Edit tour

Windows Analysis Report
getscreen-156413884-x86.exe

Overview

General Information

Sample name:	getscreen-156413884-x86.exe
Analysis ID:	1492032
MD5:	2e9de68641b502474e5ba330fe5396bb
SHA1:	a7a07fcc8643fec59e4684aaa66c64c3232e693f
SHA256:	f942c4a0313d288bf7a48aa6438ddcec9fbcccd0e8c0107b61b233a0a823731a
Infos:

Detection

Score:	54
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	47
Range:	0 - 100

Signatures

Modifies Internet Explorer zonemap settings

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Queries sensitive sound device information (via WMI, Win32_SoundDevice, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to simulate mouse events

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Sample file is different than original file name gathered from version info

Sigma detected: IE Change Domain Zone

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64native

getscreen-156413884-x86.exe (PID: 4144 cmdline: "C:\Users\user\Desktop\getscreen-156413884-x86.exe" MD5: 2E9DE68641B502474E5BA330FE5396BB)

getscreen-156413884-x86.exe (PID: 6696 cmdline: "C:\Users\user\Desktop\getscreen-156413884-x86.exe" -gpipe \\.\pipe\PCommand97tdpsimneriwgrzu -gui MD5: 2E9DE68641B502474E5BA330FE5396BB)

getscreen-156413884-x86.exe (PID: 5100 cmdline: "C:\Users\user\Desktop\getscreen-156413884-x86.exe" -cpipe \\.\pipe\PCommand96gztzxiecsokzuwc -cmem 0000pipe0PCommand96gztzxiecsokzuwcm969vla39a23oue -child MD5: 2E9DE68641B502474E5BA330FE5396BB)

nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe (PID: 2748 cmdline: "C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe" -elevate \\.\pipe\elevateGS512nqdzlqpayjfioefvlkmbvgukrpwcnna MD5: 2E9DE68641B502474E5BA330FE5396BB)

svchost.exe (PID: 6616 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon MD5: F586835082F632DC8D9404D83BC16316)

cleanup

Sigma Signatures

Sigma detected: IE Change Domain Zone

Source: Registry Key set

Author: frack113: Data: Details: 2, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\getscreen-156413884-x86.exe, ProcessId: 6696, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\getscreen.me\http

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon, CommandLine: C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 908, ProcessCommandLine: C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon, ProcessId: 6616, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Cryptography

Uses Microsoft's Enhanced Cryptographic Provider

Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 0_2_00D5584E crypto_cert_get_dns_names,	0_2_00D5584E
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 0_2_00D55831 crypto_cert_free,	0_2_00D55831
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 0_2_00E32165 freerdp_assistance_encrypt_pass_stub,	0_2_00E32165
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 0_2_00D55966 crypto_cert_get_public_key,	0_2_00D55966
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 0_2_00D56105 crypto_rsa_private_encrypt,	0_2_00D56105
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 0_2_00D5590A crypto_cert_get_email,	0_2_00D5590A
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 0_2_00D5612F crypto_rsa_public_encrypt,	0_2_00D5612F
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 0_2_00D55ABB crypto_cert_hash,	0_2_00D55ABB
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 0_2_00D55A65 crypto_cert_get_upn,	0_2_00D55A65
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 0_2_00D55A61 crypto_cert_get_signature_alg,	0_2_00D55A61
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 0_2_00D67B3F crypto_base64_encode,	0_2_00D67B3F
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 0_2_00D55B39 crypto_cert_print_info,crypto_cert_subject,crypto_cert_issuer,crypto_cert_fingerprint,	0_2_00D55B39
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 0_2_00D55B24 crypto_cert_issuer,	0_2_00D55B24
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 0_2_00D67B24 crypto_base64_decode,	0_2_00D67B24
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 0_2_00DAE437 _EncryptMessage@16,InitOnceExecuteOnce,	0_2_00DAE437
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 0_2_00DAE42E _DecryptMessage@16,InitOnceExecuteOnce,	0_2_00DAE42E
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 0_2_00D55D97 crypto_cert_subject_alt_name,	0_2_00D55D97
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 0_2_00D55D82 crypto_cert_subject,	0_2_00D55D82
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 0_2_00D55DA5 crypto_cert_subject_common_name,	0_2_00D55DA5
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 0_2_00D55D58 crypto_cert_read,	0_2_00D55D58
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 0_2_00D55ED1 crypto_reverse,	0_2_00D55ED1
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 0_2_00D55E14 crypto_get_certificate_data,crypto_cert_fingerprint,crypto_cert_issuer,crypto_cert_subject,certificate_data_new,	0_2_00D55E14
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 0_2_00E32620 freerdp_assistance_get_encrypted_pass_stub,	0_2_00E32620
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 0_2_00D55782 crypto_cert_fingerprint_by_hash,crypto_cert_hash,	0_2_00D55782
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 0_2_00D5576E crypto_cert_fingerprint,crypto_cert_fingerprint_by_hash,	0_2_00D5576E
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 0_2_00D63F1C certificate_data_new,crypto_base64_encode,crypto_base64_encode,	0_2_00D63F1C
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 0_2_00D55732 crypto_cert_dns_names_free,	0_2_00D55732
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 2_2_00D5584E crypto_cert_get_dns_names,	2_2_00D5584E
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 2_2_00D55831 crypto_cert_free,	2_2_00D55831
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 2_2_00E32165 freerdp_assistance_encrypt_pass_stub,	2_2_00E32165
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 2_2_00D55966 crypto_cert_get_public_key,	2_2_00D55966
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 2_2_00D56105 crypto_rsa_private_encrypt,	2_2_00D56105
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 2_2_00D5590A crypto_cert_get_email,	2_2_00D5590A
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 2_2_00D5612F crypto_rsa_public_encrypt,	2_2_00D5612F
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 2_2_00D55ABB crypto_cert_hash,	2_2_00D55ABB
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 2_2_00D55A65 crypto_cert_get_upn,	2_2_00D55A65
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 2_2_00D55A61 crypto_cert_get_signature_alg,	2_2_00D55A61
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 2_2_00D67B3F crypto_base64_encode,	2_2_00D67B3F
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 2_2_00D55B39 crypto_cert_print_info,crypto_cert_subject,crypto_cert_issuer,crypto_cert_fingerprint,	2_2_00D55B39
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 2_2_00D55B24 crypto_cert_issuer,	2_2_00D55B24
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 2_2_00D67B24 crypto_base64_decode,	2_2_00D67B24
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 2_2_00DAE437 _EncryptMessage@16,InitOnceExecuteOnce,	2_2_00DAE437
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 2_2_00DAE42E _DecryptMessage@16,InitOnceExecuteOnce,	2_2_00DAE42E
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 2_2_00D55D97 crypto_cert_subject_alt_name,	2_2_00D55D97
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 2_2_00D55D82 crypto_cert_subject,	2_2_00D55D82
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 2_2_00D55DA5 crypto_cert_subject_common_name,	2_2_00D55DA5
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 2_2_00D55D58 crypto_cert_read,	2_2_00D55D58
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 2_2_00D55ED1 crypto_reverse,	2_2_00D55ED1
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 2_2_00D55E14 crypto_get_certificate_data,crypto_cert_fingerprint,crypto_cert_issuer,crypto_cert_subject,certificate_data_new,	2_2_00D55E14
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 2_2_00E32620 freerdp_assistance_get_encrypted_pass_stub,	2_2_00E32620
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 2_2_00D55782 crypto_cert_fingerprint_by_hash,crypto_cert_hash,	2_2_00D55782
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 2_2_00D5576E crypto_cert_fingerprint,crypto_cert_fingerprint_by_hash,	2_2_00D5576E
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 2_2_00D63F1C certificate_data_new,crypto_base64_encode,crypto_base64_encode,	2_2_00D63F1C
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 2_2_00D55732 crypto_cert_dns_names_free,	2_2_00D55732
Source: C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe	Code function: 3_2_00DA584E crypto_cert_get_dns_names,	3_2_00DA584E
Source: C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe	Code function: 3_2_00DA5831 crypto_cert_free,	3_2_00DA5831
Source: C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe	Code function: 3_2_00E82165 freerdp_assistance_encrypt_pass_stub,	3_2_00E82165
Source: C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe	Code function: 3_2_00DA5966 crypto_cert_get_public_key,	3_2_00DA5966
Source: C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe	Code function: 3_2_00DA590A crypto_cert_get_email,	3_2_00DA590A
Source: C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe	Code function: 3_2_00DA6105 crypto_rsa_private_encrypt,	3_2_00DA6105
Source: C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe	Code function: 3_2_00DA612F crypto_rsa_public_encrypt,	3_2_00DA612F
Source: C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe	Code function: 3_2_00DA5ABB crypto_cert_hash,	3_2_00DA5ABB
Source: C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe	Code function: 3_2_00DA5A61 crypto_cert_get_signature_alg,	3_2_00DA5A61
Source: C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe	Code function: 3_2_00DA5A65 crypto_cert_get_upn,	3_2_00DA5A65
Source: C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe	Code function: 3_2_00DA5B39 crypto_cert_print_info,crypto_cert_subject,crypto_cert_issuer,crypto_cert_fingerprint,	3_2_00DA5B39
Source: C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe	Code function: 3_2_00DB7B3F crypto_base64_encode,	3_2_00DB7B3F
Source: C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe	Code function: 3_2_00DA5B24 crypto_cert_issuer,	3_2_00DA5B24
Source: C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe	Code function: 3_2_00DB7B24 crypto_base64_decode,	3_2_00DB7B24
Source: C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe	Code function: 3_2_00DFE437 _EncryptMessage@16,InitOnceExecuteOnce,	3_2_00DFE437
Source: C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe	Code function: 3_2_00DFE42E _DecryptMessage@16,InitOnceExecuteOnce,	3_2_00DFE42E
Source: C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe	Code function: 3_2_00DA5D97 crypto_cert_subject_alt_name,	3_2_00DA5D97
Source: C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe	Code function: 3_2_00DA5D82 crypto_cert_subject,	3_2_00DA5D82
Source: C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe	Code function: 3_2_00DA5DA5 crypto_cert_subject_common_name,	3_2_00DA5DA5
Source: C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe	Code function: 3_2_00DA5D58 crypto_cert_read,	3_2_00DA5D58
Source: C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe	Code function: 3_2_00DA5ED1 crypto_reverse,	3_2_00DA5ED1
Source: C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe	Code function: 3_2_00E82620 freerdp_assistance_get_encrypted_pass_stub,	3_2_00E82620
Source: C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe	Code function: 3_2_00DA5E14 crypto_get_certificate_data,crypto_cert_fingerprint,crypto_cert_issuer,crypto_cert_subject,certificate_data_new,	3_2_00DA5E14
Source: C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe	Code function: 3_2_00DA5782 crypto_cert_fingerprint_by_hash,crypto_cert_hash,	3_2_00DA5782
Source: C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe	Code function: 3_2_00DA576E crypto_cert_fingerprint,crypto_cert_fingerprint_by_hash,	3_2_00DA576E
Source: C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe	Code function: 3_2_00DB3F1C certificate_data_new,crypto_base64_encode,crypto_base64_encode,	3_2_00DB3F1C
Source: C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe	Code function: 3_2_00DA5732 crypto_cert_dns_names_free,	3_2_00DA5732

Bitcoin Miner

Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION getscreen-156413884-x86.exe			Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION getscreen-156413884-x86.exe			Jump to behavior

Compliance

Uses 32bit PE files

Source: getscreen-156413884-x86.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

PE / OLE file has a valid certificate

Source: getscreen-156413884-x86.exe

Static PE information: certificate valid

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: getscreen-156413884-x86.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:

Binary string: C:\Project\agent-windows\console\Win32\Release\getscreen.pdb source: getscreen-156413884-x86.exe, 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, getscreen-156413884-x86.exe, 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe, 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmp, getscreen-156413884-x86.exe, 00000005.00000002.18459920353.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp

Networking

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 78.47.165.25 78.47.165.25

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: HETZNER-ASDE HETZNER-ASDE

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /signal/agent HTTP/1.1Host: getscreen.meUpgrade: websocketConnection: UpgradeSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==Origin: https://getscreen.meSec-WebSocket-Protocol: chat, superchatSec-WebSocket-Version: 13User-Agent: Getscreen.me/2.21.3 (Win, getscreen.me, 2)
Source: global traffic	HTTP traffic detected: GET /signal/agent HTTP/1.1Host: getscreen.meUpgrade: websocketConnection: UpgradeSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==Origin: https://getscreen.meSec-WebSocket-Protocol: chat, superchatSec-WebSocket-Version: 13User-Agent: Getscreen.me/2.21.3 (Win, getscreen.me, 2)
Source: global traffic	HTTP traffic detected: GET /signal/agent HTTP/1.1Host: getscreen.meUpgrade: websocketConnection: UpgradeSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==Origin: https://getscreen.meSec-WebSocket-Protocol: chat, superchatSec-WebSocket-Version: 13User-Agent: Getscreen.me/2.21.3 (Win, getscreen.me, 2)
Source: global traffic	HTTP traffic detected: GET /signal/agent HTTP/1.1Host: getscreen.meUpgrade: websocketConnection: UpgradeSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==Origin: https://getscreen.meSec-WebSocket-Protocol: chat, superchatSec-WebSocket-Version: 13User-Agent: Getscreen.me/2.21.3 (Win, getscreen.me, 2)
Source: global traffic	HTTP traffic detected: GET /signal/agent HTTP/1.1Host: getscreen.meUpgrade: websocketConnection: UpgradeSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==Origin: https://getscreen.meSec-WebSocket-Protocol: chat, superchatSec-WebSocket-Version: 13User-Agent: Getscreen.me/2.21.3 (Win, getscreen.me, 2)
Source: global traffic	HTTP traffic detected: GET /signal/agent HTTP/1.1Host: getscreen.meUpgrade: websocketConnection: UpgradeSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==Origin: https://getscreen.meSec-WebSocket-Protocol: chat, superchatSec-WebSocket-Version: 13User-Agent: Getscreen.me/2.21.3 (Win, getscreen.me, 2)
Source: global traffic	HTTP traffic detected: GET /signal/agent HTTP/1.1Host: getscreen.meUpgrade: websocketConnection: UpgradeSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==Origin: https://getscreen.meSec-WebSocket-Protocol: chat, superchatSec-WebSocket-Version: 13User-Agent: Getscreen.me/2.21.3 (Win, getscreen.me, 2)
Source: global traffic	HTTP traffic detected: GET /signal/agent HTTP/1.1Host: getscreen.meUpgrade: websocketConnection: UpgradeSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==Origin: https://getscreen.meSec-WebSocket-Protocol: chat, superchatSec-WebSocket-Version: 13User-Agent: Getscreen.me/2.21.3 (Win, getscreen.me, 2)
Source: global traffic	HTTP traffic detected: GET /signal/agent HTTP/1.1Host: getscreen.meUpgrade: websocketConnection: UpgradeSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==Origin: https://getscreen.meSec-WebSocket-Protocol: chat, superchatSec-WebSocket-Version: 13User-Agent: Getscreen.me/2.21.3 (Win, getscreen.me, 2)

Source: global traffic

DNS traffic detected: DNS query: getscreen.me

Source: getscreen-156413884-x86.exe, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: getscreen-156413884-x86.exe, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: getscreen-156413884-x86.exe, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: getscreen-156413884-x86.exe, 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, getscreen-156413884-x86.exe, 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe, 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, getscreen-156413884-x86.exe, 00000005.00000002.18459920353.0000000000741000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: getscreen-156413884-x86.exe, 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, getscreen-156413884-x86.exe, 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe, 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, getscreen-156413884-x86.exe, 00000005.00000002.18459920353.0000000000741000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl0
Source: getscreen-156413884-x86.exe, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: getscreen-156413884-x86.exe, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: getscreen-156413884-x86.exe, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: getscreen-156413884-x86.exe, 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, getscreen-156413884-x86.exe, 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe, 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, getscreen-156413884-x86.exe, 00000005.00000002.18459920353.0000000000741000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: getscreen-156413884-x86.exe, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: getscreen-156413884-x86.exe, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: getscreen-156413884-x86.exe, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: getscreen-156413884-x86.exe, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: getscreen-156413884-x86.exe, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: getscreen-156413884-x86.exe, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: getscreen-156413884-x86.exe, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe.0.dr	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: getscreen-156413884-x86.exe, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe.0.dr	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: getscreen-156413884-x86.exe, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe.0.dr	String found in binary or memory: http://ocsp.globalsign.com/rootr30;
Source: getscreen-156413884-x86.exe, 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, getscreen-156413884-x86.exe, 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe, 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmp, getscreen-156413884-x86.exe, 00000005.00000002.18459920353.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://proxy.contoso.com:3128/
Source: getscreen-156413884-x86.exe, 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmp, getscreen-156413884-x86.exe, 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmp, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe, 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmp, getscreen-156413884-x86.exe, 00000005.00000002.18459920353.0000000001DCA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://proxy.pcommand.com:3128
Source: getscreen-156413884-x86.exe, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: getscreen-156413884-x86.exe, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: getscreen-156413884-x86.exe, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/root-r3.crt06
Source: getscreen-156413884-x86.exe, 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, getscreen-156413884-x86.exe, 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe, 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, getscreen-156413884-x86.exe, 00000005.00000002.18459920353.0000000000741000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
Source: getscreen-156413884-x86.exe, 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, getscreen-156413884-x86.exe, 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe, 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, getscreen-156413884-x86.exe, 00000005.00000002.18459920353.0000000000741000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01http://www.webrtc.org/exper
Source: getscreen-156413884-x86.exe, 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, getscreen-156413884-x86.exe, 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe, 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, getscreen-156413884-x86.exe, 00000005.00000002.18459920353.0000000000741000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/abs-capture-time
Source: getscreen-156413884-x86.exe, 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, getscreen-156413884-x86.exe, 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe, 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, getscreen-156413884-x86.exe, 00000005.00000002.18459920353.0000000000741000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/abs-capture-timeurn:3gpp:video-orientationhttp://www.we
Source: getscreen-156413884-x86.exe, 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, getscreen-156413884-x86.exe, 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe, 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, getscreen-156413884-x86.exe, 00000005.00000002.18459920353.0000000000741000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time
Source: getscreen-156413884-x86.exe, 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, getscreen-156413884-x86.exe, 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe, 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, getscreen-156413884-x86.exe, 00000005.00000002.18459920353.0000000000741000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/color-space
Source: getscreen-156413884-x86.exe, 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, getscreen-156413884-x86.exe, 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe, 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, getscreen-156413884-x86.exe, 00000005.00000002.18459920353.0000000000741000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/generic-frame-descriptor-00
Source: getscreen-156413884-x86.exe, 00000005.00000002.18459920353.0000000000741000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/inband-cn
Source: getscreen-156413884-x86.exe, 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, getscreen-156413884-x86.exe, 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe, 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, getscreen-156413884-x86.exe, 00000005.00000002.18459920353.0000000000741000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/playout-delay
Source: getscreen-156413884-x86.exe, 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, getscreen-156413884-x86.exe, 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe, 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, getscreen-156413884-x86.exe, 00000005.00000002.18459920353.0000000000741000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/transport-wide-cc-02
Source: getscreen-156413884-x86.exe, 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, getscreen-156413884-x86.exe, 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe, 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, getscreen-156413884-x86.exe, 00000005.00000002.18459920353.0000000000741000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/video-content-type
Source: getscreen-156413884-x86.exe, 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, getscreen-156413884-x86.exe, 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe, 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, getscreen-156413884-x86.exe, 00000005.00000002.18459920353.0000000000741000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/video-frame-tracking-id
Source: getscreen-156413884-x86.exe, 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, getscreen-156413884-x86.exe, 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe, 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, getscreen-156413884-x86.exe, 00000005.00000002.18459920353.0000000000741000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/video-layers-allocation00
Source: getscreen-156413884-x86.exe, 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, getscreen-156413884-x86.exe, 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe, 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, getscreen-156413884-x86.exe, 00000005.00000002.18459920353.0000000000741000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/video-timing
Source: getscreen-156413884-x86.exe, 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, getscreen-156413884-x86.exe, 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe, 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmp, getscreen-156413884-x86.exe, 00000005.00000002.18459920353.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://%S/%S/agent/chat$.typeoutprocessData4Z
Source: getscreen-156413884-x86.exe, 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, getscreen-156413884-x86.exe, 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe, 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, getscreen-156413884-x86.exe, 00000005.00000002.18459920353.0000000000741000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://aomediacodec.github.io/av1-rtp-spec/#dependency-descriptor-rtp-header-extension
Source: getscreen-156413884-x86.exe, 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, getscreen-156413884-x86.exe, 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe, 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmp, getscreen-156413884-x86.exe, 00000005.00000002.18459920353.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://getscreen.me/agent-policy
Source: getscreen-156413884-x86.exe, 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, getscreen-156413884-x86.exe, 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe, 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmp, getscreen-156413884-x86.exe, 00000005.00000002.18459920353.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://getscreen.me/agent-policyhttps://%s/docs/agenthttps://%s/?utm_source=agent&utm_campaign=link
Source: getscreen-156413884-x86.exe, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe.0.dr	String found in binary or memory: https://www.globalsign.com/repository/0

Source: unknown	Network traffic detected: HTTP traffic on port 50693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51422 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52633 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50211 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50452 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51663 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51548 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50578 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50440 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53603 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52518 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51410 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50325 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51524 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52645 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50464 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52404 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51319 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50439 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52608 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51651 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50337 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52506 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51320 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50566 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50235 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52416 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53627 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51512 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50591 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50301 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52302 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50656 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50247 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51561 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54609 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51446 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51626 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50313 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51434 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52555 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50259 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53615 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51307 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51500 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51573 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52621 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51638 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52428 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50644 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53411 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52516
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52517
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53847
Source: unknown	Network traffic detected: HTTP traffic on port 50386 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51115 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52514
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52515
Source: unknown	Network traffic detected: HTTP traffic on port 52567 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52518
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52519
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53840
Source: unknown	Network traffic detected: HTTP traffic on port 50632 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52512
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53844
Source: unknown	Network traffic detected: HTTP traffic on port 50873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52513
Source: unknown	Network traffic detected: HTTP traffic on port 53537 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52510
Source: unknown	Network traffic detected: HTTP traffic on port 53778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53842
Source: unknown	Network traffic detected: HTTP traffic on port 52326 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52511
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53841
Source: unknown	Network traffic detected: HTTP traffic on port 50758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52527
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52528
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52525
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53857
Source: unknown	Network traffic detected: HTTP traffic on port 50505 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52526
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52529
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52520
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53850
Source: unknown	Network traffic detected: HTTP traffic on port 50987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52453 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52523
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53855
Source: unknown	Network traffic detected: HTTP traffic on port 51001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52524
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52521
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52522
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53852
Source: unknown	Network traffic detected: HTTP traffic on port 53910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53652 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52200 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52338 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51207
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52538
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51208
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52539
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51205
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52536
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51206
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52537
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51209
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52530
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51200
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52531
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51203
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52534
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51204
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52535
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53865
Source: unknown	Network traffic detected: HTTP traffic on port 54851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50374 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51201
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52532
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51202
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52533
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53863
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51254 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50620 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52314 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53525 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51218
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52549
Source: unknown	Network traffic detected: HTTP traffic on port 53922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51219
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51216
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52547
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51217
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52548
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51210
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52541
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51211
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52542
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52540
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51214
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52545
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53877
Source: unknown	Network traffic detected: HTTP traffic on port 50897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51215
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52546
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51212
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52543
Source: unknown	Network traffic detected: HTTP traffic on port 53664 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51213
Source: unknown	Network traffic detected: HTTP traffic on port 52212 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52544
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53874
Source: unknown	Network traffic detected: HTTP traffic on port 52579 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53880
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52441 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53803
Source: unknown	Network traffic detected: HTTP traffic on port 51140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53802
Source: unknown	Network traffic detected: HTTP traffic on port 52592 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53805
Source: unknown	Network traffic detected: HTTP traffic on port 51266 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53800
Source: unknown	Network traffic detected: HTTP traffic on port 51025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52477 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50350 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53809
Source: unknown	Network traffic detected: HTTP traffic on port 50607 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50362 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53811
Source: unknown	Network traffic detected: HTTP traffic on port 51806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53810
Source: unknown	Network traffic detected: HTTP traffic on port 51139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52580 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53501 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50476 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53639 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53823
Source: unknown	Network traffic detected: HTTP traffic on port 51790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53827
Source: unknown	Network traffic detected: HTTP traffic on port 53640 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50619 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53822
Source: unknown	Network traffic detected: HTTP traffic on port 54700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53821
Source: unknown	Network traffic detected: HTTP traffic on port 51675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53820
Source: unknown	Network traffic detected: HTTP traffic on port 50223 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51409 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50349 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52465 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52505
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52506
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53836
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52503
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53835
Source: unknown	Network traffic detected: HTTP traffic on port 54430 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52504
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52509
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52507
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52508
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52501
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52502
Source: unknown	Network traffic detected: HTTP traffic on port 53513 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53832
Source: unknown	Network traffic detected: HTTP traffic on port 50488 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53831
Source: unknown	Network traffic detected: HTTP traffic on port 50746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52500
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53830
Source: unknown	Network traffic detected: HTTP traffic on port 53909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54303 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51278 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51536 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51144
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52475
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51145
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52476
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51142
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52473
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51143
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52474
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51148
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52479
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51149
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51146
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52477
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51147
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52478
Source: unknown	Network traffic detected: HTTP traffic on port 54201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51151
Source: unknown	Network traffic detected: HTTP traffic on port 52146 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52482
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51152
Source: unknown	Network traffic detected: HTTP traffic on port 52387 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52483
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52480
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51150
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52481
Source: unknown	Network traffic detected: HTTP traffic on port 53598 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53357 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54568 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52375 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53345 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51155
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52486
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51156
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52487
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51153
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52484
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51154
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52485
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51159
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51157
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52488
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51158
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52489
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52490
Source: unknown	Network traffic detected: HTTP traffic on port 54442 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51162
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52493
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51163
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52494
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51160
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52491
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52492
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51161
Source: unknown	Network traffic detected: HTTP traffic on port 50812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52158 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51166
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52497
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52498
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51164
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52495
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52496
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51165
Source: unknown	Network traffic detected: HTTP traffic on port 53369 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52499
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51169
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51170
Source: unknown	Network traffic detected: HTTP traffic on port 54191 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51173
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51174
Source: unknown	Network traffic detected: HTTP traffic on port 53196 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51171
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51172
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51177
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51178
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51175
Source: unknown	Network traffic detected: HTTP traffic on port 53104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51176
Source: unknown	Network traffic detected: HTTP traffic on port 54556 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51179
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51180
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51181
Source: unknown	Network traffic detected: HTTP traffic on port 54225 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51184
Source: unknown	Network traffic detected: HTTP traffic on port 54785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51185
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51182
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51183
Source: unknown	Network traffic detected: HTTP traffic on port 53333 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53562 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54454 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52439
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51109
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52437
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51107
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52438
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53768
Source: unknown	Network traffic detected: HTTP traffic on port 54395 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54532 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51100
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52431
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52432
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52430
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52435
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52436
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52433
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51103
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52434
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53770
Source: unknown	Network traffic detected: HTTP traffic on port 50848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52448
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51118
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52449
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53779
Source: unknown	Network traffic detected: HTTP traffic on port 52109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51111
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52442
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52440
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53772

System Summary

Detected potential crypto function

Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 0_2_0078B080	0_2_0078B080
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 0_2_007701A0	0_2_007701A0
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 0_2_007B89A0	0_2_007B89A0
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 0_2_007AA30D	0_2_007AA30D
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 0_2_007A7300	0_2_007A7300
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 0_2_007A6657	0_2_007A6657
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 0_2_00769700	0_2_00769700
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 2_2_0078B080	2_2_0078B080
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 2_2_007B89A0	2_2_007B89A0
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 2_2_007AA30D	2_2_007AA30D
Source: C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe	Code function: 3_2_007DB080	3_2_007DB080
Source: C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe	Code function: 3_2_008089A0	3_2_008089A0
Source: C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe	Code function: 3_2_007FA30D	3_2_007FA30D

Found potential string decryption / allocating functions

Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: String function: 00DA2354 appears 104 times
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: String function: 00DAE717 appears 202 times
Source: C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe	Code function: String function: 00DFE717 appears 101 times
Source: C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe	Code function: String function: 00DF2354 appears 54 times

PE file contains executable resources (Code or Archives)

Source: getscreen-156413884-x86.exe	Static PE information: Resource name: AFX_DIALOG_LAYOUT type: DOS executable (COM, 0x8C-variant)
Source: getscreen-156413884-x86.exe	Static PE information: Resource name: RT_ICON type: DOS executable (COM)
Source: getscreen-156413884-x86.exe	Static PE information: Resource name: RT_DIALOG type: DOS executable (COM, 0x8C-variant)
Source: nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe.0.dr	Static PE information: Resource name: AFX_DIALOG_LAYOUT type: DOS executable (COM, 0x8C-variant)
Source: nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe.0.dr	Static PE information: Resource name: RT_ICON type: DOS executable (COM)
Source: nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe.0.dr	Static PE information: Resource name: RT_DIALOG type: DOS executable (COM, 0x8C-variant)

Sample file is different than original file name gathered from version info

Source: getscreen-156413884-x86.exe, 00000000.00000000.18278768516.0000000001E93000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamegetscreen.exe: vs getscreen-156413884-x86.exe
Source: getscreen-156413884-x86.exe, 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamegetscreen.exe: vs getscreen-156413884-x86.exe
Source: getscreen-156413884-x86.exe, 00000002.00000000.18281989878.0000000001E93000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamegetscreen.exe: vs getscreen-156413884-x86.exe
Source: getscreen-156413884-x86.exe, 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamegetscreen.exe: vs getscreen-156413884-x86.exe
Source: getscreen-156413884-x86.exe, 00000005.00000002.18462085276.0000000001E93000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamegetscreen.exe: vs getscreen-156413884-x86.exe
Source: getscreen-156413884-x86.exe, 00000005.00000000.18308536261.0000000001E93000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamegetscreen.exe: vs getscreen-156413884-x86.exe
Source: getscreen-156413884-x86.exe	Binary or memory string: OriginalFilenamegetscreen.exe: vs getscreen-156413884-x86.exe

Uses 32bit PE files

Source: getscreen-156413884-x86.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal54.phis.evad.winEXE@8/5@5/2

Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe

File created: C:\Users\user\AppData\Local\Getscreen.me

Jump to behavior

Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe

Mutant created: \Sessions\1\BaseNamedObjects\Global\PCommandMutextTurbo96phqghum

Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name, NumberOfCores, NumberOfLogicalProcessors, MaxClockSpeed, Caption FROM Win32_Processor

Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe

File read: C:\Users\user\Desktop\getscreen-156413884-x86.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\getscreen-156413884-x86.exe "C:\Users\user\Desktop\getscreen-156413884-x86.exe"
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Process created: C:\Users\user\Desktop\getscreen-156413884-x86.exe "C:\Users\user\Desktop\getscreen-156413884-x86.exe" -gpipe \\.\pipe\PCommand97tdpsimneriwgrzu -gui
Source: unknown	Process created: C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe "C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe" -elevate \\.\pipe\elevateGS512nqdzlqpayjfioefvlkmbvgukrpwcnna
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Process created: C:\Users\user\Desktop\getscreen-156413884-x86.exe "C:\Users\user\Desktop\getscreen-156413884-x86.exe" -cpipe \\.\pipe\PCommand96gztzxiecsokzuwc -cmem 0000pipe0PCommand96gztzxiecsokzuwcm969vla39a23oue -child
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Process created: C:\Users\user\Desktop\getscreen-156413884-x86.exe "C:\Users\user\Desktop\getscreen-156413884-x86.exe" -gpipe \\.\pipe\PCommand97tdpsimneriwgrzu -gui	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Users\user\Desktop\getscreen-156413884-x86.exe "C:\Users\user\Desktop\getscreen-156413884-x86.exe" -cpipe \\.\pipe\PCommand96gztzxiecsokzuwc -cmem 0000pipe0PCommand96gztzxiecsokzuwcm969vla39a23oue -child	Jump to behavior

Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: sas.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: dsparse.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: mfwmaaec.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4}\InprocServer32

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

PE / OLE file has a valid certificate

Source: getscreen-156413884-x86.exe

Static PE information: certificate valid

Submission file is bigger than most known malware samples

Source: getscreen-156413884-x86.exe

Static file information: File size 3654440 > 1048576

PE file has a big raw section

Source: getscreen-156413884-x86.exe

Static PE information: Raw size of UPX1 is bigger than: 0x100000 < 0x374e00

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: getscreen-156413884-x86.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:

Data Obfuscation

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe

Code function: 0_2_01E929E0 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

0_2_01E929E0

PE file contains an invalid checksum

Source: nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe.0.dr	Static PE information: real checksum: 0x38a69d should be: 0x3882ba
Source: getscreen-156413884-x86.exe	Static PE information: real checksum: 0x38a69d should be: 0x3882ba

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Drops PE files

Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe

File created: C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe

Jump to dropped file

Drops PE files to the application program directory (C:\ProgramData)

Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe

File created: C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Extensive use of GetProcAddress (often used to hide API calls)

Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe

Code function: 0_2_00DB7449 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00DB7449

Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries memory information (via WMI often done to detect virtual machines)

Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT BankLabel, DeviceLocator, DataWidth, Manufacturer, PartNumber, SerialNumber, Capacity FROM Win32_PhysicalMemory

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Caption, Size FROM Win32_DiskDrive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name, Manufacturer, MACAddress, Speed, InterfaceIndex, Index, GUID FROM Win32_NetworkAdapter WHERE PhysicalAdapter=TRUE
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT DHCPServer, DNSServerSearchOrder, IPAddress FROM Win32_NetworkAdapterConfiguration WHERE InterfaceIndex = 1
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT DHCPServer, DNSServerSearchOrder, IPAddress FROM Win32_NetworkAdapterConfiguration WHERE InterfaceIndex = 2
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT IPAddress FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled = 'True'
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT IPAddress FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled = 'True'

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT BankLabel, DeviceLocator, DataWidth, Manufacturer, PartNumber, SerialNumber, Capacity FROM Win32_PhysicalMemory

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Caption, VolumeName, FileSystem, Size, FreeSpace FROM Win32_LogicalDisk

Queries sensitive sound device information (via WMI, Win32_SoundDevice, often done to detect virtual machines)

Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Caption FROM Win32_SoundDevice

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	System information queried: FirmwareTableInformation	Jump to behavior

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Window / User API: threadDelayed 1075	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Window / User API: threadDelayed 9974	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Window / User API: threadDelayed 959	Jump to behavior

Found large amount of non-executed APIs

Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	API coverage: 2.6 %
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	API coverage: 1.2 %
Source: C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe	API coverage: 1.6 %

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe TID: 1732	Thread sleep count: 282 > 30	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe TID: 2448	Thread sleep count: 1075 > 30	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe TID: 2736	Thread sleep count: 240 > 30	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe TID: 3524	Thread sleep count: 257 > 30	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe TID: 5512	Thread sleep count: 255 > 30	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe TID: 2476	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe TID: 7304	Thread sleep count: 202 > 30	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe TID: 2464	Thread sleep count: 183 > 30	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe TID: 3540	Thread sleep count: 959 > 30	Jump to behavior

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT BIOSVersion, Name, ReleaseDate FROM Win32_BIOS
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT BIOSVersion, Name, ReleaseDate FROM Win32_BIOS

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Model, Name, Domain, Workgroup FROM Win32_ComputerSystem
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Model, Name, Domain, Workgroup FROM Win32_ComputerSystem

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name, NumberOfCores, NumberOfLogicalProcessors, MaxClockSpeed, Caption FROM Win32_Processor

Source: getscreen-156413884-x86.exe, 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, getscreen-156413884-x86.exe, 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe, 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmp, getscreen-156413884-x86.exe, 00000005.00000002.18459920353.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Hyper-V console (use port 2179, disable negotiation)
Source: getscreen-156413884-x86.exe, 00000005.00000002.18459920353.0000000000741000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VMnet
Source: getscreen-156413884-x86.exe, 00000005.00000002.18459920353.0000000000741000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: WebRTC-AllowMACBasedIPv6WebRTC-BindUsingInterfaceNameVMnetWebRTC-UseDifferentiatedCellularCostsWebRTC-AddNetworkCostToVpnNet[:id=RTy
Source: nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe, 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: WebRTC-AllowMACBasedIPv6WebRTC-BindUsingInterfaceNameVMnetWebRTC-UseDifferentiatedCellularCostsWebRTC-AddNetworkCostToVpnNet[:id=RT~
Source: getscreen-156413884-x86.exe, 00000005.00000002.18462355976.0000000002451000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll(
Source: getscreen-156413884-x86.exe, 00000000.00000002.20760521579.0000000002603000.00000004.00000020.00020000.00000000.sdmp, getscreen-156413884-x86.exe, 00000002.00000002.20758827013.0000000002263000.00000004.00000020.00020000.00000000.sdmp, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe, 00000003.00000002.18293085693.0000000000572000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	API call chain: ExitProcess graph end node	graph_0-14064
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	API call chain: ExitProcess graph end node	graph_2-12898
Source: C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe	API call chain: ExitProcess graph end node	graph_3-13797

Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe

Code function: 0_2_00E061B5 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00E061B5

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe

Code function: 0_2_01E929E0 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

0_2_01E929E0

Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 0_2_00E061B5 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00E061B5
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 0_2_00DFFCA9 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00DFFCA9
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Code function: 2_2_00DFFCA9 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00DFFCA9
Source: C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe	Code function: 3_2_00E561B5 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00E561B5
Source: C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe	Code function: 3_2_00E4FCA9 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00E4FCA9

HIPS / PFW / Operating System Protection Evasion

Contains functionality to simulate mouse events

Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe

Code function: 0_2_00D573E8 freerdp_input_send_mouse_event,

0_2_00D573E8

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\System32\svchost.exe

Process created: C:\Users\user\Desktop\getscreen-156413884-x86.exe "C:\Users\user\Desktop\getscreen-156413884-x86.exe" -cpipe \\.\pipe\PCommand96gztzxiecsokzuwc -cmem 0000pipe0PCommand96gztzxiecsokzuwcm969vla39a23oue -child

Jump to behavior

Source: getscreen-156413884-x86.exe, 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, getscreen-156413884-x86.exe, 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe, 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmp

Binary or memory string: loselink.button.copymain.isntall.howconnection.session.titleconnection.menu.copyconnection.menu.generatelogin.password.titlelogin.password.ennterlogin.active.help.1login.link.dashboard.1login.link.dashboard.2login.link.registerlogin.link.restorelogin.link.help.1login.link.help.2login.active.device.titlelogin.active.contactlogin.menu.dashboardlogin.menu.logoutsettings.common.titlesettings.common.agentsettings.common.languagesettings.common.startupsettings.common.onetimesettings.common.adminsettings.permission.titlesettings.permission.controlsettings.permission.audiosettings.permission.micsettings.permission.filesettings.permission.lock_inputsettings.permission.confirmsettings.proxy.buttoninvite.disableinvite.button.agreecall.income.textcall.income.acceptcall.income.rejectcall.out.textcall.out.cancelcall.connect.textcall.connect.closecall.active.closecall.rejecet.textcall.rejecet.againcall.rejecet.closecall.finish.textcall.finish.closeturbo.button.hideturbo.button.endturbo.button.proxyturbo.button.closeturbo.button.callturbo.button.chatturbo.confirm.closeturbo.confirm.close.yesturbo.confirm.close.noturbo.menu.exitturbo.menu.chatturbo.menu.showsettings.proxy.usesettings.proxy.serversettings.proxy.loginsettings.proxy.passwordsettings.proxy.applysettings.proxy.cancelconnection.confirm.acceptinstall.turbo.line2install.turbo.confirmconnection.link.titleconnection.link.text.4connection.link.title.2connection.link.title.3connection.link.getlogin.active.help.title.headlogin.active.help.title.2login.active.help.title.3connection.menu.clipboardconnection.menu.diactivateconnection.menu.disableShell_traywnd z

Language, Device and Operating System Detection

Contains functionality to query CPU information (cpuid)

Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe

Code function: 0_2_007B89A0 cpuid

0_2_007B89A0

Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe

Code function: 0_2_00D6E4DD rfx_context_new,GetVersionExA,GetNativeSystemInfo,RegOpenKeyExA,primitives_get,CreateThreadpool,rfx_context_set_pixel_format,

0_2_00D6E4DD

Lowering of HIPS / PFW / Operating System Security Settings

Modifies Internet Explorer zonemap settings

Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\getscreen.me http	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\getscreen.me https	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\getscreen.me http	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\getscreen.me https	Jump to behavior

Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION			Jump to behavior
Source: C:\Users\user\Desktop\getscreen-156413884-x86.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION			Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	631 Windows Management Instrumentation	1 Scripting	12 Process Injection	1 Masquerading	OS Credential Dumping	731 Security Software Discovery	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	53 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Browser Session Hijacking	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	53 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Modify Registry	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Process Injection	LSA Secrets	133 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
getscreen-156413884-x86.exe	1%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe	1%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
getscreen.me	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://%S/%S/agent/chat$.typeoutprocessData4Z	0%	Avira URL Cloud	safe
https://aomediacodec.github.io/av1-rtp-spec/#dependency-descriptor-rtp-header-extension	0%	Avira URL Cloud	safe
http://proxy.contoso.com:3128/	0%	Avira URL Cloud	safe
https://getscreen.me/agent-policyhttps://%s/docs/agenthttps://%s/?utm_source=agent&utm_campaign=link	0%	Avira URL Cloud	safe
http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01	0%	Avira URL Cloud	safe
https://getscreen.me/signal/agent	0%	Avira URL Cloud	safe
https://getscreen.me/agent-policy	0%	Avira URL Cloud	safe
https://getscreen.me/agent-policyhttps://%s/docs/agenthttps://%s/?utm_source=agent&utm_campaign=link	0%	Virustotal		Browse
http://proxy.pcommand.com:3128	0%	Avira URL Cloud	safe
http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01	0%	Virustotal		Browse
http://proxy.contoso.com:3128/	0%	Virustotal		Browse
https://getscreen.me/agent-policy	0%	Virustotal		Browse
http://proxy.pcommand.com:3128	0%	Virustotal		Browse
https://getscreen.me/signal/agent	0%	Virustotal		Browse
https://aomediacodec.github.io/av1-rtp-spec/#dependency-descriptor-rtp-header-extension	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
getscreen.me	78.47.165.25	true	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://getscreen.me/signal/agent	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://getscreen.me/agent-policyhttps://%s/docs/agenthttps://%s/?utm_source=agent&utm_campaign=link	getscreen-156413884-x86.exe, 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, getscreen-156413884-x86.exe, 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe, 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmp, getscreen-156413884-x86.exe, 00000005.00000002.18459920353.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://proxy.contoso.com:3128/	getscreen-156413884-x86.exe, 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, getscreen-156413884-x86.exe, 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe, 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmp, getscreen-156413884-x86.exe, 00000005.00000002.18459920353.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01	getscreen-156413884-x86.exe, 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, getscreen-156413884-x86.exe, 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe, 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, getscreen-156413884-x86.exe, 00000005.00000002.18459920353.0000000000741000.00000040.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://%S/%S/agent/chat$.typeoutprocessData4Z	getscreen-156413884-x86.exe, 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, getscreen-156413884-x86.exe, 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe, 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmp, getscreen-156413884-x86.exe, 00000005.00000002.18459920353.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://aomediacodec.github.io/av1-rtp-spec/#dependency-descriptor-rtp-header-extension	getscreen-156413884-x86.exe, 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, getscreen-156413884-x86.exe, 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe, 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, getscreen-156413884-x86.exe, 00000005.00000002.18459920353.0000000000741000.00000040.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://getscreen.me/agent-policy	getscreen-156413884-x86.exe, 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, getscreen-156413884-x86.exe, 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe, 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmp, getscreen-156413884-x86.exe, 00000005.00000002.18459920353.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://proxy.pcommand.com:3128	getscreen-156413884-x86.exe, 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmp, getscreen-156413884-x86.exe, 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmp, nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe, 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmp, getscreen-156413884-x86.exe, 00000005.00000002.18459920353.0000000001DCA000.00000040.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
78.47.165.25	getscreen.me	Germany		24940	HETZNER-ASDE	true
51.89.95.37	unknown	France		16276	OVHFR	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1492032
Start date and time:	2024-08-13 09:04:36 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected VM Detection
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	getscreen-156413884-x86.exe
Detection:	MAL
Classification:	mal54.phis.evad.winEXE@8/5@5/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, backgroundTaskHost.exe
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:06:43	API Interceptor	12580321x Sleep call for process: getscreen-156413884-x86.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
78.47.165.25	getscreen-511588515.exe	Get hash	malicious	Unknown	Browse
	getscreen-973519027.exe	Get hash	malicious	Unknown	Browse
	getscreen-973519027.exe	Get hash	malicious	Unknown	Browse
	getscreen-959987858.exe	Get hash	malicious	Unknown	Browse
	getscreen-728974364.exe	Get hash	malicious	Unknown	Browse
	getscreen-728974364.exe	Get hash	malicious	Unknown	Browse
	getscreen-447303723.exe	Get hash	malicious	Unknown	Browse
	getscreen-447303723.exe	Get hash	malicious	Unknown	Browse
	getscreen-008263870.exe	Get hash	malicious	Unknown	Browse
51.89.95.37	getscreen-511588515.exe	Get hash	malicious	Unknown	Browse
	getscreen-959987858.exe	Get hash	malicious	Unknown	Browse
	getscreen-973519027.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
getscreen.me	getscreen-511588515.exe	Get hash	malicious	Unknown	Browse	5.75.168.191
	getscreen-511588515.exe	Get hash	malicious	Unknown	Browse	78.47.165.25
	getscreen-973519027.exe	Get hash	malicious	Unknown	Browse	5.75.168.191
	getscreen-959987858.exe	Get hash	malicious	Unknown	Browse	5.75.168.191
	getscreen-973519027.exe	Get hash	malicious	Unknown	Browse	51.89.95.37
	getscreen-959987858.exe	Get hash	malicious	Unknown	Browse	5.75.168.191
	getscreen-728974364.exe	Get hash	malicious	Unknown	Browse	5.75.168.191
	getscreen-728974364.exe	Get hash	malicious	Unknown	Browse	5.75.168.191
	getscreen-447303723.exe	Get hash	malicious	Unknown	Browse	78.47.165.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HETZNER-ASDE	hoho.arm.elf	Get hash	malicious	Mirai	Browse	136.243.55.31
	http://www-indonesia.zee-mi.cfd/	Get hash	malicious	Unknown	Browse	135.181.63.70
	https://bhaez.cuakss.biz.id/	Get hash	malicious	Unknown	Browse	135.181.63.70
	Monica_velez Scan to View CourtOrder.docx	Get hash	malicious	Unknown	Browse	116.202.167.133
	file.exe	Get hash	malicious	Metastealer	Browse	188.40.187.174
	$RY0TBV2.exe	Get hash	malicious	Unknown	Browse	5.161.211.130
	$RY0TBV2.exe	Get hash	malicious	Unknown	Browse	5.161.211.130
	66b9d00589bbc_doz.exe	Get hash	malicious	Vidar	Browse	78.46.239.218
	66b9d56da3bee_main.exe	Get hash	malicious	Vidar	Browse	78.46.239.218
OVHFR	http://dkpmt.ngelink.cc/4NiJac15319dpCI1377ckliwublab21000DYABYJHPBRHUKFV28279WINZ17387I18#un92gu3drmwdgxav0i4clt74ygdc5umnx660ge2pw16j2d27zp	Get hash	malicious	Unknown	Browse	51.68.39.188
	Monica_velez Scan to View CourtOrder.docx	Get hash	malicious	Unknown	Browse	5.135.209.104
	https://staging.d1suhxp7nxddnj.amplifyapp.com/	Get hash	malicious	HTMLPhisher	Browse	147.135.115.157
	Updated Handbook.docx	Get hash	malicious	Unknown	Browse	54.36.150.186
	01_extracted.exe	Get hash	malicious	Remcos	Browse	188.165.120.122
	Wordle_x64LTS.exe	Get hash	malicious	Unknown	Browse	51.89.9.253
	Wordle_x64LTS.exe	Get hash	malicious	Unknown	Browse	51.89.9.252
	Facturation.exe	Get hash	malicious	Doenerium	Browse	51.38.43.18
	https://multievmosdapp.net/	Get hash	malicious	Unknown	Browse	5.196.111.68
	http://blockdag-network-rectification.pages.dev/wallet/inputs.html/js/aes.js	Get hash	malicious	Unknown	Browse	149.202.238.101

Process:	C:\Users\user\Desktop\getscreen-156413884-x86.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	5.675704882778696
Encrypted:	false
SSDEEP:	3:BvBAwxiIIOM+C8uzP:7AwkIRJuj
MD5:	00B7C901338BF7B4226CBCF2B375518D
SHA1:	C7FFF995851586FBC2BB957535B01D976E9C36A1
SHA-256:	F9AF21F736C60A69BBCD927DB2272A67B16FAE747B9334D73C483C87F08D465F
SHA-512:	DAB0FAF0065471600C4A61A85CBF6BD66C995136282C7A4116B1BF716397CE2580689CCACE6BA247E253174CF9D6635F5B48F904ED7F143386B9D36D6CCF1D93
Malicious:	false
Reputation:	low
Preview:	...J.+.q....:.O.K.*@...[...%.....,.6.<.....2.@\.%.+.#.K.jK..

C:\ProgramData\Getscreen.me\logs\20240813.log

Download File

Process:	C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	6544
Entropy (8bit):	5.101516790100599
Encrypted:	false
SSDEEP:	192:lQs7Ry/85y8S092rpKkrPoJCo4+mLsXFG:fQGsfUDcsA
MD5:	65374CDD92C68847FC80A6C91534C717
SHA1:	AB8E8BFC3AAC365D87D8A1A44363B14B92287640
SHA-256:	A9B1EE1C866321414EFBD98E6D8323D36409065BE49B71630972E0DB0856D07E
SHA-512:	ADE27C907732F58E4C1B63436A2C1FD645EE644CB8114293BB36C5419727B2705CEB9F2637010103A0AF36C86E0642B4046CD6BCFBACFE7553F939F14306D0B2
Malicious:	false
Reputation:	low
Preview:	07:06:40.819.INFO.GuiSessionList created new gui session for: 1, is active: false..07:06:40.819.INFO.Server start server run....07:06:40.820.INFO.Start Getscreen.me v 2.21.3 build 2 revision 0..07:06:40.894.INFO.GUI GUI started..07:06:41.027.INFO.CGuiSessionList m_active is null..07:06:41.473.INFO.CConfigStore Loaded config from `C:\ProgramData\Getscreen.me\folder\settings.dat`..07:06:41.473.ERROR.Service service 'GetscreenSV' not found..07:06:41.636.INFO.Service service 'GetscreenSV' installed..07:06:41.868.INFO.Service service 'GetscreenSV' start success..07:06:41.865.INFO.Service get control message 1..07:06:41.878.INFO.FrameMark hide frame..07:06:42.377.INFO.Service service 'GetscreenSV' stop [0] (87)..07:06:42.890.INFO.Service service 'GetscreenSV' removed..07:06:42.906.INFO.Child success get system token..07:06:42.906.INFO.Child start child process simply..07:06:42.907.INF

C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe

Download File

Process:	C:\Users\user\Desktop\getscreen-156413884-x86.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	3654440
Entropy (8bit):	7.931175512125937
Encrypted:	false
SSDEEP:	98304:w2WbzRq8h0oEPel9/DLRAHyGBydPnYMJojL5Nb:w2ez4o0OmyVnvKLH
MD5:	2E9DE68641B502474E5BA330FE5396BB
SHA1:	A7A07FCC8643FEC59E4684AAA66C64C3232E693F
SHA-256:	F942C4A0313D288BF7A48AA6438DDCEC9FBCCCD0E8C0107B61B233A0A823731A
SHA-512:	B5F460EE55C415C5238D500C454F3A9AAE5ADFC9763573FA84C9694F4145AD69515FDDD46A819AFF5B5762E3DBA39888B1BA675EBE2771009A7ACA24AD4A7DEB
Malicious:	true
Antivirus:	Antivirus: Virustotal, Detection: 1%, Browse
Reputation:	low
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.......iI/.-(AD-(AD-(ADfPBE.(AD.D)(AD.EE5(AD9WEE.(AD-(AD./ADfPFE,(AD.BE3(AD.DE](ADfPEE.(ADfPDE.(ADfPGE/(ADfP@En(AD-(@D.*AD>.HE.(AD>.AE,(AD>..D,(AD-(.D,(AD>.CE,(ADRich-(AD........................PE..L..../.f...............(.P7..P....=..)u...=..0u...@...........................u.......8...@..............................U..Pju......0u.P:............7.(/...qu. ............................+u.....<,u.............................................UPX0......=.............................UPX1.....P7...=..N7.................@....rsrc....P...0u..B...R7.............@..............................................................................................................................................................................................................................................................................................................4.22.UPX!....

C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\getscreen-156413884-x86.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Getscreen.me\folder\settings.dat

Download File

Process:	C:\Users\user\Desktop\getscreen-156413884-x86.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	5.84375
Encrypted:	false
SSDEEP:	3:BvBAwxiIIOMpFl8g:7AwkIROFz
MD5:	F6EF0C76DC981AF143C7FB794DF13F8B
SHA1:	372E75981542A254DD6855A7E9AED68E1878A184
SHA-256:	F702D40B2C523E9F62164DDE2458A6FA76B1254EE847D25A420CBA49D1F5A3F2
SHA-512:	4A4CA46FC0B5EF91A5673526C124C4C389495EACC479EC0F52EA9757F70E89E8AF2418DD602C9511A64684DF534FABFB7A71ABBDB4A0BAFD473821BFE0862B3E
Malicious:	false
Preview:	...J.+.q....:.O.K.*@...[...%.....,.6.<.....2.8UO..u.C/.A{;

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Entropy (8bit):	7.931175512125937
TrID:	Win32 Executable (generic) a (10002005/4) 99.66% UPX compressed Win32 Executable (30571/9) 0.30% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	getscreen-156413884-x86.exe
File size:	3'654'440 bytes
MD5:	2e9de68641b502474e5ba330fe5396bb
SHA1:	a7a07fcc8643fec59e4684aaa66c64c3232e693f
SHA256:	f942c4a0313d288bf7a48aa6438ddcec9fbcccd0e8c0107b61b233a0a823731a
SHA512:	b5f460ee55c415c5238d500c454f3a9aae5adfc9763573fa84c9694f4145ad69515fddd46a819aff5b5762e3dba39888b1ba675ebe2771009a7aca24ad4a7deb
SSDEEP:	98304:w2WbzRq8h0oEPel9/DLRAHyGBydPnYMJojL5Nb:w2ez4o0OmyVnvKLH
TLSH:	B50633E1ED6939A1D33D5CB8111B56BD73FAA03658FE23C78A1D9B219E347028F52113
File Content Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.......iI/.-(AD-(AD-(ADfPBE.(AD...D)(AD..EE5(AD9WEE.(AD-(AD./ADfPFE,(AD..BE3(AD..DE](ADfPEE.(ADfPDE.(ADfPGE/(ADfP@En(AD-(@D.*AD>.HE.(A

File Icon


Icon Hash:	418c6963696c9643

Static PE Info

General

Entrypoint:	0x1b529e0
Entrypoint Section:	UPX1
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66912FD6 [Fri Jul 12 13:29:58 2024 UTC]
TLS Callbacks:	0x1b52bd3
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	26c6aff4250b45d1c4ee6d86013ea70c

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=GlobalSign GCC R45 EV CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	28/05/2024 15:50:28 28/06/2026 16:36:10
Subject Chain	CN=POINT B LTD, O=POINT B LTD, L=Limassol, S=Limassol, C=CY, OID.1.3.6.1.4.1.311.60.2.1.3=CY, SERIALNUMBER=HE 430957, OID.2.5.4.15=Private Organization
Version:	3
Thumbprint MD5:	9B083870477F4699693EEECABF351BF8
Thumbprint SHA-1:	B3C999E29AED18DEA59733F3CAA94E788B1AC3A1
Thumbprint SHA-256:	3E73B7C28C18DC6A03B9816F200365F1DF1FF80A7BD0D55DB920F1B24BBD74E7
Serial:	7AE0E9C1CFE2DCE0E21C4327

Entrypoint Preview

Instruction
pushad
mov esi, 017DE000h
lea edi, dword ptr [esi-013DD000h]
push edi
or ebp, FFFFFFFFh
jmp 00007F21952A4CD2h
nop
nop
nop
nop
nop
nop
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
add ebx, ebx
jne 00007F21952A4CC9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F21952A4CAFh
mov eax, 00000001h
add ebx, ebx
jne 00007F21952A4CC9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
add ebx, ebx
jnc 00007F21952A4CCDh
jne 00007F21952A4CEAh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F21952A4CE1h
dec eax
add ebx, ebx
jne 00007F21952A4CC9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
jmp 00007F21952A4C96h
add ebx, ebx
jne 00007F21952A4CC9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
jmp 00007F21952A4D14h
xor ecx, ecx
sub eax, 03h
jc 00007F21952A4CD3h
shl eax, 08h
mov al, byte ptr [esi]
inc esi
xor eax, FFFFFFFFh
je 00007F21952A4D37h
sar eax, 1
mov ebp, eax
jmp 00007F21952A4CCDh
add ebx, ebx
jne 00007F21952A4CC9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F21952A4C8Eh
inc ecx
add ebx, ebx
jne 00007F21952A4CC9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F21952A4C80h
add ebx, ebx
jne 00007F21952A4CC9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jnc 00007F21952A4CB1h
jne 00007F21952A4CCBh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jnc 00007F21952A4CA6h
add ecx, 02h
cmp ebp, FFFFFB00h
adc ecx, 02h
lea edx, dword ptr [eax+eax]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x820d90	0x5500	UPX0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1756a50	0x6c0	.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1753000	0x3a50	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x379400	0x2f28	UPX0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1757110	0x20	.rsrc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x1752bf4	0x18	UPX1
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1752c3c	0xc0	UPX1
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0x13dd000	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1	0x13de000	0x375000	0x374e00	a216f7d1a8e4e14b94fdfbca52f7b652	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1753000	0x5000	0x4200	5871e1397e577651929aa76b50980e16	False	0.4675662878787879	data	5.104875966236682	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AFX_DIALOG_LAYOUT	0x168ca98	0x2	ASCII text, with no line terminators	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x168caa0	0x2	Non-ISO extended-ASCII text, with no line terminators	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x168cb08	0x2	ISO-8859 text, with no line terminators	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x16d4db0	0x2	ASCII text, with no line terminators			5.0
AFX_DIALOG_LAYOUT	0x168caa8	0x2	ISO-8859 text, with CR line terminators	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x168cb00	0x2	ISO-8859 text, with no line terminators	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x168cb10	0x2a	DOS executable (COM, 0x8C-variant)	Russian	Russia	1.2142857142857142
AFX_DIALOG_LAYOUT	0x168cb40	0x22	data	Russian	Russia	1.2647058823529411
AFX_DIALOG_LAYOUT	0x168cb68	0x22	data	Russian	Russia	1.2647058823529411
AFX_DIALOG_LAYOUT	0x168cb90	0x22	data	Russian	Russia	1.2647058823529411
AFX_DIALOG_LAYOUT	0x168cbb8	0x22	data	Russian	Russia	1.2647058823529411
AFX_DIALOG_LAYOUT	0x168cbe0	0x2a	data	Russian	Russia	1.2142857142857142
AFX_DIALOG_LAYOUT	0x168cc10	0x2	ASCII text, with no line terminators	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x168cc28	0x2	ISO-8859 text, with no line terminators	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x168cc20	0x2	data	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x168cc18	0x2	ASCII text	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x168cc30	0x2	ISO-8859 text, with no line terminators	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x168cc38	0x2	ASCII text, with no line terminators	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x168cc40	0x2	ISO-8859 text, with no line terminators	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x16d4ff0	0x2	ISO-8859 text, with no line terminators	English	United States	5.0
AFX_DIALOG_LAYOUT	0x168cc48	0x2	ISO-8859 text, with no line terminators	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x168cc50	0x2	data	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x168cc58	0x2	data	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x168cc60	0x2	ISO-8859 text, with no line terminators	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x168cc68	0x2	data	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x168cc70	0x2	ISO-8859 text, with no line terminators	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x168cab0	0x42	data	Russian	Russia	1.1666666666666667
AFX_DIALOG_LAYOUT	0x168caf8	0x2	ISO-8859 text, with no line terminators	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x168cc78	0x2	ISO-8859 text, with no line terminators, with overstriking	Russian	Russia	5.0
INI	0x16d3a18	0xa	data	Russian	Russia	1.8
LANG	0x16ace60	0x1b82	data	Russian	Russia	0.8660891792104516
LANG	0x16ae9e8	0x26fb	data	Russian	Russia	0.950796673013328
LANG	0x16b10e8	0x1e2b	data	Russian	Russia	0.9835556131037162
LANG	0x16b2f18	0x1e5d	data	Russian	Russia	0.9994853981731635
LANG	0x16b4d78	0x1ca1	data	Russian	Russia	0.9953608950743621
LANG	0x16b6a20	0x21fd	data	Russian	Russia	0.983794966095851
LANG	0x16b8c20	0x1de4	data	Russian	Russia	0.9225039205436487
LANG	0x16baa08	0x1a50	data	Russian	Russia	0.962143705463183
LANG	0x16bc458	0x1d25	data	Russian	Russia	0.9987937273823885
LANG	0x16be180	0x1e03	data	Russian	Russia	0.9980476376415462
LANG	0x16e7c38	0x1ddc	data	English	United States	0.9955520669806384
OPUS	0x16bff88	0xa5e5	data	Russian	Russia	0.9886505451034873
OPUS	0x16ca570	0x94a4	data	Russian	Russia	0.978082623777988
RT_ICON	0x168cc80	0x139	data	Russian	Russia	1.035143769968051
RT_ICON	0x168cdc0	0x1ef	data	Russian	Russia	1.0222222222222221
RT_ICON	0x168cfb0	0x225	data	Russian	Russia	1.0200364298724955
RT_ICON	0x168d1d8	0x26b	OpenPGP Public Key	Russian	Russia	1.0177705977382876
RT_ICON	0x168d448	0x326	data	Russian	Russia	1.0136476426799008
RT_ICON	0x168d770	0x402	data	Russian	Russia	1.010721247563353
RT_ICON	0x17550f0	0x13b	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.034920634920635
RT_ICON	0x1755230	0x1c5	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.0242825607064017
RT_ICON	0x17553fc	0x1ee	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.0222672064777327
RT_ICON	0x17555f0	0x253	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.0184873949579831
RT_ICON	0x1755848	0x2e7	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.0148048452220726
RT_ICON	0x1755b34	0x3ad	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.0116896918172158
RT_ICON	0x168ea20	0xac	data	Russian	Russia	1.063953488372093
RT_ICON	0x168eae8	0x159	data	Russian	Russia	1.0318840579710145
RT_ICON	0x168ec48	0x1e6	data	Russian	Russia	1.022633744855967
RT_ICON	0x168ee30	0x1f6	data	Russian	Russia	1.0219123505976095
RT_ICON	0x168f028	0x26d	data	Russian	Russia	1.0177133655394526
RT_ICON	0x168f298	0x31b	data	Russian	Russia	1.0138364779874214
RT_ICON	0x168f5b8	0x3e7	data	Russian	Russia	1.011011011011011
RT_ICON	0x168fa00	0xdd	DOS executable (COM)	Russian	Russia	1.0497737556561086
RT_ICON	0x168faf8	0x10f	data	Russian	Russia	1.040590405904059
RT_ICON	0x168fc20	0x25a8	data	Russian	Russia	0.999896265560166
RT_ICON	0x16921e0	0x12d	data	Russian	Russia	1.0365448504983388
RT_ICON	0x1692328	0x106	data	Russian	Russia	1.0419847328244274
RT_ICON	0x1692448	0x109	data	Russian	Russia	1.0415094339622641
RT_ICON	0x1692570	0x171	data	Russian	Russia	1.029810298102981
RT_ICON	0x1692700	0x109d	data	Russian	Russia	1.0025864095932282
RT_ICON	0x16937b8	0xdd9	data	Russian	Russia	1.0031029619181946
RT_ICON	0x16945b0	0xc0e	data	Russian	Russia	1.0035644847699288
RT_ICON	0x16951d8	0xb91	data	Russian	Russia	1.0037149611617697
RT_ICON	0x1695d88	0xdd9	data	Russian	Russia	1.0031029619181946
RT_ICON	0x1696b80	0x11c	data	Russian	Russia	1.0387323943661972
RT_ICON	0x1696cb8	0x116	data	Russian	Russia	1.039568345323741
RT_ICON	0x1696de8	0x1c4	data	Russian	Russia	1.0243362831858407
RT_ICON	0x1696fc8	0x1a1	data	Russian	Russia	1.026378896882494
RT_ICON	0x1697188	0x182	data	Russian	Russia	1.028497409326425
RT_ICON	0x1697328	0x222	data	Russian	Russia	1.02014652014652
RT_ICON	0x1697568	0x11f	OpenPGP Secret Key	Russian	Russia	1.038327526132404
RT_ICON	0x16976a0	0x103	data	Russian	Russia	1.0424710424710424
RT_ICON	0x16977c0	0x1588	data	Russian	Russia	1.0019956458635704
RT_ICON	0x1698d60	0x580	data	Russian	Russia	1.0078125
RT_ICON	0x16992f8	0x988	data	Russian	Russia	1.0045081967213114
RT_ICON	0x1699c98	0x25a8	data	Russian	Russia	0.9986514522821577
RT_ICON	0x169c258	0x10828	data	Russian	Russia	0.9908316573997398
RT_ICON	0x16d3a28	0x163	data			1.0309859154929577
RT_ICON	0x16d3b90	0x20d	data			1.020952380952381
RT_ICON	0x16d3da0	0x21b	data			1.0148423005565863
RT_ICON	0x16d3fc0	0x282	data			1.017133956386293
RT_ICON	0x16d4248	0x33c	data			1.0132850241545894
RT_ICON	0x16d4588	0x413	data			1.0105465004793863
RT_ICON	0x16d4a00	0x152	data			0.9792899408284024
RT_ICON	0x16d4ff8	0x10a8	data	English	United States	0.9798311444652908
RT_ICON	0x16d60b8	0x988	data	English	United States	1.0045081967213114
RT_ICON	0x16d6a58	0x988	data	English	United States	0.9721311475409836
RT_ICON	0x16d73f8	0x10828	data	English	United States	0.9158286998698687
RT_MENU	0x16d4b70	0xf8	data			1.0161290322580645
RT_MENU	0x16acd20	0xd2	data	Russian	Russia	1.0523809523809524
RT_MENU	0x16acdf8	0x66	data	Russian	Russia	1.088235294117647
RT_MENU	0x16d4c68	0x46	data			1.1571428571428573
RT_DIALOG	0x168a0f0	0x490	data	Russian	Russia	1.009417808219178
RT_DIALOG	0x168a580	0x78	data	Russian	Russia	1.0916666666666666
RT_DIALOG	0x16d4cb0	0x100	data			0.9765625
RT_DIALOG	0x168a5f8	0x1f8	data	Russian	Russia	1.0218253968253967
RT_DIALOG	0x168acb0	0x190	data	Russian	Russia	1.0275
RT_DIALOG	0x168ae40	0x154	data	Russian	Russia	1.0323529411764707
RT_DIALOG	0x168af98	0xf4	data	Russian	Russia	1.0450819672131149
RT_DIALOG	0x168b090	0x12c	data	Russian	Russia	1.0366666666666666
RT_DIALOG	0x168b1c0	0x110	data	Russian	Russia	1.0404411764705883
RT_DIALOG	0x168b2d0	0x128	data	Russian	Russia	1.037162162162162
RT_DIALOG	0x168b3f8	0x154	data	Russian	Russia	1.0323529411764707
RT_DIALOG	0x168b550	0x7e	data	Russian	Russia	1.0873015873015872
RT_DIALOG	0x168b808	0x148	data	Russian	Russia	1.0335365853658536
RT_DIALOG	0x168b738	0xd0	data	Russian	Russia	1.0528846153846154
RT_DIALOG	0x168b5d0	0x164	data	Russian	Russia	1.0308988764044944
RT_DIALOG	0x168b950	0x14c	data	Russian	Russia	1.033132530120482
RT_DIALOG	0x168baa0	0x1f0	data	Russian	Russia	1.0221774193548387
RT_DIALOG	0x168bc90	0x284	data	Russian	Russia	1.0170807453416149
RT_DIALOG	0x16d4db8	0x232	data	English	United States	1.019572953736655
RT_DIALOG	0x168bf18	0x182	data	Russian	Russia	1.0129533678756477
RT_DIALOG	0x168c0a0	0x68	data	Russian	Russia	1.1057692307692308
RT_DIALOG	0x168c108	0x1f8	DOS executable (COM, 0x8C-variant)	Russian	Russia	1.0218253968253967
RT_DIALOG	0x168c300	0x218	data	Russian	Russia	1.0205223880597014
RT_DIALOG	0x168c518	0x2ba	data	Russian	Russia	1.015759312320917
RT_DIALOG	0x168c7d8	0x242	data	Russian	Russia	1.019031141868512
RT_DIALOG	0x168a7f0	0x21c	data	Russian	Russia	1.0203703703703704
RT_DIALOG	0x168aa10	0x29a	data	Russian	Russia	1.0165165165165164
RT_DIALOG	0x168ca20	0x72	OpenPGP Secret Key	Russian	Russia	1.0964912280701755
RT_STRING	0x16e9a18	0x38	data	Russian	Russia	1.1964285714285714
RT_GROUP_ICON	0x1755ee8	0x5a	data	Russian	Russia	0.8
RT_GROUP_ICON	0x168db78	0x5a	data	Russian	Russia	1.1222222222222222
RT_GROUP_ICON	0x16d49a0	0x5a	data			1.1222222222222222
RT_GROUP_ICON	0x16977a8	0x14	data	Russian	Russia	1.4
RT_GROUP_ICON	0x168ead0	0x14	data	Russian	Russia	1.4
RT_GROUP_ICON	0x168f9a0	0x5a	data	Russian	Russia	1.1222222222222222
RT_GROUP_ICON	0x1698d48	0x14	Non-ISO extended-ASCII text, with CR line terminators	Russian	Russia	1.45
RT_GROUP_ICON	0x168fae0	0x14	data	Russian	Russia	1.45
RT_GROUP_ICON	0x168fc08	0x14	data	Russian	Russia	1.2
RT_GROUP_ICON	0x16921c8	0x14	Non-ISO extended-ASCII text, with LF, NEL line terminators	Russian	Russia	1.4
RT_GROUP_ICON	0x16d4b58	0x14	Non-ISO extended-ASCII text, with no line terminators			1.4
RT_GROUP_ICON	0x1692310	0x14	data	Russian	Russia	1.4
RT_GROUP_ICON	0x1692430	0x14	locale data table	Russian	Russia	1.4
RT_GROUP_ICON	0x1692558	0x14	International EBCDIC text, with NEL line terminators	Russian	Russia	1.45
RT_GROUP_ICON	0x16926e8	0x14	data	Russian	Russia	1.4
RT_GROUP_ICON	0x16937a0	0x14	Non-ISO extended-ASCII text, with no line terminators, with overstriking	Russian	Russia	1.45
RT_GROUP_ICON	0x1694598	0x14	data	Russian	Russia	1.45
RT_GROUP_ICON	0x16951c0	0x14	Non-ISO extended-ASCII text, with no line terminators	Russian	Russia	1.4
RT_GROUP_ICON	0x1695d70	0x14	data	Russian	Russia	1.45
RT_GROUP_ICON	0x1696b68	0x14	data	Russian	Russia	1.4
RT_GROUP_ICON	0x1696ca0	0x14	data	Russian	Russia	1.4
RT_GROUP_ICON	0x1696dd0	0x14	data	Russian	Russia	1.45
RT_GROUP_ICON	0x1696fb0	0x14	data	Russian	Russia	1.45
RT_GROUP_ICON	0x1697170	0x14	data	Russian	Russia	1.45
RT_GROUP_ICON	0x1697310	0x14	data	Russian	Russia	1.45
RT_GROUP_ICON	0x1697550	0x14	data	Russian	Russia	1.45
RT_GROUP_ICON	0x1697688	0x14	data	Russian	Russia	1.4
RT_GROUP_ICON	0x16992e0	0x14	data	Russian	Russia	1.45
RT_GROUP_ICON	0x1699c80	0x14	data	Russian	Russia	1.45
RT_GROUP_ICON	0x16d60a0	0x14	data	English	United States	1.45
RT_GROUP_ICON	0x169c240	0x14	data	Russian	Russia	1.45
RT_GROUP_ICON	0x16aca80	0x14	data	Russian	Russia	1.45
RT_GROUP_ICON	0x16d6a40	0x14	data	English	United States	1.4
RT_GROUP_ICON	0x16d73e0	0x14	data	English	United States	1.45
RT_GROUP_ICON	0x16e7c20	0x14	data	English	United States	1.45
RT_VERSION	0x1755f48	0x284	data	Russian	Russia	0.468944099378882
RT_MANIFEST	0x17561d0	0x87f	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (2115), with CRLF line terminators	English	United States	0.31264367816091954

Imports

DLL	Import
ADVAPI32.dll	FreeSid
COMCTL32.dll	_TrackMouseEvent
d3d11.dll	D3D11CreateDevice
dbghelp.dll	StackWalk
dxgi.dll	CreateDXGIFactory1
GDI32.dll	LineTo
gdiplus.dll	GdipFree
IPHLPAPI.DLL	GetIfEntry2
KERNEL32.DLL	LoadLibraryA, ExitProcess, GetProcAddress, VirtualProtect
MPR.dll	WNetGetConnectionW
msdmo.dll	MoInitMediaType
NETAPI32.dll	NetUserGetInfo
ntdll.dll	RtlGetVersion
NTDSAPI.dll	DsMakeSpnW
ole32.dll	OleCreate
OLEAUT32.dll	SysFreeString
POWRPROF.dll	PowerGetActiveScheme
RPCRT4.dll	UuidEqual
SAS.dll	SendSAS
Secur32.dll	FreeCredentialsHandle
SHELL32.dll
SHLWAPI.dll	PathFileExistsA
USER32.dll	GetDC
USERENV.dll	CreateEnvironmentBlock
UxTheme.dll	IsThemeActive
VERSION.dll	VerQueryValueW
WINHTTP.dll	WinHttpOpen
WINMM.dll	waveInOpen
WINSPOOL.DRV	GetPrinterW
WS2_32.dll	WSASetLastError
WTSAPI32.dll	WTSFreeMemory

Possible Origin

Language of compilation system	Country where language is spoken	Map
Russian	Russia
English	United States

Network Behavior

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 13, 2024 09:06:44.008306026 CEST	192.168.11.20	1.1.1.1	0x28cf	Standard query (0)	getscreen.me	A (IP address)	IN (0x0001)	false
Aug 13, 2024 09:07:47.097349882 CEST	192.168.11.20	1.1.1.1	0x7021	Standard query (0)	getscreen.me	A (IP address)	IN (0x0001)	false
Aug 13, 2024 09:08:46.583831072 CEST	192.168.11.20	1.1.1.1	0x83ed	Standard query (0)	getscreen.me	A (IP address)	IN (0x0001)	false
Aug 13, 2024 09:09:46.602049112 CEST	192.168.11.20	1.1.1.1	0x7cec	Standard query (0)	getscreen.me	A (IP address)	IN (0x0001)	false
Aug 13, 2024 09:10:46.605489969 CEST	192.168.11.20	1.1.1.1	0x5629	Standard query (0)	getscreen.me	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Aug 13, 2024 09:06:44.183358908 CEST	1.1.1.1	192.168.11.20	0x28cf	No error (0)	getscreen.me	78.47.165.25	A (IP address)	IN (0x0001)	false
Aug 13, 2024 09:06:44.183358908 CEST	1.1.1.1	192.168.11.20	0x28cf	No error (0)	getscreen.me	51.89.95.37	A (IP address)	IN (0x0001)	false
Aug 13, 2024 09:06:44.183358908 CEST	1.1.1.1	192.168.11.20	0x28cf	No error (0)	getscreen.me	5.75.168.191	A (IP address)	IN (0x0001)	false
Aug 13, 2024 09:07:47.272507906 CEST	1.1.1.1	192.168.11.20	0x7021	No error (0)	getscreen.me	51.89.95.37	A (IP address)	IN (0x0001)	false
Aug 13, 2024 09:07:47.272507906 CEST	1.1.1.1	192.168.11.20	0x7021	No error (0)	getscreen.me	5.75.168.191	A (IP address)	IN (0x0001)	false
Aug 13, 2024 09:07:47.272507906 CEST	1.1.1.1	192.168.11.20	0x7021	No error (0)	getscreen.me	78.47.165.25	A (IP address)	IN (0x0001)	false
Aug 13, 2024 09:08:46.751064062 CEST	1.1.1.1	192.168.11.20	0x83ed	No error (0)	getscreen.me	51.89.95.37	A (IP address)	IN (0x0001)	false
Aug 13, 2024 09:08:46.751064062 CEST	1.1.1.1	192.168.11.20	0x83ed	No error (0)	getscreen.me	78.47.165.25	A (IP address)	IN (0x0001)	false
Aug 13, 2024 09:08:46.751064062 CEST	1.1.1.1	192.168.11.20	0x83ed	No error (0)	getscreen.me	5.75.168.191	A (IP address)	IN (0x0001)	false
Aug 13, 2024 09:09:46.769257069 CEST	1.1.1.1	192.168.11.20	0x7cec	No error (0)	getscreen.me	51.89.95.37	A (IP address)	IN (0x0001)	false
Aug 13, 2024 09:09:46.769257069 CEST	1.1.1.1	192.168.11.20	0x7cec	No error (0)	getscreen.me	78.47.165.25	A (IP address)	IN (0x0001)	false
Aug 13, 2024 09:09:46.769257069 CEST	1.1.1.1	192.168.11.20	0x7cec	No error (0)	getscreen.me	5.75.168.191	A (IP address)	IN (0x0001)	false
Aug 13, 2024 09:10:46.772159100 CEST	1.1.1.1	192.168.11.20	0x5629	No error (0)	getscreen.me	5.75.168.191	A (IP address)	IN (0x0001)	false
Aug 13, 2024 09:10:46.772159100 CEST	1.1.1.1	192.168.11.20	0x5629	No error (0)	getscreen.me	51.89.95.37	A (IP address)	IN (0x0001)	false
Aug 13, 2024 09:10:46.772159100 CEST	1.1.1.1	192.168.11.20	0x5629	No error (0)	getscreen.me	78.47.165.25	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49821	78.47.165.25	443	4144	C:\Users\user\Desktop\getscreen-156413884-x86.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-13 07:06:44 UTC	290	OUT	GET /signal/agent HTTP/1.1 Host: getscreen.me Upgrade: websocket Connection: Upgrade Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ== Origin: https://getscreen.me Sec-WebSocket-Protocol: chat, superchat Sec-WebSocket-Version: 13 User-Agent: Getscreen.me/2.21.3 (Win, getscreen.me, 2)
2024-08-13 07:06:45 UTC	265	IN	HTTP/1.1 400 Bad Request content-type: text/plain; charset=utf-8 sec-websocket-version: 13 x-content-type-options: nosniff date: Tue, 13 Aug 2024 07:06:45 GMT content-length: 12 x-envoy-upstream-service-time: 6 server: lb1.getscreen.me connection: close
2024-08-13 07:06:45 UTC	12	IN	Data Raw: 42 61 64 20 52 65 71 75 65 73 74 0a Data Ascii: Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.20	49822	78.47.165.25	443	4144	C:\Users\user\Desktop\getscreen-156413884-x86.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-13 07:06:57 UTC	290	OUT	GET /signal/agent HTTP/1.1 Host: getscreen.me Upgrade: websocket Connection: Upgrade Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ== Origin: https://getscreen.me Sec-WebSocket-Protocol: chat, superchat Sec-WebSocket-Version: 13 User-Agent: Getscreen.me/2.21.3 (Win, getscreen.me, 2)
2024-08-13 07:06:58 UTC	265	IN	HTTP/1.1 400 Bad Request content-type: text/plain; charset=utf-8 sec-websocket-version: 13 x-content-type-options: nosniff date: Tue, 13 Aug 2024 07:06:58 GMT content-length: 12 x-envoy-upstream-service-time: 0 server: lb1.getscreen.me connection: close
2024-08-13 07:06:58 UTC	12	IN	Data Raw: 42 61 64 20 52 65 71 75 65 73 74 0a Data Ascii: Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.11.20	49823	78.47.165.25	443	4144	C:\Users\user\Desktop\getscreen-156413884-x86.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-13 07:07:17 UTC	290	OUT	GET /signal/agent HTTP/1.1 Host: getscreen.me Upgrade: websocket Connection: Upgrade Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ== Origin: https://getscreen.me Sec-WebSocket-Protocol: chat, superchat Sec-WebSocket-Version: 13 User-Agent: Getscreen.me/2.21.3 (Win, getscreen.me, 2)
2024-08-13 07:07:17 UTC	265	IN	HTTP/1.1 400 Bad Request content-type: text/plain; charset=utf-8 sec-websocket-version: 13 x-content-type-options: nosniff date: Tue, 13 Aug 2024 07:07:17 GMT content-length: 12 x-envoy-upstream-service-time: 4 server: lb1.getscreen.me connection: close
2024-08-13 07:07:17 UTC	12	IN	Data Raw: 42 61 64 20 52 65 71 75 65 73 74 0a Data Ascii: Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.11.20	49824	78.47.165.25	443	4144	C:\Users\user\Desktop\getscreen-156413884-x86.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-13 07:07:24 UTC	290	OUT	GET /signal/agent HTTP/1.1 Host: getscreen.me Upgrade: websocket Connection: Upgrade Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ== Origin: https://getscreen.me Sec-WebSocket-Protocol: chat, superchat Sec-WebSocket-Version: 13 User-Agent: Getscreen.me/2.21.3 (Win, getscreen.me, 2)
2024-08-13 07:07:24 UTC	265	IN	HTTP/1.1 400 Bad Request content-type: text/plain; charset=utf-8 sec-websocket-version: 13 x-content-type-options: nosniff date: Tue, 13 Aug 2024 07:07:24 GMT content-length: 12 x-envoy-upstream-service-time: 1 server: lb1.getscreen.me connection: close
2024-08-13 07:07:24 UTC	12	IN	Data Raw: 42 61 64 20 52 65 71 75 65 73 74 0a Data Ascii: Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.11.20	49825	78.47.165.25	443	4144	C:\Users\user\Desktop\getscreen-156413884-x86.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-13 07:07:34 UTC	290	OUT	GET /signal/agent HTTP/1.1 Host: getscreen.me Upgrade: websocket Connection: Upgrade Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ== Origin: https://getscreen.me Sec-WebSocket-Protocol: chat, superchat Sec-WebSocket-Version: 13 User-Agent: Getscreen.me/2.21.3 (Win, getscreen.me, 2)
2024-08-13 07:07:35 UTC	265	IN	HTTP/1.1 400 Bad Request content-type: text/plain; charset=utf-8 sec-websocket-version: 13 x-content-type-options: nosniff date: Tue, 13 Aug 2024 07:07:35 GMT content-length: 12 x-envoy-upstream-service-time: 3 server: lb1.getscreen.me connection: close
2024-08-13 07:07:35 UTC	12	IN	Data Raw: 42 61 64 20 52 65 71 75 65 73 74 0a Data Ascii: Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.11.20	49826	51.89.95.37	443	4144	C:\Users\user\Desktop\getscreen-156413884-x86.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-13 07:07:47 UTC	290	OUT	GET /signal/agent HTTP/1.1 Host: getscreen.me Upgrade: websocket Connection: Upgrade Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ== Origin: https://getscreen.me Sec-WebSocket-Protocol: chat, superchat Sec-WebSocket-Version: 13 User-Agent: Getscreen.me/2.21.3 (Win, getscreen.me, 2)
2024-08-13 07:07:48 UTC	265	IN	HTTP/1.1 400 Bad Request content-type: text/plain; charset=utf-8 sec-websocket-version: 13 x-content-type-options: nosniff date: Tue, 13 Aug 2024 07:07:48 GMT content-length: 12 x-envoy-upstream-service-time: 7 server: ov1.getscreen.me connection: close
2024-08-13 07:07:48 UTC	12	IN	Data Raw: 42 61 64 20 52 65 71 75 65 73 74 0a Data Ascii: Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.11.20	49827	51.89.95.37	443	4144	C:\Users\user\Desktop\getscreen-156413884-x86.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-13 07:07:50 UTC	290	OUT	GET /signal/agent HTTP/1.1 Host: getscreen.me Upgrade: websocket Connection: Upgrade Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ== Origin: https://getscreen.me Sec-WebSocket-Protocol: chat, superchat Sec-WebSocket-Version: 13 User-Agent: Getscreen.me/2.21.3 (Win, getscreen.me, 2)
2024-08-13 07:07:51 UTC	265	IN	HTTP/1.1 400 Bad Request content-type: text/plain; charset=utf-8 sec-websocket-version: 13 x-content-type-options: nosniff date: Tue, 13 Aug 2024 07:07:51 GMT content-length: 12 x-envoy-upstream-service-time: 6 server: ov1.getscreen.me connection: close
2024-08-13 07:07:51 UTC	12	IN	Data Raw: 42 61 64 20 52 65 71 75 65 73 74 0a Data Ascii: Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.11.20	49828	51.89.95.37	443	4144	C:\Users\user\Desktop\getscreen-156413884-x86.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-13 07:07:55 UTC	290	OUT	GET /signal/agent HTTP/1.1 Host: getscreen.me Upgrade: websocket Connection: Upgrade Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ== Origin: https://getscreen.me Sec-WebSocket-Protocol: chat, superchat Sec-WebSocket-Version: 13 User-Agent: Getscreen.me/2.21.3 (Win, getscreen.me, 2)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.11.20	49829	51.89.95.37	443	4144	C:\Users\user\Desktop\getscreen-156413884-x86.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-13 07:08:00 UTC	290	OUT	GET /signal/agent HTTP/1.1 Host: getscreen.me Upgrade: websocket Connection: Upgrade Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ== Origin: https://getscreen.me Sec-WebSocket-Protocol: chat, superchat Sec-WebSocket-Version: 13 User-Agent: Getscreen.me/2.21.3 (Win, getscreen.me, 2)
2024-08-13 07:08:01 UTC	265	IN	HTTP/1.1 400 Bad Request content-type: text/plain; charset=utf-8 sec-websocket-version: 13 x-content-type-options: nosniff date: Tue, 13 Aug 2024 07:08:00 GMT content-length: 12 x-envoy-upstream-service-time: 6 server: ov1.getscreen.me connection: close
2024-08-13 07:08:01 UTC	12	IN	Data Raw: 42 61 64 20 52 65 71 75 65 73 74 0a Data Ascii: Bad Request

Target ID:	0
Start time:	03:06:40
Start date:	13/08/2024
Path:	C:\Users\user\Desktop\getscreen-156413884-x86.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\getscreen-156413884-x86.exe"
Imagebase:	0x740000
File size:	3'654'440 bytes
MD5 hash:	2E9DE68641B502474E5BA330FE5396BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	03:06:40
Start date:	13/08/2024
Path:	C:\Users\user\Desktop\getscreen-156413884-x86.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\getscreen-156413884-x86.exe" -gpipe \\.\pipe\PCommand97tdpsimneriwgrzu -gui
Imagebase:	0x740000
File size:	3'654'440 bytes
MD5 hash:	2E9DE68641B502474E5BA330FE5396BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	03:06:41
Start date:	13/08/2024
Path:	C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe" -elevate \\.\pipe\elevateGS512nqdzlqpayjfioefvlkmbvgukrpwcnna
Imagebase:	0x790000
File size:	3'654'440 bytes
MD5 hash:	2E9DE68641B502474E5BA330FE5396BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 1%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:06:43
Start date:	13/08/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
Imagebase:	0x7ff653ca0000
File size:	57'360 bytes
MD5 hash:	F586835082F632DC8D9404D83BC16316
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	03:06:43
Start date:	13/08/2024
Path:	C:\Users\user\Desktop\getscreen-156413884-x86.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\getscreen-156413884-x86.exe" -cpipe \\.\pipe\PCommand96gztzxiecsokzuwc -cmem 0000pipe0PCommand96gztzxiecsokzuwcm969vla39a23oue -child
Imagebase:	0x740000
File size:	3'654'440 bytes
MD5 hash:	2E9DE68641B502474E5BA330FE5396BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.8%
Total number of Nodes:	247
Total number of Limit Nodes:	11

Executed Functions

Function 01E929E0 Relevance: 7.7, APIs: 5, Instructions: 212
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?), ref: 01E92B13
GetProcAddress.KERNEL32(?,01E6CFF9), ref: 01E92B31
ExitProcess.KERNEL32(?,01E6CFF9), ref: 01E92B42
VirtualProtect.KERNEL32(00740000,00001000,00000004,?,00000000), ref: 01E92B90
VirtualProtect.KERNEL32(00740000,00001000), ref: 01E92BA5

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: ProtectVirtual$AddressExitLibraryLoadProcProcess
String ID:
API String ID: 1996367037-0
Opcode ID: 3c3e4e1660f31b76f3217510b8a4a34511a40d85c57fd981d39193e29dff6a9b
Instruction ID: 391c61bb0c683ec58ecfee36cbc39f1b252ca285cad72aaf2d7eb62838771f35
Opcode Fuzzy Hash: 3c3e4e1660f31b76f3217510b8a4a34511a40d85c57fd981d39193e29dff6a9b
Instruction Fuzzy Hash: C0510473A103136ADF318E6CDCC06ACB795EB452247581738DBE2D73C6E7E858468364

Function 00832EDC Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 91
threadlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 00832FA5
SetThreadDescription.KERNELBASE(00000000,?), ref: 00832FBD
KiUserExceptionDispatcher.NTDLL(406D1388,00000000,00000004,?), ref: 00832FEA
GetModuleHandleA.KERNEL32(Kernel32.dll), ref: 00833031
GetProcAddress.KERNEL32(00000000,SetThreadDescription), ref: 0083303D

Strings

Kernel32.dll, xrefs: 0083302C
SetThreadDescription, xrefs: 00833037

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Thread$AddressCurrentDescriptionDispatcherExceptionHandleModuleProcUser
String ID: Kernel32.dll$SetThreadDescription
API String ID: 2856497764-1724334159
Opcode ID: 5eb737a3f5d7115e918a15001cdff54b5202bfa5fbac9cbf4e64fca405ade5ea
Instruction ID: 983dbbf7c7da133107bde0674b3ca00bad7aeba072b2445c81bf3881a9b93ce4
Opcode Fuzzy Hash: 5eb737a3f5d7115e918a15001cdff54b5202bfa5fbac9cbf4e64fca405ade5ea
Instruction Fuzzy Hash: 72418EB1D007899FD720CF54DC88BA9B7B4FF8A720F108359E865A7391DB744985CB91

Function 00E1F42C Relevance: 5.2, APIs: 4, Instructions: 192
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,00E0B650,00F60388,0000000C), ref: 00E1F430
SetLastError.KERNEL32(00000000), ref: 00E1F4D2
GetLastError.KERNEL32(00000000,?,00E05FDD,00E1F0E3,?,?,00DAF77A,0000000C,?,?,?,?,00D227D2,?,?,?), ref: 00E1F581
SetLastError.KERNEL32(00000000,000000FF,00000006), ref: 00E1F623

Part of subcall function 00E1F717: RtlAllocateHeap.NTDLL(00000008,?,00000000), ref: 00E1F758

Part of subcall function 00E1F066: RtlFreeHeap.NTDLL(00000000,00000000,?,00E2B935,?,00000000,?,?,00E2BBD6,?,00000007,?,?,00E2BF89,?,?), ref: 00E1F07C
Part of subcall function 00E1F066: GetLastError.KERNEL32(?,?,00E2B935,?,00000000,?,?,00E2BBD6,?,00000007,?,?,00E2BF89,?,?), ref: 00E1F087

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: ErrorLast$Heap$AllocateFree
String ID:
API String ID: 2037364846-0
Opcode ID: 30a1303a25e3fc17586513998c0fc702bef44ee55c28445dd1772e7423a270b2
Instruction ID: 86c83acbbdd2d07543e59be71c3ede325a97e0733c97606a87b24136a4e6e58b
Opcode Fuzzy Hash: 30a1303a25e3fc17586513998c0fc702bef44ee55c28445dd1772e7423a270b2
Instruction Fuzzy Hash: 89515D7661A3216ED6113B78BC87EEB368DAF14378F102270F724BA1E1DB248ED191D1

Function 00E0B62B Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(00F60388,0000000C), ref: 00E0B63E
RtlExitUserThread.NTDLL(00000000), ref: 00E0B645

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: ErrorExitLastThreadUser
String ID:
API String ID: 1750398979-0
Opcode ID: 20c702f8eb4a4f1d09fa1df70841d5b491034839501e3b64d69212977764bbf0
Instruction ID: e70983f9302ad3213ab65a109bf384cab2291cba1f74aeca5e1488578c76322e
Opcode Fuzzy Hash: 20c702f8eb4a4f1d09fa1df70841d5b491034839501e3b64d69212977764bbf0
Instruction Fuzzy Hash: 93F0C2B5A406049FDB04AFB0E80AB6E7BB4FF41710F205188F011BB2E2CB319981CBA1

Function 00E1F066 Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00E2B935,?,00000000,?,?,00E2BBD6,?,00000007,?,?,00E2BF89,?,?), ref: 00E1F07C
GetLastError.KERNEL32(?,?,00E2B935,?,00000000,?,?,00E2BBD6,?,00000007,?,?,00E2BF89,?,?), ref: 00E1F087

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: b020231825db68da30ff995e801a8abb5c03ebc3394ee0c89d842ce0cff53336
Instruction ID: 8b540874914e115e72feaf95fba04187f469ce4b03d478f4b39f2d46948bad35
Opcode Fuzzy Hash: b020231825db68da30ff995e801a8abb5c03ebc3394ee0c89d842ce0cff53336
Instruction Fuzzy Hash: CAE086722006086BDB212BA1ED097993A99AB05755F115020F60CB60E1D7748C81CBA4

Function 00E023CE Relevance: 1.5, APIs: 1, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL(E06D7363,00000001,00000003,?,?,00000001), ref: 00E0242E

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 173e8a952e85795111be0358260f4561e2ad5b21901bd09115edf7c95a474c93
Instruction ID: 2a2114963e4ca167ff0051bf8e82c3ddf7c8a3b1341b854a38e13d8c6cb46e91
Opcode Fuzzy Hash: 173e8a952e85795111be0358260f4561e2ad5b21901bd09115edf7c95a474c93
Instruction Fuzzy Hash: 70018F75A00208AFC7019F5DD884B9EBBF9EF88714F154169EA15AB390D770ED41CB90

Function 00E1F717 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000), ref: 00E1F758

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f693c1232b036711f5dc43f0bcff34894fe04e79fdef286edb6913cac42226fc
Instruction ID: f6c0a0c4399d7c2e869f0c307725d0f5eab5f5801ade1dc6718a9db44b3704f0
Opcode Fuzzy Hash: f693c1232b036711f5dc43f0bcff34894fe04e79fdef286edb6913cac42226fc
Instruction Fuzzy Hash: 48F0E93162022466EB216E269C05BDB3789AF41774B156033FC14F71C0CB30D88186E0

Function 008AB829 Relevance: 1.3, APIs: 1, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetLastError.KERNEL32(00000000), ref: 008AB834

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 14c0d35bee7b76e9fdb2ceac20964509794def159990583e9de6aa631136a159
Instruction ID: 34f4fa09e0ba21be090da8d9603ed58ad8fb9450fb79702d52b8612fe5401ce4
Opcode Fuzzy Hash: 14c0d35bee7b76e9fdb2ceac20964509794def159990583e9de6aa631136a159
Instruction Fuzzy Hash: E231AFB5B003289FD710DF69C884A6ABBA9FF89710B054529EA4997741D731FC40CBE0

Non-executed Functions

Function 00DB7449 Relevance: 224.3, APIs: 64, Strings: 64, Instructions: 269libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(wtsapi32.dll,00DB7168), ref: 00DB744E
GetProcAddress.KERNEL32(00000000,WTSStopRemoteControlSession), ref: 00DB746B
GetProcAddress.KERNEL32(WTSStartRemoteControlSessionW), ref: 00DB747D
GetProcAddress.KERNEL32(WTSStartRemoteControlSessionA), ref: 00DB748F
GetProcAddress.KERNEL32(WTSConnectSessionW), ref: 00DB74A1
GetProcAddress.KERNEL32(WTSConnectSessionA), ref: 00DB74B3
GetProcAddress.KERNEL32(WTSEnumerateServersW), ref: 00DB74C5
GetProcAddress.KERNEL32(WTSEnumerateServersA), ref: 00DB74D7
GetProcAddress.KERNEL32(WTSOpenServerW), ref: 00DB74E9
GetProcAddress.KERNEL32(WTSOpenServerA), ref: 00DB74FB
GetProcAddress.KERNEL32(WTSOpenServerExW), ref: 00DB750D
GetProcAddress.KERNEL32(WTSOpenServerExA), ref: 00DB751F
GetProcAddress.KERNEL32(WTSCloseServer), ref: 00DB7531
GetProcAddress.KERNEL32(WTSEnumerateSessionsW), ref: 00DB7543
GetProcAddress.KERNEL32(WTSEnumerateSessionsA), ref: 00DB7555
GetProcAddress.KERNEL32(WTSEnumerateSessionsExW), ref: 00DB7567
GetProcAddress.KERNEL32(WTSEnumerateSessionsExA), ref: 00DB7579
GetProcAddress.KERNEL32(WTSEnumerateProcessesW), ref: 00DB758B
GetProcAddress.KERNEL32(WTSEnumerateProcessesA), ref: 00DB759D
GetProcAddress.KERNEL32(WTSTerminateProcess), ref: 00DB75AF
GetProcAddress.KERNEL32(WTSQuerySessionInformationW), ref: 00DB75C1
GetProcAddress.KERNEL32(WTSQuerySessionInformationA), ref: 00DB75D3
GetProcAddress.KERNEL32(WTSQueryUserConfigW), ref: 00DB75E5
GetProcAddress.KERNEL32(WTSQueryUserConfigA), ref: 00DB75F7
GetProcAddress.KERNEL32(WTSSetUserConfigW), ref: 00DB7609

Strings

WTSRegisterSessionNotificationEx, xrefs: 00DB774F
WTSLogoffSession, xrefs: 00DB7653
WTSSetUserConfigA, xrefs: 00DB760B
WTSQueryListenerConfigA, xrefs: 00DB7803
WTSOpenServerExA, xrefs: 00DB750F
WTSEnumerateListenersA, xrefs: 00DB77DF
WTSOpenServerExW, xrefs: 00DB74FD
WTSQueryUserConfigW, xrefs: 00DB75D5
WTSQueryUserConfigA, xrefs: 00DB75E7
WTSEnumerateProcessesExW, xrefs: 00DB77A9
WTSGetListenerSecurityA, xrefs: 00DB786F
WTSCreateListenerA, xrefs: 00DB7827
WTSIsChildSessionsEnabled, xrefs: 00DB7898
WTSGetActiveConsoleSessionId, xrefs: 00DB78B7
WTSSetListenerSecurityW, xrefs: 00DB7839
WTSCreateListenerW, xrefs: 00DB7815
WTSQuerySessionInformationA, xrefs: 00DB75C3
WTSSendMessageA, xrefs: 00DB762F
WTSEnumerateServersW, xrefs: 00DB74B5
WTSWaitSystemEvent, xrefs: 00DB7677
WTSSetUserConfigW, xrefs: 00DB75F9
WTSStopRemoteControlSession, xrefs: 00DB7465
WTSTerminateProcess, xrefs: 00DB759F
WTSVirtualChannelPurgeOutput, xrefs: 00DB76F5
WTSVirtualChannelPurgeInput, xrefs: 00DB76E3
WTSEnumerateSessionsExW, xrefs: 00DB7557
WTSStartRemoteControlSessionA, xrefs: 00DB747F
WTSConnectSessionW, xrefs: 00DB7491
WTSQuerySessionInformationW, xrefs: 00DB75B1
WTSEnumerateSessionsA, xrefs: 00DB7545
WTSFreeMemoryExW, xrefs: 00DB7785
WTSRegisterSessionNotification, xrefs: 00DB7730
WTSQueryListenerConfigW, xrefs: 00DB77F1
WTSConnectSessionA, xrefs: 00DB74A3
WTSVirtualChannelWrite, xrefs: 00DB76D1
WTSCloseServer, xrefs: 00DB7521
WTSEnumerateSessionsW, xrefs: 00DB7533
WTSVirtualChannelOpenEx, xrefs: 00DB769B
WTSOpenServerA, xrefs: 00DB74EB
WTSShutdownSystem, xrefs: 00DB7665
WTSVirtualChannelQuery, xrefs: 00DB7707
WTSVirtualChannelRead, xrefs: 00DB76BF
WTSDisconnectSession, xrefs: 00DB7641
WTSEnableChildSessions, xrefs: 00DB7881
WTSFreeMemory, xrefs: 00DB7719
WTSQueryUserToken, xrefs: 00DB7773
WTSSendMessageW, xrefs: 00DB761D
WTSStartRemoteControlSessionW, xrefs: 00DB746D
wtsapi32.dll, xrefs: 00DB7449
WTSEnumerateProcessesW, xrefs: 00DB757B
WTSEnumerateListenersW, xrefs: 00DB77CD
WTSOpenServerW, xrefs: 00DB74D9
WTSUnRegisterSessionNotificationEx, xrefs: 00DB7761
WTSVirtualChannelOpen, xrefs: 00DB7689
WTSEnumerateSessionsExA, xrefs: 00DB7569
WTSVirtualChannelClose, xrefs: 00DB76AD
WTSEnumerateProcessesExA, xrefs: 00DB77BB
WTSSetListenerSecurityA, xrefs: 00DB784B
WTSFreeMemoryExA, xrefs: 00DB7797
WTSGetChildSessionId, xrefs: 00DB78A5
WTSEnumerateServersA, xrefs: 00DB74C7
WTSGetListenerSecurityW, xrefs: 00DB785D
WTSUnRegisterSessionNotification, xrefs: 00DB773D
WTSEnumerateProcessesA, xrefs: 00DB758D

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: WTSCloseServer$WTSConnectSessionA$WTSConnectSessionW$WTSCreateListenerA$WTSCreateListenerW$WTSDisconnectSession$WTSEnableChildSessions$WTSEnumerateListenersA$WTSEnumerateListenersW$WTSEnumerateProcessesA$WTSEnumerateProcessesExA$WTSEnumerateProcessesExW$WTSEnumerateProcessesW$WTSEnumerateServersA$WTSEnumerateServersW$WTSEnumerateSessionsA$WTSEnumerateSessionsExA$WTSEnumerateSessionsExW$WTSEnumerateSessionsW$WTSFreeMemory$WTSFreeMemoryExA$WTSFreeMemoryExW$WTSGetActiveConsoleSessionId$WTSGetChildSessionId$WTSGetListenerSecurityA$WTSGetListenerSecurityW$WTSIsChildSessionsEnabled$WTSLogoffSession$WTSOpenServerA$WTSOpenServerExA$WTSOpenServerExW$WTSOpenServerW$WTSQueryListenerConfigA$WTSQueryListenerConfigW$WTSQuerySessionInformationA$WTSQuerySessionInformationW$WTSQueryUserConfigA$WTSQueryUserConfigW$WTSQueryUserToken$WTSRegisterSessionNotification$WTSRegisterSessionNotificationEx$WTSSendMessageA$WTSSendMessageW$WTSSetListenerSecurityA$WTSSetListenerSecurityW$WTSSetUserConfigA$WTSSetUserConfigW$WTSShutdownSystem$WTSStartRemoteControlSessionA$WTSStartRemoteControlSessionW$WTSStopRemoteControlSession$WTSTerminateProcess$WTSUnRegisterSessionNotification$WTSUnRegisterSessionNotificationEx$WTSVirtualChannelClose$WTSVirtualChannelOpen$WTSVirtualChannelOpenEx$WTSVirtualChannelPurgeInput$WTSVirtualChannelPurgeOutput$WTSVirtualChannelQuery$WTSVirtualChannelRead$WTSVirtualChannelWrite$WTSWaitSystemEvent$wtsapi32.dll
API String ID: 2238633743-2998606599
Opcode ID: 58f037b4dfcc0c0f6153050d52cb80cf1f43709ff7803f71061a8f5da0502f32
Instruction ID: 889e04a529bee836fa364e9f33b3c2be857b4fef63ba590a49f0ca02da6b30e0
Opcode Fuzzy Hash: 58f037b4dfcc0c0f6153050d52cb80cf1f43709ff7803f71061a8f5da0502f32
Instruction Fuzzy Hash: 56B158B4D44315EBCB315F79AC4A8063EA3E7047783808917E9845E2BAE6BF8050FF91

Function 00D6E4DD Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 138registrythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00DB6B05: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00000FA0,00000000,00000000,00000000,?,00D6E59B,00000001,00006060,00000010), ref: 00DB6B3E

GetVersionExA.KERNEL32(?), ref: 00D6E5CD
GetNativeSystemInfo.KERNEL32(?), ref: 00D6E5E7
RegOpenKeyExA.ADVAPI32(80000002,Software\FreeRDP\FreeRDP\RemoteFX,00000000,00020119,?), ref: 00D6E612
primitives_get.GETSCREEN-156413884-X86 ref: 00D6E6DC
CreateThreadpool.KERNEL32(00000000), ref: 00D6E6E2

Strings

Software\FreeRDP\FreeRDP\RemoteFX, xrefs: 00D6E605
com.freerdp.codec.rfx, xrefs: 00D6E530

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: CountCreateCriticalInfoInitializeNativeOpenSectionSpinSystemThreadpoolVersionprimitives_get
String ID: Software\FreeRDP\FreeRDP\RemoteFX$com.freerdp.codec.rfx
API String ID: 3882483829-2530424157
Opcode ID: 32f5e091e2b1d32d4fc4213206633ff03a16acd273ed0287aa5cb20d16a4fdae
Instruction ID: 5c4e0ae59249631e6cc24edc33fd482fdee636d76ee8ea35f24eae6d19730bd6
Opcode Fuzzy Hash: 32f5e091e2b1d32d4fc4213206633ff03a16acd273ed0287aa5cb20d16a4fdae
Instruction Fuzzy Hash: 0041AEB5A0070AAFEB109FB5DC86B6AB7F8FF44704F10442DE549A6282EB74D9458F70

Function 00DAE437 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB43BE

Strings

sspi_EncryptMessage, xrefs: 00DB4406, 00DB443E, 00DB4443, 00DB4449
EncryptMessage: %s (0x%08X), xrefs: 00DB4401
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB440B, 00DB444A
[%s]: Security module does not provide an implementation, xrefs: 00DB4444

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$EncryptMessage: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_EncryptMessage
API String ID: 689400697-3976766517
Opcode ID: f369313ce97d77256c537f2cd269f98f8828213c85fe734e9aed2eadb1d5a78d
Instruction ID: b9081319dcaf33b24754beb8ac5c78ab50d4c5ef5aaeac8cc1ecbdc5ad09c99c
Opcode Fuzzy Hash: f369313ce97d77256c537f2cd269f98f8828213c85fe734e9aed2eadb1d5a78d
Instruction Fuzzy Hash: 10114635784305BBEA21AE56EC07F673A5CDB91B60F040054F541A61E2D9A2D921E671

Function 00DAE42E Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB42FB

Strings

sspi_DecryptMessage, xrefs: 00DB4343, 00DB437B, 00DB4380, 00DB4386
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB4348, 00DB4387
DecryptMessage: %s (0x%08X), xrefs: 00DB433E
[%s]: Security module does not provide an implementation, xrefs: 00DB4381

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$DecryptMessage: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_DecryptMessage
API String ID: 689400697-3301108232
Opcode ID: 3bd30c57549016c991fe5c43270f22717075e25eed3e706dcfc899111b149208
Instruction ID: dd33cee2726611f6ec9e59f22ed0059c62e60ab8a3d6583eb77e36d44d2969aa
Opcode Fuzzy Hash: 3bd30c57549016c991fe5c43270f22717075e25eed3e706dcfc899111b149208
Instruction Fuzzy Hash: 4011AB357C4305BBEA216A56EC43E6F3FACEB95B60F080054F541A61D2D962DA10E771

Function 00D55E14 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

crypto_cert_fingerprint.GETSCREEN-156413884-X86(?), ref: 00D55E1C

Part of subcall function 00D5576E: crypto_cert_fingerprint_by_hash.GETSCREEN-156413884-X86(?,sha256), ref: 00D55779

crypto_cert_issuer.GETSCREEN-156413884-X86(?), ref: 00D55E30
crypto_cert_subject.GETSCREEN-156413884-X86(?,?), ref: 00D55E3A
certificate_data_new.GETSCREEN-156413884-X86(?,?,00000000,00000000,00000000,?,?), ref: 00D55E4A

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: certificate_data_newcrypto_cert_fingerprintcrypto_cert_fingerprint_by_hashcrypto_cert_issuercrypto_cert_subject
String ID:
API String ID: 1865246629-0
Opcode ID: b22f0af09afbb53f47c67a66392b01df666bde5d5b51faeba4ef9e6157e0229e
Instruction ID: 1c0b49ac72356f5ad9bb6363ab6a0902b68539d48f6c4c0547ab9c3a12defea7
Opcode Fuzzy Hash: b22f0af09afbb53f47c67a66392b01df666bde5d5b51faeba4ef9e6157e0229e
Instruction Fuzzy Hash: ACE0DF36400608BF8F122F69EC06C9F3EBDDF853E0B084124BC1856129DA31CE1096B0

Function 00DFFCA9 Relevance: 6.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00DFFDC9,00F2C654), ref: 00DFFCAE
UnhandledExceptionFilter.KERNEL32(?,?,00DFFDC9,00F2C654), ref: 00DFFCB7
GetCurrentProcess.KERNEL32(C0000409,?,00DFFDC9,00F2C654), ref: 00DFFCC2
TerminateProcess.KERNEL32(00000000,?,00DFFDC9,00F2C654), ref: 00DFFCC9

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: 016b122b261de21273483e79371318767e93e4d76e6305f054fed9ede04224c6
Instruction ID: a7857dc23f70debcd977cb2c300a531c34c70a76bf39b72adb1ed1a1a4242ea3
Opcode Fuzzy Hash: 016b122b261de21273483e79371318767e93e4d76e6305f054fed9ede04224c6
Instruction Fuzzy Hash: B3D012BA200208AFCB002BE2FD0DB493F2CFB4A61AF050000F31AA20F0CB71440A8B65

Function 007B89A0 Relevance: 5.1, Strings: 4, Instructions: 137COMMON

Download Yara Rule

Strings

ineI, xrefs: 0084C6C7
OPENSSL_ia32cap, xrefs: 0084C80B
Genu, xrefs: 0084C6BF
ntel, xrefs: 0084C6CF

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID:
String ID: Genu$OPENSSL_ia32cap$ineI$ntel
API String ID: 0-3767422159
Opcode ID: ae20e81f5512b77e481a2e372628164d7d4438548ba766812f1aba8ba182533d
Instruction ID: de1202f48f8790d414aeeb0ca491e35612ab89476333db9efcefede778ee7140
Opcode Fuzzy Hash: ae20e81f5512b77e481a2e372628164d7d4438548ba766812f1aba8ba182533d
Instruction Fuzzy Hash: AA4126B6F0624D07EF9C867DAC9537E7589FB91364F28423ED926D62C0DE348D408A85

Function 00E061B5 Relevance: 4.6, APIs: 3, Instructions: 77COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00E062AD
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00E062B7
UnhandledExceptionFilter.KERNEL32(00D2259A,?,?,?,?,?,00000000), ref: 00E062C4

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 2ccb5e450294c3fe2719864c2c993fac8f5844d992e25ede9c9290fb90015094
Instruction ID: 6a2952a010dd6da13343bb6801a2fa41b5786336413aad5d3db0be1cc73455ad
Opcode Fuzzy Hash: 2ccb5e450294c3fe2719864c2c993fac8f5844d992e25ede9c9290fb90015094
Instruction Fuzzy Hash: 3F31B37490122C9BCB21DF28D88978DBBF8BF08314F5051EAE41CB62A0EB709B858F54

Function 00D55B39 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

crypto_cert_subject.GETSCREEN-156413884-X86(?), ref: 00D55B42
crypto_cert_issuer.GETSCREEN-156413884-X86(?,?), ref: 00D55B4C
crypto_cert_fingerprint.GETSCREEN-156413884-X86(?,?,?), ref: 00D55B56

Part of subcall function 00D5576E: crypto_cert_fingerprint_by_hash.GETSCREEN-156413884-X86(?,sha256), ref: 00D55779

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: crypto_cert_fingerprintcrypto_cert_fingerprint_by_hashcrypto_cert_issuercrypto_cert_subject
String ID:
API String ID: 727492566-0
Opcode ID: 2403153368bf5f0852c407299b060d09ba28b0057ab7bad3b343f04c5c55d6c4
Instruction ID: f357fcf4cb418b04d764c3de1ef7c4baeff25b8ba25949f7cb7423e003aecef0
Opcode Fuzzy Hash: 2403153368bf5f0852c407299b060d09ba28b0057ab7bad3b343f04c5c55d6c4
Instruction Fuzzy Hash: 3A118271704B0226EF369676BC2AF2F27DCDF117A1B188415FC00DB18AEA26DD0486B4

Function 00D5576E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 5COMMON

Download Yara Rule

APIs

crypto_cert_fingerprint_by_hash.GETSCREEN-156413884-X86(?,sha256), ref: 00D55779

Part of subcall function 00D55782: crypto_cert_hash.GETSCREEN-156413884-X86(?,?,?,?,?,?,?,00D5577E,?,sha256), ref: 00D55792

Strings

sha256, xrefs: 00D55771

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: crypto_cert_fingerprint_by_hashcrypto_cert_hash
String ID: sha256
API String ID: 2885152359-1556616439
Opcode ID: c1e9b217ca1ffe56e717449f4c2af574b4cc3c33386e733707082b913d5a7de7
Instruction ID: e567db67adf3dbc249e0d7542a6e120bc2eccc011ac05864b18c4408144b3351
Opcode Fuzzy Hash: c1e9b217ca1ffe56e717449f4c2af574b4cc3c33386e733707082b913d5a7de7
Instruction Fuzzy Hash: 21A0223020830CBB8E023B83CC03C0A3E0CCA00B83B0020B8BC0020023CBA2BA0280F2

Function 00D63F1C Relevance: 3.1, APIs: 2, Instructions: 85COMMON

Download Yara Rule

APIs

crypto_base64_encode.GETSCREEN-156413884-X86(00F4A688,00000000,00000000,00000000,00000000,?,00D55E4F,?,?,00000000,00000000,00000000,?,?), ref: 00D63F7D

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: crypto_base64_encode
String ID:
API String ID: 2528031924-0
Opcode ID: 1fe5a3de59c1c85c98f480b88233d7ac88b521ca3bf8fc4c4f11a835b4a4b415
Instruction ID: 1fcad4f5210f19a334c1a5e72c29a226ad98737459e4eac7e453d7e8899c13a2
Opcode Fuzzy Hash: 1fe5a3de59c1c85c98f480b88233d7ac88b521ca3bf8fc4c4f11a835b4a4b415
Instruction Fuzzy Hash: DD210A32A04B03AFCB30AF69C80285B77E8EF44351B18442DF945A7192EB35D880CF70

Function 00D55782 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

crypto_cert_hash.GETSCREEN-156413884-X86(?,?,?,?,?,?,?,00D5577E,?,sha256), ref: 00D55792

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: crypto_cert_hash
String ID:
API String ID: 1547982073-0
Opcode ID: 7460d84a63f73ef57bb7a90a7cbc953c30664581771c6989db31222eff5a1bf8
Instruction ID: ba850467087f0828a334f71c251a8c15d8166dc4bdc3d4065560b9b78e07df4a
Opcode Fuzzy Hash: 7460d84a63f73ef57bb7a90a7cbc953c30664581771c6989db31222eff5a1bf8
Instruction Fuzzy Hash: 2DC048B601010CBFAF06AB85CC86CAA7B6DEA04260B008225BE0445021E6B2BE14AAB0

Function 00769700 Relevance: 1.4, Strings: 1, Instructions: 198COMMON

Download Yara Rule

Strings

o.u, xrefs: 0076970F

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID:
String ID: o.u
API String ID: 0-2544032144
Opcode ID: 62ceb7660dc4629b2ac26ecb48289b630fa7e8fd35740ff450311f40593f9d80
Instruction ID: fb4e2034edf3ad5f44a358b093e73398b581b673264e65eb06755873bb9dd17d
Opcode Fuzzy Hash: 62ceb7660dc4629b2ac26ecb48289b630fa7e8fd35740ff450311f40593f9d80
Instruction Fuzzy Hash: 5081E120D18BC587E7128F3CC8426AAF3A4BFD6318F14E719EED466152FB71A6C58781

Function 00D55ABB Relevance: 1.3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

Strings

@, xrefs: 00D55AC5

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 6f2c8adfc3a7746f7bcc21c7e8ebdf9c9b635e5e3cb3ad753f3208d9ff8683b7
Instruction ID: 562affd42bf784ddf98d1be003d6c0b8107474a2717e2619a77246753272dd68
Opcode Fuzzy Hash: 6f2c8adfc3a7746f7bcc21c7e8ebdf9c9b635e5e3cb3ad753f3208d9ff8683b7
Instruction Fuzzy Hash: FEF0BE32210608BAEF229E95EC4AF9B7BACDB407A0F240025FE046A140D6719D0486B1

Function 007701A0 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8843ff878148d9d6b200c78fe77f3a658439cee7fc1cd39c9f06291863b8ff64
Instruction ID: 14db8f50dbe7c54e591788a1c4512dee5504e2f07de67c73789d775a0e45e454
Opcode Fuzzy Hash: 8843ff878148d9d6b200c78fe77f3a658439cee7fc1cd39c9f06291863b8ff64
Instruction Fuzzy Hash: C1E1D369C2DFD946E323573EA80326BE7647FFB284E50EB1BBDD431C21EB6142456209

Function 007A6657 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be81703520fa74d5847a713d340fe6bf848b73201990e2e06a3e8eaca0f20479
Instruction ID: 10fcef939b0b583ff3274529d616bbdf6e9fcf77bc2851a7fe8f36e979aa5c1c
Opcode Fuzzy Hash: be81703520fa74d5847a713d340fe6bf848b73201990e2e06a3e8eaca0f20479
Instruction Fuzzy Hash: 3AA1AD21C19FC586E70B3B35444B265E330AFF3288B54CB06FDA178967EB69B6C85261

Function 00D67B3F Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06cfed2109845416018322ccb59ac96f7411ea8d75f5aac0e58571d0c0e5568b
Instruction ID: 6bd73b07ed0964d515ddbbdade972e58e1512b3ed73cc4faeef96dff51467de9
Opcode Fuzzy Hash: 06cfed2109845416018322ccb59ac96f7411ea8d75f5aac0e58571d0c0e5568b
Instruction Fuzzy Hash: C33133A26083C40ED3198F6C88646747FE59BAA100B0D84DEE9F9CF343E120DA0AD731

Function 0078B080 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67c5a5b38ad57acd17395755d6869b213b2472f5960ea1db488aef957251935f
Instruction ID: dd1968abbb16a3c8fff670917b0ab1def610f4478baa494159eae58501fde8a0
Opcode Fuzzy Hash: 67c5a5b38ad57acd17395755d6869b213b2472f5960ea1db488aef957251935f
Instruction Fuzzy Hash: 02512372C20F8286E261AB31CD45793B7E17FE5304F24972EE4DA211A1FBB571E48E85

Function 007A7300 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bd6ee22b8be88284ea3de3379d93d189bee9a2acde73ad58f94725c0800f69d
Instruction ID: 34ebaeb37e2cd86641bcbb81574a1f0103a965a8e8a7a8c53d3871bbde799a2a
Opcode Fuzzy Hash: 1bd6ee22b8be88284ea3de3379d93d189bee9a2acde73ad58f94725c0800f69d
Instruction Fuzzy Hash: 4721A520C1CFC9C5E71B7B388C4B2AAAB506FEB344F51D716F8D839452FB284654E151

Function 007AA30D Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51f477ecbd8c86e18464dd12c1106ff108f6fe7e53e3396059e243e6e9527724
Instruction ID: 3e4aa2ddb2d8e81c8354a7a9abd9c0855dd406e35942f766b766150b3b172115
Opcode Fuzzy Hash: 51f477ecbd8c86e18464dd12c1106ff108f6fe7e53e3396059e243e6e9527724
Instruction Fuzzy Hash: DD1151D9C2AF7A06E713633B5D42242DA105EF7989550D347FCB439D61F701B5C17210

Function 00E32165 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 4cfa1d1722eb79ed8c6b704e1e76a99dce7f1ad66c420fb1f8b603a864e74dc0
Instruction ID: 970e76ee9d7991c146ac7fef4dd9531e5d4a0652bc87df06ce420964a836ea40
Opcode Fuzzy Hash: 4cfa1d1722eb79ed8c6b704e1e76a99dce7f1ad66c420fb1f8b603a864e74dc0
Instruction Fuzzy Hash: F8011275A0020DAFDB08DFA9DC519FFBBB9EB88720F10812AF515A7291EA705905CB70

Function 00D5590A Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b422819db95d3645cbdcc77238595e870197e85cf553f878d55c446da8e9666
Instruction ID: 41505bf8cf5951f31ab428fa2e0f3685ea666266fc7e5b4dbe963e1d5a9e9e38
Opcode Fuzzy Hash: 7b422819db95d3645cbdcc77238595e870197e85cf553f878d55c446da8e9666
Instruction Fuzzy Hash: E6F06272904119AFDF05ABA4DC068BE77A8EF04315F500469FC12A7141EA74D9188A70

Function 00D55732 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 911fe133215822d16af9a9dfc112a6ee4ab14ddce8b8a69d0b2a4c7a9a515291
Instruction ID: 842e43f4289518e28d74c16c7e84d4214ffe0bce9b6da920772f168b778eb596
Opcode Fuzzy Hash: 911fe133215822d16af9a9dfc112a6ee4ab14ddce8b8a69d0b2a4c7a9a515291
Instruction Fuzzy Hash: 74E09B32100E19E6CF131E05EC519AB3B55EFC2373F180026FD0467044C731B982CBA5

Function 00E32620 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfd3501ae8cc7d54b5b6039e73c4159469e4ee806065cc444d8108c8b9717388
Instruction ID: 419e91bec4c82c99b07cd036027dfda2c2694e7e65ce98a11267ea2dad50fc65
Opcode Fuzzy Hash: cfd3501ae8cc7d54b5b6039e73c4159469e4ee806065cc444d8108c8b9717388
Instruction Fuzzy Hash: 62E08635B122159F8B15CE65D8015AA7BE5BF45704B54A46CDDC5EB300D330EC01CB80

Function 00D573E8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abef29f18486b8e7023c2129847a18c3c9cea34ce2d28db27c277d5279c50b60
Instruction ID: e2fa7e35269439170c35fce92ff8c28daf2a0b6a6056d6c22f76eefd2463ec57
Opcode Fuzzy Hash: abef29f18486b8e7023c2129847a18c3c9cea34ce2d28db27c277d5279c50b60
Instruction Fuzzy Hash: CDD05E3225420DABEF059EE5FC00DBA3B9DEF44625B0C4498FD2C8A511E636D830A650

Function 00D55ED1 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92904718c7774d80baf37b01db223b482aa12a3400e7c889efefc14f73fae5f7
Instruction ID: 5dc183ba330e40957fad80d8a3ad8f84ae50c2ff52a5091aa0c16c402afd12c0
Opcode Fuzzy Hash: 92904718c7774d80baf37b01db223b482aa12a3400e7c889efefc14f73fae5f7
Instruction Fuzzy Hash: EEE0C22A5096A7878721495D60104A7FFA9ADDA695328C5AAEEE45B30A8020EE4543F0

Function 00D55DA5 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4a5700dd9c090860e746394635df8148f9f381a8a4f8febb47ad15a4feb3c59
Instruction ID: 23f7aee23fbcb4f2a99abbc545e3f8f4e2f422cb978c3f8ed146012e22aa7ba2
Opcode Fuzzy Hash: b4a5700dd9c090860e746394635df8148f9f381a8a4f8febb47ad15a4feb3c59
Instruction Fuzzy Hash: EAD0123252D93536D92536A9EC07E8B394DCB427B4F150311BC22A51D9E980DE0181E1

Function 00D5612F Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 020cacdd8480cb7acb5a33face7ae5f67d8364c27b2bc5f228b0cde8383a0b65
Instruction ID: e3ec27fb53f9a565ed73b66eba37145f76e25e124ccd78da7bb263489c6aba31
Opcode Fuzzy Hash: 020cacdd8480cb7acb5a33face7ae5f67d8364c27b2bc5f228b0cde8383a0b65
Instruction Fuzzy Hash: F7D06C3204460DBBCF022E85AC02DAA3B6AAB08662F448050FF1805522E673D571ABA5

Function 00D55D58 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc66a9d30c7db1291679ea8940f3866de8d0a73c04af855de0002ed13e2284d9
Instruction ID: 222b4e2af94bbfea3b511734f8257ca267eae342a6a288dfd215d9dabce14bb7
Opcode Fuzzy Hash: dc66a9d30c7db1291679ea8940f3866de8d0a73c04af855de0002ed13e2284d9
Instruction Fuzzy Hash: 93D02233241A2F76EA2036D4A806FDB7B8CCB00BB6F044012FE0CAE185CD60880603F0

Function 00D56105 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a874a97c1a0f1350a0a091136a2aa511b6a6aa38adc0722bbc87292597935bc
Instruction ID: 0e91feeecc876a76e10ec398403ce23e2b5e6ae72c73e115dff9804e3f41164d
Opcode Fuzzy Hash: 0a874a97c1a0f1350a0a091136a2aa511b6a6aa38adc0722bbc87292597935bc
Instruction Fuzzy Hash: 85D0953600420EBB8F026EC5DC02CAA3F6AFF08391F408010FE2001022DA33E931ABE1

Function 00D5584E Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c44ae05eeeaf96c3b4c4259dcbd0ced95bce8786c5fb31708b966f3efd20d008
Instruction ID: 91e23dd84f762b46bc56f0ed85777cde0c837a02c25801760fa949f67a84495d
Opcode Fuzzy Hash: c44ae05eeeaf96c3b4c4259dcbd0ced95bce8786c5fb31708b966f3efd20d008
Instruction Fuzzy Hash: C2C0122044421C7AEF00FAE4CC0BDBF7A6CEB00701FC004107D1053042E6B0D51D86B0

Function 00D55831 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00697b1b55a066e8f6e82ecc9971366dd5c01e2c0e8b86d5be220022d81dff43
Instruction ID: df2ac6a19e282e52eaa3b77a736fb7e4b4ff410bfa794ca1b51d6b982a88c2cc
Opcode Fuzzy Hash: 00697b1b55a066e8f6e82ecc9971366dd5c01e2c0e8b86d5be220022d81dff43
Instruction Fuzzy Hash: B9C02B32401238E34E113D44E400899BF8C8D00BA230C0021FC083711641136C0003E0

Function 00D67B24 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b7a3ce230df7e31ab3e725e1e43306e95fe06bef9b56ac6c445c84563359095
Instruction ID: 87eb183e67802edc6cde5889e2f8a0c04e705deaea7600a1df51b01cd2a52767
Opcode Fuzzy Hash: 4b7a3ce230df7e31ab3e725e1e43306e95fe06bef9b56ac6c445c84563359095
Instruction Fuzzy Hash: A9C0027114820DABCF029F95EC018993B6AEF45368B004065FD180A221D63399319BA5

Function 00D55D82 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f213a4fa0332fa88bc39a926fb07c1300ecb502a4f432fd2e01db9a1bb9e3ce3
Instruction ID: 4e1a5f3b0ea0407e92c410e3ba137f5422deec082eafdb3fdba1cca5fd6c0de2
Opcode Fuzzy Hash: f213a4fa0332fa88bc39a926fb07c1300ecb502a4f432fd2e01db9a1bb9e3ce3
Instruction Fuzzy Hash: AFB0123204C30C7A9D0936E1FC0784A3B8DC9406F07200016FC2D05456AD27F55052FD

Function 00D55966 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c058d809a171879c7d2e6b30af2b691a972df3c75a096c5f2351ff0c006427d
Instruction ID: eec5a375ecff08bb143ef01d80de91bbe13dee169b701c37e0d9f64dc46c04d8
Opcode Fuzzy Hash: 5c058d809a171879c7d2e6b30af2b691a972df3c75a096c5f2351ff0c006427d
Instruction Fuzzy Hash: 49B09231004228BB47266A9A8809C8B7FACEB06AA07000000BD09471118A34A901D6EA

Function 00D55A65 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a503f68feaf53306e5e090325c103b21fd0aafa9d66652788954b5afafb2aef
Instruction ID: 7e6491405c832f5386b6ee998b355e642099619fb39de2db90d20a66ccfcd324
Opcode Fuzzy Hash: 4a503f68feaf53306e5e090325c103b21fd0aafa9d66652788954b5afafb2aef
Instruction Fuzzy Hash: D9C09B648053489ADA40F7F5850E85F7AEC9F05700F854514AD9157143DA78D548C7B3

Function 00D55B24 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1147995217c392e36dfc48353d2d3a4c789210a0bcddb43d26d5ef8e713f020
Instruction ID: 470d9df7f77793a3b5a0a34ac0147ecc587545c377c8dbc8cf61c4e4b9f18541
Opcode Fuzzy Hash: c1147995217c392e36dfc48353d2d3a4c789210a0bcddb43d26d5ef8e713f020
Instruction Fuzzy Hash: A0A01230000208738D013B61EC0794A394CC9012C170000107C10010168966A55401BC

Function 00D55D97 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a308af3d19b287379fcfdac4b35ebea863e8ea0d915d34481b303974fcc68d7
Instruction ID: 2d0fb86a4af904b59551be876cd411544704f85c5edada9b179c57e0cffe5a39
Opcode Fuzzy Hash: 1a308af3d19b287379fcfdac4b35ebea863e8ea0d915d34481b303974fcc68d7
Instruction Fuzzy Hash:

Function 00D55A61 Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c1af10e55f65fcf33e1f61e2858dedc3d93677e06f0a9ee18408edf0f16553e
Instruction ID: f9d93bb6050abece768ba640a33519d1f25643404e4c276bdb386cb4d050c773
Opcode Fuzzy Hash: 3c1af10e55f65fcf33e1f61e2858dedc3d93677e06f0a9ee18408edf0f16553e
Instruction Fuzzy Hash:

Function 00DA14E3 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 194sleepCOMMON

Download Yara Rule

APIs

freerdp_error_info.GETSCREEN-156413884-X86(?,?,?,?,?,?,?,00DA14DF,?,00000000), ref: 00DA1519
freerdp_get_error_info_string.GETSCREEN-156413884-X86(00000000,?,?,?,?,?,?,00DA14DF,?,00000000), ref: 00DA155D
freerdp_reconnect.GETSCREEN-156413884-X86(?,?,?,?,?,?,?,00DA14DF,?,00000000), ref: 00DA1601
freerdp_get_last_error.GETSCREEN-156413884-X86(?,?,?,?,?,?,?,00DA14DF,?,00000000), ref: 00DA1611
Sleep.KERNEL32(0000000A,?,?,?,?,?,?,00DA14DF,?,00000000), ref: 00DA167E

Strings

Disconnected by server hitting a bug or resource limit [%s], xrefs: 00DA1563
Attempting reconnect (%u of %u), xrefs: 00DA15DA
C:\Project\agent-windows\freerdp\FreeRDP\client\common\client.c, xrefs: 00DA156D, 00DA15E4, 00DA164B, 00DA16C1, 00DA171A
com.freerdp.client.common, xrefs: 00DA153E, 00DA1589, 00DA15BC, 00DA1627, 00DA169D, 00DA16E9, 00DA16F2
Autoreconnect aborted by user, xrefs: 00DA1641
client_auto_reconnect_ex, xrefs: 00DA1568, 00DA15DF, 00DA1646, 00DA16BC, 00DA1715
Maximum reconnect retries exceeded, xrefs: 00DA16B7
Network disconnect!, xrefs: 00DA1710

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Sleepfreerdp_error_infofreerdp_get_error_info_stringfreerdp_get_last_errorfreerdp_reconnect
String ID: Attempting reconnect (%u of %u)$Autoreconnect aborted by user$C:\Project\agent-windows\freerdp\FreeRDP\client\common\client.c$Disconnected by server hitting a bug or resource limit [%s]$Maximum reconnect retries exceeded$Network disconnect!$client_auto_reconnect_ex$com.freerdp.client.common
API String ID: 968149013-2963753137
Opcode ID: 52e07c33af9fc13d6e074c0f836e5f8e7aea98aecd7a1dfff7b1998b3a5752e1
Instruction ID: 1b780f5c1893d4df400537a90cfae4965274cec3d1a900c8f12ba80652d98e88
Opcode Fuzzy Hash: 52e07c33af9fc13d6e074c0f836e5f8e7aea98aecd7a1dfff7b1998b3a5752e1
Instruction Fuzzy Hash: 9751D776B4030577EB257B25EC43F7A27A8DF62B50F1C4029F610FA1D1EA76DA808674

Function 00D6A89E Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 127COMMON

Download Yara Rule

APIs

gdi_get_pixel_format.GETSCREEN-156413884-X86(?,?,?,?,?,00D6A899,?,?,00000000,00000000,Function_006DAA7A), ref: 00D6A8B3
gdi_free.GETSCREEN-156413884-X86(?,?,?,?,?,00D6A899,?,?,00000000,00000000,Function_006DAA7A), ref: 00D6AA40

Strings

failed to initialize gdi, xrefs: 00D6AA6D
com.freerdp.gdi, xrefs: 00D6A8D7, 00D6AA4F
gdi_init_ex, xrefs: 00D6AA72
C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\gdi\gdi.c, xrefs: 00D6AA77

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: gdi_freegdi_get_pixel_format
String ID: C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\gdi\gdi.c$com.freerdp.gdi$failed to initialize gdi$gdi_init_ex
API String ID: 1251975138-534786182
Opcode ID: 736e6e28bfab0f4d5ff8517606a17aaf4e9ac39a32e281fa7f1c25b6275a8a44
Instruction ID: 048db22db05d0468b72fba943d9835b19abd880d5ce30f0cf61c222ec5a33d59
Opcode Fuzzy Hash: 736e6e28bfab0f4d5ff8517606a17aaf4e9ac39a32e281fa7f1c25b6275a8a44
Instruction Fuzzy Hash: 984172712007026FDB54AF68DC42B6AB7A5FF15310F18442AF598AB192EF71A851CF71

Function 00D30E1F Relevance: 17.6, APIs: 2, Strings: 8, Instructions: 141COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 00D30F64
RtlLeaveCriticalSection.NTDLL(?), ref: 00D30F79

Strings

com.freerdp.core.client, xrefs: 00D30E3D, 00D30E9A, 00D30F9B
PDRF, xrefs: 00D30F4B
C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\client.c, xrefs: 00D30E69, 00D30EC2, 00D30FC3
error: channel export function call failed, xrefs: 00D30FB9
Skipping, channel already loaded, xrefs: 00D30EB8
error: too many channels, xrefs: 00D30E5F
freerdp_channels_client_load_ex, xrefs: 00D30E64, 00D30EBD, 00D30FBE
,, xrefs: 00D30F23

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: ,$C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\client.c$PDRF$Skipping, channel already loaded$com.freerdp.core.client$error: channel export function call failed$error: too many channels$freerdp_channels_client_load_ex
API String ID: 3168844106-1571615648
Opcode ID: e196fda8aa3df71ec429677dd426a63e709925eb21032b98280bf9f47e7f55da
Instruction ID: 329d81fc3df4a899cedadc6a72d75e6cba0eb4365c05580b2ca61c68765f337e
Opcode Fuzzy Hash: e196fda8aa3df71ec429677dd426a63e709925eb21032b98280bf9f47e7f55da
Instruction Fuzzy Hash: 6741D571B4030AAFDB209F69EC42B597BE8EB09714F144429F654F72D0D7B5A9018BA4

Function 00D36AF2 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 449COMMON

Download Yara Rule

APIs

freerdp_settings_free.GETSCREEN-156413884-X86(00000000), ref: 00D37326

Part of subcall function 00D37F9B: GetComputerNameExA.KERNEL32(00000000,?,?,00000000), ref: 00D37FCC
Part of subcall function 00D37F9B: freerdp_settings_set_string.GETSCREEN-156413884-X86(?,00000680,?), ref: 00D37FFC

freerdp_settings_set_string.GETSCREEN-156413884-X86(00000000,00000086,?), ref: 00D36D8C
freerdp_settings_set_bool.GETSCREEN-156413884-X86(00000000,00001446,00000001), ref: 00D37177
freerdp_settings_set_uint32.GETSCREEN-156413884-X86(00000000,00001447,00000003), ref: 00D3718F
freerdp_settings_set_uint32.GETSCREEN-156413884-X86(00000000,00001448,00000005), ref: 00D371A7
freerdp_settings_set_uint32.GETSCREEN-156413884-X86(00000000,00001449,00000002), ref: 00D371BF
freerdp_settings_set_uint32.GETSCREEN-156413884-X86(00000000,0000144A,00002328), ref: 00D371DA
freerdp_settings_set_uint32.GETSCREEN-156413884-X86(00000000,0000144D,00003A98), ref: 00D371F5

Strings

C:\Windows\System32\mstscax.dll, xrefs: 00D36F3F

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: freerdp_settings_set_uint32$freerdp_settings_set_string$ComputerNamefreerdp_settings_freefreerdp_settings_set_bool
String ID: C:\Windows\System32\mstscax.dll
API String ID: 2536960967-183970058
Opcode ID: a0fcc8c7c1138c1ebde9721e5b4015ea08b20d290a10227be3374d74c5b95e51
Instruction ID: 0b96d550a898f720747fe1bc14c123a67325764ff190d059cf32dcdedd2d57ab
Opcode Fuzzy Hash: a0fcc8c7c1138c1ebde9721e5b4015ea08b20d290a10227be3374d74c5b95e51
Instruction Fuzzy Hash: 0412F9B1A04F009EE324DF39D885B97B7E4FF08311F54492EE5AE87291DBB5A580CB58

Function 00DA6C86 Relevance: 16.1, APIs: 4, Strings: 5, Instructions: 337COMMON

Download Yara Rule

APIs

freerdp_device_collection_add.GETSCREEN-156413884-X86(?,?), ref: 00DA6D79
freerdp_device_collection_add.GETSCREEN-156413884-X86(?,00000000), ref: 00DA6E1D
freerdp_device_collection_add.GETSCREEN-156413884-X86(?,00000000), ref: 00DA6F6F
freerdp_device_collection_add.GETSCREEN-156413884-X86(?,00000000), ref: 00DA7044

Strings

drive, xrefs: 00DA6C95
serial, xrefs: 00DA6E3D
printer, xrefs: 00DA6CDF
smartcard, xrefs: 00DA6DA3
parallel, xrefs: 00DA6FAF

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: freerdp_device_collection_add
String ID: drive$parallel$printer$serial$smartcard
API String ID: 2538329621-807955808
Opcode ID: 3c7d77665c20f1ca863a836b189f594689807942b2e15851ff90dcb0ac55d62c
Instruction ID: 4fdefb2aadd57d8e8ca45f8235a31c89f0d83400624acd8d5ba121443c7c77a2
Opcode Fuzzy Hash: 3c7d77665c20f1ca863a836b189f594689807942b2e15851ff90dcb0ac55d62c
Instruction Fuzzy Hash: 2DB1A036608602DBDF15AF18D84199E7BE1FF46350B188069F804AF292EF72DD919FA4

Function 00D30C4D Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 145COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 00D30D92
RtlLeaveCriticalSection.NTDLL(?), ref: 00D30DB2

Strings

com.freerdp.core.client, xrefs: 00D30C6C, 00D30CCA, 00D30DD3
freerdp_channels_client_load, xrefs: 00D30C93, 00D30CED, 00D30DF6
C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\client.c, xrefs: 00D30C98, 00D30CF2, 00D30DFB
error: channel export function call failed, xrefs: 00D30DF1
PDRF, xrefs: 00D30D76
Skipping, channel already loaded, xrefs: 00D30CE8
error: too many channels, xrefs: 00D30C8E

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\client.c$PDRF$Skipping, channel already loaded$com.freerdp.core.client$error: channel export function call failed$error: too many channels$freerdp_channels_client_load
API String ID: 3168844106-4217659166
Opcode ID: 51e591a06f08c591435b422d6e952d2ddc77b0e0d15d6984e73f578023353a9d
Instruction ID: d2acf971fe50968f178ca803bba6dce10a18dfd0ca66655c62a2c63ab1213201
Opcode Fuzzy Hash: 51e591a06f08c591435b422d6e952d2ddc77b0e0d15d6984e73f578023353a9d
Instruction Fuzzy Hash: E751AF71A40305AFEB24DF65EC46B5A7BA8EB05714F144029F644BB2D1EBB4A900CB64

Function 00E358B8 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 93COMMON

Download Yara Rule

APIs

audio_format_get_tag_string.GETSCREEN-156413884-X86(00000000,?,?,00E35425,?,?,?,?,00000000,?), ref: 00E358FA
audio_format_get_tag_string.GETSCREEN-156413884-X86(00000001,00000000,?,?,00E35425,?,?,?,?,00000000,?), ref: 00E35902
audio_format_compatible.GETSCREEN-156413884-X86(%T,?,?,?,?,00E35425,?,?,?,?,00000000,?), ref: 00E3594D

Strings

freerdp_dsp_resample, xrefs: 00E35909, 00E3590E, 00E35914, 00E35989
com.freerdp.dsp, xrefs: 00E358D4, 00E35966
Missing resample support, recompile -DWITH_SOXR=ON or -DWITH_DSP_FFMPEG=ON, xrefs: 00E35984
%s requires %s for sample input, got %s, xrefs: 00E3590F
C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\dsp.c, xrefs: 00E35915, 00E3598E
%T, xrefs: 00E35937, 00E35949, 00E3594C

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: audio_format_get_tag_string$audio_format_compatible
String ID: %T$%s requires %s for sample input, got %s$C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\dsp.c$Missing resample support, recompile -DWITH_SOXR=ON or -DWITH_DSP_FFMPEG=ON$com.freerdp.dsp$freerdp_dsp_resample
API String ID: 204136587-1473788660
Opcode ID: 29c281bf8f68dacc1c6ecbc63b5716983a06f941abb9707eafc645fe31ac66ec
Instruction ID: 1798c5e9b03cc595c653d2a1446ba90b8626bdce48c38534dee020eb9ed1cae7
Opcode Fuzzy Hash: 29c281bf8f68dacc1c6ecbc63b5716983a06f941abb9707eafc645fe31ac66ec
Instruction Fuzzy Hash: 8521AAB27443016AE7245B64AC47F6B3BDCDB5173CF10141AFA54FA1C1EDA1E840D67A

Function 00E33B76 Relevance: 15.1, APIs: 10, Instructions: 134COMMON

Download Yara Rule

APIs

freerdp_settings_set_bool.GETSCREEN-156413884-X86(?,00000400,00000001), ref: 00E33B87
freerdp_settings_set_string.GETSCREEN-156413884-X86(?,00000401,00000000), ref: 00E33BB7
freerdp_settings_set_string.GETSCREEN-156413884-X86(?,00000404,?), ref: 00E33BDB
freerdp_settings_set_string.GETSCREEN-156413884-X86(?,00000402,00000000), ref: 00E33BFA
freerdp_settings_set_string.GETSCREEN-156413884-X86(?,00000014,?), ref: 00E33C12
freerdp_settings_set_string.GETSCREEN-156413884-X86(?,000006C1,?), ref: 00E33C2B
freerdp_settings_set_string.GETSCREEN-156413884-X86(?,00000403,?), ref: 00E33C44
freerdp_settings_set_string.GETSCREEN-156413884-X86(?,00000015,00000000), ref: 00E33C60
freerdp_settings_set_uint32.GETSCREEN-156413884-X86(?,00000013,?), ref: 00E33C82
freerdp_target_net_addresses_free.GETSCREEN-156413884-X86(?), ref: 00E33C93

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: freerdp_settings_set_string$freerdp_settings_set_boolfreerdp_settings_set_uint32freerdp_target_net_addresses_free
String ID:
API String ID: 949014189-0
Opcode ID: 6cef6dd10707ff90aaa457e2c58685527288738f0f1d639d76a365eb69d9ad72
Instruction ID: 3cc2f8fa1af4a78d03d4e5adae9df05d7f39a7578fcc74f9f9acc278b3b8a316
Opcode Fuzzy Hash: 6cef6dd10707ff90aaa457e2c58685527288738f0f1d639d76a365eb69d9ad72
Instruction Fuzzy Hash: C841D971600A06BBE7315F34EC4EF9A7B94FF04308F441024FA05E6591E776EA60CBA4

Function 00DE1612 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 220COMMON

Download Yara Rule

APIs

Part of subcall function 00DB5CD5: InitializeCriticalSectionAndSpinCount.KERNEL32(00000004,00000FA0,?,00000000,?,00DE1701,00000001), ref: 00DB5CF9

zgfx_context_new.GETSCREEN-156413884-X86(00000000), ref: 00DE1874

Part of subcall function 00E3693A: zgfx_context_reset.GETSCREEN-156413884-X86(00000000,00000000,00000000,?,00DE1879,00000000), ref: 00E36964

Strings

zgfx_context_new failed!, xrefs: 00DE18B2
com.freerdp.channels.rdpgfx.client, xrefs: 00DE1635, 00DE167A, 00DE167F, 00DE16A0, 00DE16BE, 00DE1719, 00DE17ED, 00DE1898
rdpgfx_client_context_new, xrefs: 00DE165C, 00DE16C4, 00DE173C, 00DE1810, 00DE18B7
HashTable_New failed!, xrefs: 00DE1737
C:\Project\agent-windows\freerdp\FreeRDP\channels\rdpgfx\client\rdpgfx_main.c, xrefs: 00DE1661, 00DE16C9, 00DE1741, 00DE1815, 00DE18BC
Failed to acquire reference to WLog %s, xrefs: 00DE16BF
calloc failed!, xrefs: 00DE1657, 00DE180B

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpinzgfx_context_newzgfx_context_reset
String ID: C:\Project\agent-windows\freerdp\FreeRDP\channels\rdpgfx\client\rdpgfx_main.c$Failed to acquire reference to WLog %s$HashTable_New failed!$calloc failed!$com.freerdp.channels.rdpgfx.client$rdpgfx_client_context_new$zgfx_context_new failed!
API String ID: 3732774510-3243565116
Opcode ID: e74ce8ee631442bdc1fbf04b03170d64e4ef0986876eec0aec06964121f56f51
Instruction ID: a7884d76c1402203b4a71a9339bf000f96533329993c787448c501b47fe49e02
Opcode Fuzzy Hash: e74ce8ee631442bdc1fbf04b03170d64e4ef0986876eec0aec06964121f56f51
Instruction Fuzzy Hash: 29711974784742BAD320AF26AC46B5677D8FB15B64F140129F544EB6C1DBB4E840CBB4

Function 00DAE889 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 106COMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(WLOG_APPENDER,00000000,00000000), ref: 00DAE8B2
GetEnvironmentVariableA.KERNEL32(WLOG_APPENDER,00000000,00000000), ref: 00DAE8D6

Strings

FILE, xrefs: 00DAE922
BINARY, xrefs: 00DAE938
UDP, xrefs: 00DAE94E
CONSOLE, xrefs: 00DAE911
%s environment variable modified in my back, xrefs: 00DAE8E8
WLOG_APPENDER, xrefs: 00DAE8A6, 00DAE8D1, 00DAE8E3

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: EnvironmentVariable
String ID: %s environment variable modified in my back$BINARY$CONSOLE$FILE$UDP$WLOG_APPENDER
API String ID: 1431749950-225596728
Opcode ID: 26dffbe6dfdadfba69782d2fe792a3301b81378424556aa33b7939396d17bdc5
Instruction ID: ee82b75be1a7cbf690fccbfebfb7c04767cf7637468d7e82a100162d7369ee3d
Opcode Fuzzy Hash: 26dffbe6dfdadfba69782d2fe792a3301b81378424556aa33b7939396d17bdc5
Instruction Fuzzy Hash: D521A13734835629E6647366AC8BE3B1B99CB93B74724043AF405F50C2EE55C891EDB2

Function 00D23971 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 95COMMON

Download Yara Rule

APIs

freerdp_set_last_error_ex.GETSCREEN-156413884-X86(?,?,rdp_set_error_info,C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\rdp.c,0000015B), ref: 00D348D9
freerdp_set_last_error_ex.GETSCREEN-156413884-X86(?,00000000,rdp_set_error_info,C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\rdp.c,0000016A), ref: 00D3498F

Strings

%s missing context=%p, xrefs: 00D34959
com.freerdp.core.rdp, xrefs: 00D34933
C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\rdp.c, xrefs: 00D348C7, 00D3495F, 00D34982
freerdp, xrefs: 00D34919
ErrorInfo, xrefs: 00D3490B
rdp_set_error_info, xrefs: 00D348CC, 00D34953, 00D34958, 00D3495E, 00D34987

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: freerdp_set_last_error_ex
String ID: %s missing context=%p$C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\rdp.c$ErrorInfo$com.freerdp.core.rdp$freerdp$rdp_set_error_info
API String ID: 270715978-29603548
Opcode ID: 6805e0f0f859e76f837a4a9d0c547b024f1cb982e7fd7b7dafe110a540c0051d
Instruction ID: d3638f7f4958cd93d300bb98f490a1a99c7581fee34172c24aa3615508b6c4d9
Opcode Fuzzy Hash: 6805e0f0f859e76f837a4a9d0c547b024f1cb982e7fd7b7dafe110a540c0051d
Instruction Fuzzy Hash: D8210B72A40305BADB106F55DC03FAB7B6CDB51B14F184169FA047A2C5E6F8A640CEB5

Function 00DB4B0C Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 37libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(secur32.dll,?,00DB4AEC), ref: 00DB4B18
LoadLibraryA.KERNEL32(security.dll,?,00DB4AEC), ref: 00DB4B28
GetProcAddress.KERNEL32(00000000,InitSecurityInterfaceW), ref: 00DB4B42
GetProcAddress.KERNEL32(InitSecurityInterfaceA), ref: 00DB4B51

Strings

InitSecurityInterfaceW, xrefs: 00DB4B3C
security.dll, xrefs: 00DB4B23
InitSecurityInterfaceA, xrefs: 00DB4B44
secur32.dll, xrefs: 00DB4B13

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: InitSecurityInterfaceA$InitSecurityInterfaceW$secur32.dll$security.dll
API String ID: 2574300362-4081094439
Opcode ID: 6dc9c195ef71b49740e96efa3b3d7dac41623b4274284e34f788f6e9c7118604
Instruction ID: c6c5fb9d0c236541ea0d90f628031eaa7f36e9349fb369af3d771d2e5b6abcc1
Opcode Fuzzy Hash: 6dc9c195ef71b49740e96efa3b3d7dac41623b4274284e34f788f6e9c7118604
Instruction Fuzzy Hash: 9AF08976D54326D69732EBBABC00D967AE8AB84B543090263E940E3154E6B5D8019FB1

Function 00D642E5 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 181fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000003,00000080,00000000), ref: 00D64320
GetFileSize.KERNEL32(00000000,?), ref: 00D6433A

Strings

%s %hu %s %s %s, xrefs: 00D64610

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: File$CreateSize
String ID: %s %hu %s %s %s
API String ID: 2791376181-2916857029
Opcode ID: 6f5cbd4aeb870431c3efe7dd1a35d044482453006dc06590acbc4c4f4c1987c0
Instruction ID: 237e39134405a733fd206d3881dc8a96382620f8a7c352e027a9d41c61ed9067
Opcode Fuzzy Hash: 6f5cbd4aeb870431c3efe7dd1a35d044482453006dc06590acbc4c4f4c1987c0
Instruction Fuzzy Hash: 54514FB5A00215AFEB11ABB5EC45ABF77FCEF05720B14412AF911F6290EB3499408B74

Function 00D4501B Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 140COMMON

Download Yara Rule

APIs

ber_read_universal_tag.GETSCREEN-156413884-X86(?,00000002,00000000), ref: 00D4502A
ber_read_length.GETSCREEN-156413884-X86(?,?), ref: 00D4503F

Strings

com.freerdp.crypto, xrefs: 00D4510A, 00D45159
C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\crypto\ber.c, xrefs: 00D45132, 00D45182
ber_read_integer, xrefs: 00D4512D, 00D4517D
should implement reading an 8 bytes integer, xrefs: 00D45128
should implement reading an integer with length=%d, xrefs: 00D45178

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: ber_read_lengthber_read_universal_tag
String ID: C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\crypto\ber.c$ber_read_integer$com.freerdp.crypto$should implement reading an 8 bytes integer$should implement reading an integer with length=%d
API String ID: 3186670568-2454464461
Opcode ID: ba375764ba7af731fbd1cde8059592c2cac3e763f6c2fd08624046a6823b2fc2
Instruction ID: 4e51c84c7c1c4a5764acaec974826a5cb9dc166e84ddfb10d4ec214304261f3c
Opcode Fuzzy Hash: ba375764ba7af731fbd1cde8059592c2cac3e763f6c2fd08624046a6823b2fc2
Instruction Fuzzy Hash: 354147B1704B426BDB208F25EC82B2A37E5EB52720F184169F5999B2CFE675D900CB70

Function 00D89C5D Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 109COMMON

Download Yara Rule

APIs

region16_rects.GETSCREEN-156413884-X86(?,?), ref: 00D89C6E

Strings

(%hu,%hu-%hu,%hu), xrefs: 00D89D64
com.freerdp.codec, xrefs: 00D89C80, 00D89CE5, 00D89D33
region16_print, xrefs: 00D89CA7, 00D89D09, 00D89D69
C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\region.c, xrefs: 00D89CAC, 00D89D0E, 00D89D6E
band %d: , xrefs: 00D89D04
nrects=%u, xrefs: 00D89CA2

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: region16_rects
String ID: (%hu,%hu-%hu,%hu)$C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\region.c$band %d: $com.freerdp.codec$nrects=%u$region16_print
API String ID: 844131241-2640574824
Opcode ID: a0621893c0bcdac7eb9a1e157bffbd7a1cc333f7abe26ecca077089619322ab3
Instruction ID: d14cf10fe670c30fddff6f47bd896c1f8f0084ad19bf62500fb6d94763b53b0e
Opcode Fuzzy Hash: a0621893c0bcdac7eb9a1e157bffbd7a1cc333f7abe26ecca077089619322ab3
Instruction Fuzzy Hash: A231A472780306B9E6306B65AC53F76B3D8DB56B11F181015FA94F62D0FA97A9808374

Function 00D22BCF Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 102COMMON

Download Yara Rule

APIs

freerdp_set_last_error_ex.GETSCREEN-156413884-X86(?,00000000,freerdp_connect,C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\freerdp.c,000000AA), ref: 00D22C14
clearChannelError.GETSCREEN-156413884-X86(?,?,00000000,freerdp_connect,C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\freerdp.c,000000AA), ref: 00D22C1B

Part of subcall function 00D226E1: ResetEvent.KERNEL32(?), ref: 00D2270A

Part of subcall function 00D38142: ResetEvent.KERNEL32(?,?,00D22C27,?,?,?,00000000,freerdp_connect,C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\freerdp.c,000000AA), ref: 00D3814E

Strings

freerdp, xrefs: 00D23062
ConnectionResult, xrefs: 00D23077
C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\freerdp.c, xrefs: 00D22BFC
freerdp_connect, xrefs: 00D22C01

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: EventReset$ChannelErrorclearfreerdp_set_last_error_ex
String ID: C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\freerdp.c$ConnectionResult$freerdp$freerdp_connect
API String ID: 3632380314-3564821047
Opcode ID: a578b5f886a1ba92aa63df4fb30f24e917e37c5d5805c9d18a9d5dfe7f20543f
Instruction ID: 47f9ff579d0f6bd4f8c6551b647dceb0c06b388598284b870d4b857142b52a35
Opcode Fuzzy Hash: a578b5f886a1ba92aa63df4fb30f24e917e37c5d5805c9d18a9d5dfe7f20543f
Instruction Fuzzy Hash: 79317E71600215AFEB10DF69E985BAAB7F4FF18304F180079F914E7291DB759A548B70

Function 00D453FD Relevance: 12.1, APIs: 8, Instructions: 80COMMON

Download Yara Rule

APIs

ber_write_universal_tag.GETSCREEN-156413884-X86(?,00000002,00000000), ref: 00D45415
ber_write_length.GETSCREEN-156413884-X86(?,00000001,?,00000002,00000000), ref: 00D4541D
ber_write_universal_tag.GETSCREEN-156413884-X86(?,00000002,00000000), ref: 00D45440
ber_write_length.GETSCREEN-156413884-X86(?,00000002,?,00000002,00000000), ref: 00D45448

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: ber_write_lengthber_write_universal_tag
String ID:
API String ID: 1889070510-0
Opcode ID: 18ef3f9f5ae11241768caf1c4dc31a824dec3e3bd5586f49f269dacf6024e569
Instruction ID: 2370a199a7cdf897bc0aefee0484073bb4ceb46cef0d095266aff33809bbaf7c
Opcode Fuzzy Hash: 18ef3f9f5ae11241768caf1c4dc31a824dec3e3bd5586f49f269dacf6024e569
Instruction Fuzzy Hash: 1F21D731205F44EFDB125B08ED42B6A77A5EF11B01F058459FA8E1FA87C265AE41CBB1

Function 00D4CB5F Relevance: 12.1, APIs: 8, Instructions: 65COMMON

Download Yara Rule

APIs

glyph_cache_new.GETSCREEN-156413884-X86(?), ref: 00D4CB79
brush_cache_new.GETSCREEN-156413884-X86(?), ref: 00D4CB86
pointer_cache_new.GETSCREEN-156413884-X86(?), ref: 00D4CB94
bitmap_cache_new.GETSCREEN-156413884-X86(?), ref: 00D4CBA2
offscreen_cache_new.GETSCREEN-156413884-X86(?), ref: 00D4CBB0
palette_cache_new.GETSCREEN-156413884-X86(?), ref: 00D4CBBE
nine_grid_cache_new.GETSCREEN-156413884-X86(?), ref: 00D4CBCC
cache_free.GETSCREEN-156413884-X86(00000000), ref: 00D4CBDE

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: bitmap_cache_newbrush_cache_newcache_freeglyph_cache_newnine_grid_cache_newoffscreen_cache_newpalette_cache_newpointer_cache_new
String ID:
API String ID: 2332728789-0
Opcode ID: 42906154869710506a0c67ebba1e6bbb42983877cc0118c6e46d3c0bd67e0258
Instruction ID: fff0f8e958aee5268df8f76507cf07d66487e8d42236f9fcc16d47005cc25ea2
Opcode Fuzzy Hash: 42906154869710506a0c67ebba1e6bbb42983877cc0118c6e46d3c0bd67e0258
Instruction Fuzzy Hash: E501803625AB075BE364AEB6A853D3B67E8CF42B70718543FE480E6981FF24D40186B1

Function 00D6EFD0 Relevance: 10.7, APIs: 7, Instructions: 160COMMON

Download Yara Rule

APIs

region16_init.GETSCREEN-156413884-X86(?), ref: 00D6F58A

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: region16_init
String ID:
API String ID: 4140821900-0
Opcode ID: 3e8d829aa97f6b1ed1f2f2cf94f42bc771981313d169c183af5fd76dbc63c424
Instruction ID: 305966164178dc0f8d3ba639d6ef2abdbb41c12daa4f928cff9ce80e3619b53f
Opcode Fuzzy Hash: 3e8d829aa97f6b1ed1f2f2cf94f42bc771981313d169c183af5fd76dbc63c424
Instruction Fuzzy Hash: A8517CB2D00219ABDF18EFA9D8819EEBBF9FF48304F14412AF559E7240E7359941CB60

Function 00D6AA9A Relevance: 10.6, APIs: 7, Instructions: 147windowCOMMON

Download Yara Rule

APIs

gdi_CreateCompatibleDC.GETSCREEN-156413884-X86(?,00000000,?,?,?,00D6A9C7,00000000,?,?,?,?,?,?,?,?,00D6A899), ref: 00D6AAE7
gdi_CreateCompatibleBitmap.GETSCREEN-156413884-X86(?,?,?,00000000,?,?,?,00D6A9C7,00000000,?,?,?,?), ref: 00D6AB0E
gdi_CreateBitmapEx.GETSCREEN-156413884-X86(?,?,?,?,?,?,00000000,?,?,?,00D6A9C7,00000000,?,?,?,?), ref: 00D6AB2A
gdi_SelectObject.GETSCREEN-156413884-X86(?,?), ref: 00D6AB60
gdi_CreateRectRgn.GETSCREEN-156413884-X86(00000000,00000000,00000000,00000000), ref: 00D6ABA5
gdi_DeleteObject.GETSCREEN-156413884-X86(?), ref: 00D6AC39
gdi_DeleteDC.GETSCREEN-156413884-X86(?), ref: 00D6AC48

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: gdi_$Create$BitmapCompatibleDeleteObject$RectSelect
String ID:
API String ID: 412453062-0
Opcode ID: 465b4ffd023e57f5a0c4565455c46a70f3e764856c2752f7a876167ddfb1c273
Instruction ID: fdf687e987cde5e3a753ed0a5395322451627d44377fe6879c6aa63682e1b8c5
Opcode Fuzzy Hash: 465b4ffd023e57f5a0c4565455c46a70f3e764856c2752f7a876167ddfb1c273
Instruction Fuzzy Hash: 3B5106792007059FC725DF28C885EA6B7E1FF1C310B0945AEE98A8B762E771E841CF60

Function 00DBEA62 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(WLOG_FILEAPPENDER_OUTPUT_FILE_PATH,00000000,00000000,00000000,?,?,?,?,?,00DB6939,?,?,?,?,00DB6A0A,?), ref: 00DBEABD
GetEnvironmentVariableA.KERNEL32(WLOG_FILEAPPENDER_OUTPUT_FILE_PATH,00000000,?,?,?,?,00DB6939,?,?,?,?,00DB6A0A,?,?,00000000), ref: 00DBEAE7
GetEnvironmentVariableA.KERNEL32(WLOG_FILEAPPENDER_OUTPUT_FILE_NAME,00000000,00000000,?,?,?,00DB6939,?,?,?,?,00DB6A0A,?,?,00000000), ref: 00DBEB14
GetEnvironmentVariableA.KERNEL32(WLOG_FILEAPPENDER_OUTPUT_FILE_NAME,00000000,?,?,?,?,00DB6939,?,?,?,?,00DB6A0A,?,?,00000000), ref: 00DBEB37

Strings

WLOG_FILEAPPENDER_OUTPUT_FILE_PATH, xrefs: 00DBEA87, 00DBEAE2
WLOG_FILEAPPENDER_OUTPUT_FILE_NAME, xrefs: 00DBEB0F, 00DBEB32

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: EnvironmentVariable
String ID: WLOG_FILEAPPENDER_OUTPUT_FILE_NAME$WLOG_FILEAPPENDER_OUTPUT_FILE_PATH
API String ID: 1431749950-2760771567
Opcode ID: f786b4220e39eae0ed1bd492793fe623fc85827ccd2ffc167ce030539d8f9d69
Instruction ID: 90133b353b5cf1063962a4ace7bdf70f69dd8727c235b759bd6964edd19ed087
Opcode Fuzzy Hash: f786b4220e39eae0ed1bd492793fe623fc85827ccd2ffc167ce030539d8f9d69
Instruction Fuzzy Hash: 5031D1B6A00A16FF87146FA69849DEFBFA8FF407643140018F403A3681DB709C519AF9

Function 007A8EE0 Relevance: 10.6, APIs: 7, Instructions: 87COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(00FE1278,Function_00068C90,007A8EC0,00000000), ref: 007A8F0A
GetLastError.KERNEL32 ref: 007A8F38
TlsGetValue.KERNEL32 ref: 007A8F46
SetLastError.KERNEL32(00000000), ref: 007A8F4F
RtlAcquireSRWLockExclusive.NTDLL(00FE1284), ref: 007A8F61
RtlReleaseSRWLockExclusive.NTDLL(00FE1284), ref: 007A8F73
TlsSetValue.KERNEL32(00000000,?,?,00000000,0078B080), ref: 007A8FB5

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: ErrorExclusiveLastLockOnceValue$AcquireExecuteInitRelease
String ID:
API String ID: 389898287-0
Opcode ID: 5f7dcc49219c69d28eea3b8000ec592fb93b2040093f6ef70ce72008527faa41
Instruction ID: e2a4279d735c18e1b95dfaebc6676b0b4821ef0f2c36977a78e068d3e474efea
Opcode Fuzzy Hash: 5f7dcc49219c69d28eea3b8000ec592fb93b2040093f6ef70ce72008527faa41
Instruction Fuzzy Hash: 3C21F6B570020AAFD7405FA6EC49BAE3BA5FB47701F000120FE15E62D0EB759919DBA2

Function 00DBF61C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000002,00000011), ref: 00DBF673
GetEnvironmentVariableA.KERNEL32(WLOG_UDP_TARGET,00000000,00000000,?,00DB6921,?,?,?,?,00DB6A0A,?,?,00000000,?,00DAE976,00000000), ref: 00DBF68A
GetEnvironmentVariableA.KERNEL32(WLOG_UDP_TARGET,00000000,00000000,?,00DB6921,?,?,?,?,00DB6A0A,?,?,00000000,?,00DAE976,00000000), ref: 00DBF6AB
closesocket.WS2_32(?), ref: 00DBF6E6

Strings

127.0.0.1:20000, xrefs: 00DBF6CB
WLOG_UDP_TARGET, xrefs: 00DBF685, 00DBF6A6

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: EnvironmentVariable$closesocketsocket
String ID: 127.0.0.1:20000$WLOG_UDP_TARGET
API String ID: 65193492-3368084233
Opcode ID: 39a73ad04d4e58b3067d844af0e14279af8c0cb32794676c61b92ce4e9d99c25
Instruction ID: ce4c73165f8e39fe9115eda3647c98a578ad6a325e3d0917779317582e933391
Opcode Fuzzy Hash: 39a73ad04d4e58b3067d844af0e14279af8c0cb32794676c61b92ce4e9d99c25
Instruction Fuzzy Hash: 97219F76644B02EFD3305F669C09B977BE4EF41714F24042DF543AAAE1DBB1E4418B64

Function 00DC001B Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(winsta.dll,?,00DB78D9,01067120), ref: 00DC0023
GetProcAddress.KERNEL32(00000000,WinStationVirtualOpen), ref: 00DC003C
GetProcAddress.KERNEL32(WinStationVirtualOpenEx), ref: 00DC0052

Strings

WinStationVirtualOpen, xrefs: 00DC0036
WinStationVirtualOpenEx, xrefs: 00DC0042
winsta.dll, xrefs: 00DC001E

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: WinStationVirtualOpen$WinStationVirtualOpenEx$winsta.dll
API String ID: 2238633743-2382846951
Opcode ID: bca72f749f963809c03aaa0275ada407960eddc3121bd1f100a8fb5f62a59976
Instruction ID: a8fd1ac4370bff82f7a7cb31ba5c699696b6b56c3ffe79f8a697d2f120e9f33e
Opcode Fuzzy Hash: bca72f749f963809c03aaa0275ada407960eddc3121bd1f100a8fb5f62a59976
Instruction Fuzzy Hash: 770125B0A41742CFD7009FB1A80DF623EE4BB05794F0A40BDE489EB362DBB58044AF64

Function 00D4CB11 Relevance: 10.5, APIs: 7, Instructions: 26COMMON

Download Yara Rule

APIs

glyph_cache_free.GETSCREEN-156413884-X86(?), ref: 00D4CB1E
brush_cache_free.GETSCREEN-156413884-X86(?,?), ref: 00D4CB26
pointer_cache_free.GETSCREEN-156413884-X86(?,?,?), ref: 00D4CB2E
bitmap_cache_free.GETSCREEN-156413884-X86(?,?,?,?), ref: 00D4CB36
offscreen_cache_free.GETSCREEN-156413884-X86(?,?,?,?,?), ref: 00D4CB3E
palette_cache_free.GETSCREEN-156413884-X86(?,?,?,?,?,?), ref: 00D4CB46
nine_grid_cache_free.GETSCREEN-156413884-X86(?,?,?,?,?,?,?), ref: 00D4CB4E

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: bitmap_cache_freebrush_cache_freeglyph_cache_freenine_grid_cache_freeoffscreen_cache_freepalette_cache_freepointer_cache_free
String ID:
API String ID: 637575458-0
Opcode ID: 2a12e379a9b476aac062f53d4a627af9393f4fd168afc1b96a522a904cabb56b
Instruction ID: 7d2ad1be38f40f5d9100628832ae03b041193a76f72864a167362ba3ee387bbb
Opcode Fuzzy Hash: 2a12e379a9b476aac062f53d4a627af9393f4fd168afc1b96a522a904cabb56b
Instruction Fuzzy Hash: 71E01231411A14ABCA323F61DC03C5ABBAAEF117617445929F49625473CB22AC60AEB5

Function 00D8DFDE Relevance: 9.2, APIs: 6, Instructions: 160COMMON

Download Yara Rule

APIs

gdi_CRgnToRect.GETSCREEN-156413884-X86(00000000,00000000,00000000,00000000,?,?,?,?,?,?), ref: 00D8E040
gdi_RgnToRect.GETSCREEN-156413884-X86(?,?,?,?,?), ref: 00D8E04F
gdi_CRgnToRect.GETSCREEN-156413884-X86(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00D8E062
gdi_RgnToRect.GETSCREEN-156413884-X86(?,?,?,?,?), ref: 00D8E0A3
gdi_CRgnToRect.GETSCREEN-156413884-X86(?,?,?,?,?,?,?,?,?,?), ref: 00D8E0C8
gdi_RectToCRgn.GETSCREEN-156413884-X86(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00D8E147

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Rectgdi_
String ID:
API String ID: 2404991910-0
Opcode ID: 3d67676e60336d8243c1b5285746560daf0f8b90a72871facbe574aa155c2f1d
Instruction ID: 59c4b9f716e6fafceaa9a279b9c9673c2ddaf35ae519084c4ba5e651d87cacde
Opcode Fuzzy Hash: 3d67676e60336d8243c1b5285746560daf0f8b90a72871facbe574aa155c2f1d
Instruction Fuzzy Hash: 0C51C072E01219EFCF14EF99C8858EEBBB9FF48710B14842AE515A7250D771AA41CFB0

Function 00D61D8F Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

freerdp_settings_set_uint32.GETSCREEN-156413884-X86(?,000007C0,?), ref: 00D61DA2
freerdp_settings_set_bool.GETSCREEN-156413884-X86(?,000007C8,00000001), ref: 00D61DCC
freerdp_settings_set_bool.GETSCREEN-156413884-X86(?,000007C8,00000000), ref: 00D61DE8
freerdp_settings_set_bool.GETSCREEN-156413884-X86(?,000007C9,00000000), ref: 00D61DFC
freerdp_settings_set_bool.GETSCREEN-156413884-X86(?,000007C8,00000000), ref: 00D61E19
freerdp_settings_set_bool.GETSCREEN-156413884-X86(?,000007C9,00000000), ref: 00D61E2D

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: freerdp_settings_set_bool$freerdp_settings_set_uint32
String ID:
API String ID: 4272850885-0
Opcode ID: fad6795779e0600882673a89c48fb156f3d83e8e8ab2019e83a44d2ff3258703
Instruction ID: feb49c3982a8684006756a8fdfe54064ca500717821cece9542d44e8f719cad9
Opcode Fuzzy Hash: fad6795779e0600882673a89c48fb156f3d83e8e8ab2019e83a44d2ff3258703
Instruction Fuzzy Hash: 7A11D66EF8920277F96020654C82F6F129C8F62B59F5C0025FE08E51C3EA96EE0088F6

Function 00D88AF6 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 154COMMON

Download Yara Rule

APIs

freerdp_image_copy.GETSCREEN-156413884-X86(?,?,?,?,?,?,?,?,08008000,00000000,00000000,00000000,?,00000001,?,?), ref: 00D88C2B

Strings

C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\color.c, xrefs: 00D88DBF
freerdp_image_copy_from_icon_data, xrefs: 00D88DBA
1bpp and 4bpp icons are not supported, xrefs: 00D88DB5
com.freerdp.color, xrefs: 00D88D98

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: freerdp_image_copy
String ID: 1bpp and 4bpp icons are not supported$C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\color.c$com.freerdp.color$freerdp_image_copy_from_icon_data
API String ID: 1523062921-332027372
Opcode ID: 180bafbf75882e55464d0ec9705d59608dc54d08cf93fc5971317ff467151dff
Instruction ID: 34ea53ca85ac2f1719ac225b7316df33585b6dcfc5fcce39badb4d22dfae884b
Opcode Fuzzy Hash: 180bafbf75882e55464d0ec9705d59608dc54d08cf93fc5971317ff467151dff
Instruction Fuzzy Hash: 0851B5B1A0021DAEDF24AF15CD41BFA77A8EF14300F4881A9FE14A2191D7719E81DF74

Function 00DA8423 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 92COMMON

Download Yara Rule

Strings

kbd-lang-list, xrefs: 00DA84D3
kbd-list, xrefs: 00DA84F5
monitor-list, xrefs: 00DA85E3

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID:
String ID: kbd-lang-list$kbd-list$monitor-list
API String ID: 0-1393584692
Opcode ID: fe51db516223de5ca331d88248ae5dc69143970dd8df4d27b1a39c4cb4a0fa66
Instruction ID: 6e075998fd72a7b786a2918271cbd35609f93a4e6f0503c882ee7d8e1406be28
Opcode Fuzzy Hash: fe51db516223de5ca331d88248ae5dc69143970dd8df4d27b1a39c4cb4a0fa66
Instruction Fuzzy Hash: 9431A732901218ABDB20EB68DD46DDBB7ECEB05310F0841A5FD18A71D2DA70DE40EAF1

Function 00D79962 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 82COMMON

Download Yara Rule

Strings

C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\interleaved.c, xrefs: 00D79AFA
com.freerdp.codec, xrefs: 00D79AD0
interleaved_compress: width (%u) or height (%u) is greater than 64, xrefs: 00D79AF0
interleaved_compress, xrefs: 00D79AF5

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID:
String ID: C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\interleaved.c$com.freerdp.codec$interleaved_compress$interleaved_compress: width (%u) or height (%u) is greater than 64
API String ID: 0-4054760794
Opcode ID: d85437afc43ce44ab5132420aab3533f95c215e4be3900ba6292be4bf386adf8
Instruction ID: b9cf6b2ac3b1e1ba26c8d4c733676cf33304a4dcd19a13ac3aa60de0457c31dc
Opcode Fuzzy Hash: d85437afc43ce44ab5132420aab3533f95c215e4be3900ba6292be4bf386adf8
Instruction Fuzzy Hash: E521C273341209BFEF255E56DC96FAB7B68EB05754F088119FA08661A0F672EC50CB70

Function 00DAE492 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 80COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB3CC8

Strings

sspi_InitializeSecurityContextW, xrefs: 00DB3D28, 00DB3D60, 00DB3D65, 00DB3D6B
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB3D2D, 00DB3D6C
InitializeSecurityContextW: %s (0x%08X), xrefs: 00DB3D23
[%s]: Security module does not provide an implementation, xrefs: 00DB3D66

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$InitializeSecurityContextW: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_InitializeSecurityContextW
API String ID: 689400697-743139187
Opcode ID: b3b805675f9222908816f167d5fb7b1162adb8a8f0cdaea20a55787a871de2c8
Instruction ID: c61b74a6778c36063c0bb2a1ffa8d1edb47d65641b055684fbe2395195ff3fc3
Opcode Fuzzy Hash: b3b805675f9222908816f167d5fb7b1162adb8a8f0cdaea20a55787a871de2c8
Instruction Fuzzy Hash: C221A536280244FBEF225E96DC02EEB3F69EB55B54F040154FA04660E1DA62DA60FBB1

Function 00DAE489 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 80COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB3DA3

Strings

InitializeSecurityContextA: %s (0x%08X), xrefs: 00DB3DFE
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB3E08, 00DB3E47
sspi_InitializeSecurityContextA, xrefs: 00DB3E03, 00DB3E3B, 00DB3E40, 00DB3E46
[%s]: Security module does not provide an implementation, xrefs: 00DB3E41

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$InitializeSecurityContextA: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_InitializeSecurityContextA
API String ID: 689400697-1744466472
Opcode ID: 2eea3a3e51f6079cc079a12b7f81ffe647e431201094f2e9324180b18d59b907
Instruction ID: 0db3efcb9d8d3e86031f11ffc3e329e15d9f953f7646301bfee65671ced8692d
Opcode Fuzzy Hash: 2eea3a3e51f6079cc079a12b7f81ffe647e431201094f2e9324180b18d59b907
Instruction Fuzzy Hash: C421C336240204FBEF225E96EC02EEB3F69EB45B54F040154FA44650E1D672DA21FB70

Function 00DAE413 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 77COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB3227

Strings

C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB3283, 00DB32C2
sspi_AcquireCredentialsHandleW, xrefs: 00DB327E, 00DB32B6, 00DB32BB, 00DB32C1
AcquireCredentialsHandleW: %s (0x%08X), xrefs: 00DB3279
[%s]: Security module does not provide an implementation, xrefs: 00DB32BC

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: AcquireCredentialsHandleW: %s (0x%08X)$C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$[%s]: Security module does not provide an implementation$sspi_AcquireCredentialsHandleW
API String ID: 689400697-2657764935
Opcode ID: 3608575d8dcd4481cd5f3055395dec5de9a26248fa144b46edfc1a51ccdbaf8e
Instruction ID: fdcda2abf87abb33374589a7c2a86917b64a7dd425e847e6d722d69d0728af92
Opcode Fuzzy Hash: 3608575d8dcd4481cd5f3055395dec5de9a26248fa144b46edfc1a51ccdbaf8e
Instruction Fuzzy Hash: 3A11E432684305FBEF221E56EC07EAB3B69EB55B14F040094FA01A50E1D572DA20F7B5

Function 00DAE40A Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 77COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB32F9

Strings

AcquireCredentialsHandleA: %s (0x%08X), xrefs: 00DB334B
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB3355, 00DB3394
sspi_AcquireCredentialsHandleA, xrefs: 00DB3350, 00DB3388, 00DB338D, 00DB3393
[%s]: Security module does not provide an implementation, xrefs: 00DB338E

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: AcquireCredentialsHandleA: %s (0x%08X)$C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$[%s]: Security module does not provide an implementation$sspi_AcquireCredentialsHandleA
API String ID: 689400697-1172745827
Opcode ID: ee8330f766247ef7580ab77b56b9b2ac2045816d24b17fa03d64e72467238a28
Instruction ID: 10bf43b068e49bd497b97c3fcc99fe516e99f4f27280dc1cfd64e8af1dd408c8
Opcode Fuzzy Hash: ee8330f766247ef7580ab77b56b9b2ac2045816d24b17fa03d64e72467238a28
Instruction Fuzzy Hash: 3611A536344205FBEF222E569C06EAB3FA9EB45B54F040054FA04651E1DA62D920F7B1

Function 00DAE401 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 77COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB384E

Strings

AcceptSecurityContext: %s (0x%08X), xrefs: 00DB38A0
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB38AA, 00DB38E9
sspi_AcceptSecurityContext, xrefs: 00DB38A5, 00DB38DD, 00DB38E2, 00DB38E8
[%s]: Security module does not provide an implementation, xrefs: 00DB38E3

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: AcceptSecurityContext: %s (0x%08X)$C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$[%s]: Security module does not provide an implementation$sspi_AcceptSecurityContext
API String ID: 689400697-2008077614
Opcode ID: ccefbb1fe2f2e385423ef8aa5d2334f9ed660c910b16205ec69a1fc16b740488
Instruction ID: 99fe409885ad976f5129006e109f3b164fdba013604cc5fdb1efff9062ed6bc5
Opcode Fuzzy Hash: ccefbb1fe2f2e385423ef8aa5d2334f9ed660c910b16205ec69a1fc16b740488
Instruction Fuzzy Hash: 6311D636240204FBEF225E56EC07EAB3F69EB55B54F040055FA00A51E1D966CA21FBB1

Function 00DAE4FE Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB4544

Strings

sspi_VerifySignature, xrefs: 00DB458C, 00DB45C4, 00DB45C9, 00DB45CF
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB4591, 00DB45D0
VerifySignature: %s (0x%08X), xrefs: 00DB4587
[%s]: Security module does not provide an implementation, xrefs: 00DB45CA

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$VerifySignature: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_VerifySignature
API String ID: 689400697-1495805676
Opcode ID: 307cbb9edf8a4ebff92783441eab19cdcaf0d103a63b8c2a8886c8410c94a2fc
Instruction ID: 98b3351dc559f1c5d86aee85d2f7a1c82c6d7f02ad04834b08163a97289a2162
Opcode Fuzzy Hash: 307cbb9edf8a4ebff92783441eab19cdcaf0d103a63b8c2a8886c8410c94a2fc
Instruction Fuzzy Hash: CC11E775384704BBEA31AA56EC07FA73BACDB51B50F040054FA01A61E2D9A2CD10E775

Function 00DAE4F5 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB40BB

Strings

C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB4108, 00DB4147
SetContextAttributesW: %s (0x%08X), xrefs: 00DB40FE
sspi_SetContextAttributesW, xrefs: 00DB4103, 00DB413B, 00DB4140, 00DB4146
[%s]: Security module does not provide an implementation, xrefs: 00DB4141

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$SetContextAttributesW: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_SetContextAttributesW
API String ID: 689400697-247170817
Opcode ID: 8fbfbfd4e0a825d081d4a12aba37a5dfaa4f6f380db60e38efc816a182c25d0a
Instruction ID: cb79550c6f617bfaa4b7ce11790babc97080b350c82d278fcca72b1439d18cd1
Opcode Fuzzy Hash: 8fbfbfd4e0a825d081d4a12aba37a5dfaa4f6f380db60e38efc816a182c25d0a
Instruction Fuzzy Hash: 98110A36784305FBEA22AA5AEC03EAB3F6CEB91B60F044054F941A60D2D966CD50E771

Function 00DAE4EC Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB417E

Strings

SetContextAttributesA: %s (0x%08X), xrefs: 00DB41C1
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB41CB, 00DB420A
sspi_SetContextAttributesA, xrefs: 00DB41C6, 00DB41FE, 00DB4203, 00DB4209
[%s]: Security module does not provide an implementation, xrefs: 00DB4204

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$SetContextAttributesA: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_SetContextAttributesA
API String ID: 689400697-1164902870
Opcode ID: bea88b7b22939bf934497e077808359eb8e6a2e0534cb70cd60e5d03e430364e
Instruction ID: a8904db56472dead351d7abe508bd6a5f4a1bfb2fc1115e403d61f3f2f8bcc4f
Opcode Fuzzy Hash: bea88b7b22939bf934497e077808359eb8e6a2e0534cb70cd60e5d03e430364e
Instruction Fuzzy Hash: 32110D39784305FBEA31AA56EC03E673F6CDB51B60F040054F901A50D3D962CA50E771

Function 00DAE49B Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB4481

Strings

C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB44CE, 00DB450D
sspi_MakeSignature, xrefs: 00DB44C9, 00DB4501, 00DB4506, 00DB450C
MakeSignature: %s (0x%08X), xrefs: 00DB44C4
[%s]: Security module does not provide an implementation, xrefs: 00DB4507

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$MakeSignature: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_MakeSignature
API String ID: 689400697-3834539683
Opcode ID: 8fff4197dd1dac2a00c8d5ad8cbb4b930f8cb7b9d9af8445e52f2d71828b2080
Instruction ID: 9c96ad772089bde2f9169dc48410110a3975094eacd190773c5293c4526f8a76
Opcode Fuzzy Hash: 8fff4197dd1dac2a00c8d5ad8cbb4b930f8cb7b9d9af8445e52f2d71828b2080
Instruction Fuzzy Hash: F111E775380304FBEA316A56AC03FAB3B6CDB81B60F044054FA01A65E3D9A2CD20E771

Function 00DAE452 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB33CB

Strings

sspi_ExportSecurityContext, xrefs: 00DB3413, 00DB344B, 00DB3450, 00DB3456
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB3418, 00DB3457
ExportSecurityContext: %s (0x%08X), xrefs: 00DB340E
[%s]: Security module does not provide an implementation, xrefs: 00DB3451

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$ExportSecurityContext: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_ExportSecurityContext
API String ID: 689400697-3640258815
Opcode ID: 080f00bc6b52f8b4c90e95ccc08b55ec7e2501dc662a57880aaafce68d5d65f2
Instruction ID: 4f57cd32bab2273443919f188ac44c2e473d00e22c2901cb0347818e3de2850a
Opcode Fuzzy Hash: 080f00bc6b52f8b4c90e95ccc08b55ec7e2501dc662a57880aaafce68d5d65f2
Instruction Fuzzy Hash: 4111E735384304FAEB221A56EC07FA73B6CEB91B54F040064FA41A70E1D962DA10F771

Function 00DAE476 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB3548

Strings

ImportSecurityContextW: %s (0x%08X), xrefs: 00DB358B
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB3595, 00DB35D4
sspi_ImportSecurityContextW, xrefs: 00DB3590, 00DB35C8, 00DB35CD, 00DB35D3
[%s]: Security module does not provide an implementation, xrefs: 00DB35CE

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$ImportSecurityContextW: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_ImportSecurityContextW
API String ID: 689400697-3257054040
Opcode ID: deb4a1c2086ca34d2869eebd00ccf5e504d8730b312efbf1b265f6d338d2c72d
Instruction ID: 64977588999548d6247546f1d7fe72f77c10104e888ea0dbd4ce5c53f87dddd8
Opcode Fuzzy Hash: deb4a1c2086ca34d2869eebd00ccf5e504d8730b312efbf1b265f6d338d2c72d
Instruction Fuzzy Hash: 77119435384305BAEA315E56EC07FA73BADEB51B54F040054FA01A61D1E9A2DA10F775

Function 00DAE46D Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB360B

Strings

C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB3658, 00DB3697
sspi_ImportSecurityContextA, xrefs: 00DB3653, 00DB368B, 00DB3690, 00DB3696
ImportSecurityContextA: %s (0x%08X), xrefs: 00DB364E
[%s]: Security module does not provide an implementation, xrefs: 00DB3691

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$ImportSecurityContextA: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_ImportSecurityContextA
API String ID: 689400697-848437295
Opcode ID: 633087edfde2f68bb47261b14267e125a5daf245b454dbb2927d5e57ae45b585
Instruction ID: d7a1cdd970deefc0b9ba524ce1c3a78a833dc5445281ec20ed0ccf819f42b62e
Opcode Fuzzy Hash: 633087edfde2f68bb47261b14267e125a5daf245b454dbb2927d5e57ae45b585
Instruction Fuzzy Hash: 73110A35380304FAEB325A56EC07FAB3B6CDB51B64F040054F941A61E1D9A2DA11F7B5

Function 00D81A7D Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 71COMMON

Download Yara Rule

APIs

ncrush_context_reset.GETSCREEN-156413884-X86(00000000,00000000), ref: 00D81B36

Strings

C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\ncrush.c, xrefs: 00D81B19
com.freerdp.codec, xrefs: 00D81AF1
ncrush_context_new: failed to initialize tables, xrefs: 00D81B0F
ncrush_context_new, xrefs: 00D81B14

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: ncrush_context_reset
String ID: C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\ncrush.c$com.freerdp.codec$ncrush_context_new$ncrush_context_new: failed to initialize tables
API String ID: 2838332675-904927664
Opcode ID: 5beb58443ae4acf6553ade6ffe48762b4b104013af54215ae2096fca8978c0e7
Instruction ID: 92ea939e86af608edb07a1b05139b89813acb907b2eb101fa3b390d080ead838
Opcode Fuzzy Hash: 5beb58443ae4acf6553ade6ffe48762b4b104013af54215ae2096fca8978c0e7
Instruction Fuzzy Hash: C01108723007067AE314BB15AC42FA7B7DCEB41754F20411DF608A66C1EBB2A951CBB0

Function 00DAE4BF Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 71COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB36CE

Strings

C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB3718, 00DB3757
QueryCredentialsAttributesW: %s (0x%08X), xrefs: 00DB370E
[%s]: Security module does not provide an implementation, xrefs: 00DB3751
sspi_QueryCredentialsAttributesW, xrefs: 00DB3713, 00DB374B, 00DB3750, 00DB3756

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$QueryCredentialsAttributesW: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_QueryCredentialsAttributesW
API String ID: 689400697-3413647607
Opcode ID: e1f6dbac7b1aecb37c71ce92d399cd3bf0e4fa6a14009dd2e1820232b963d726
Instruction ID: 13d2b840c005fe16bd761178484a735cc88847a3272b82e0f65e5ccd2380754b
Opcode Fuzzy Hash: e1f6dbac7b1aecb37c71ce92d399cd3bf0e4fa6a14009dd2e1820232b963d726
Instruction Fuzzy Hash: 9E11E9B5384340FBEB215A56EC07FA73BACEB92B54F040094F941AA1E1DDA2DA11F771

Function 00DAE4B6 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 71COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB378E

Strings

C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB37D8, 00DB3817
sspi_QueryCredentialsAttributesA, xrefs: 00DB37D3, 00DB380B, 00DB3810, 00DB3816
QueryCredentialsAttributesA: %s (0x%08X), xrefs: 00DB37CE
[%s]: Security module does not provide an implementation, xrefs: 00DB3811

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$QueryCredentialsAttributesA: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_QueryCredentialsAttributesA
API String ID: 689400697-3754301720
Opcode ID: f8d11526cb3e0c97667efc20a61aa2108bb6d5ed5f4ab4bd00d595dca7856f30
Instruction ID: c806a74fe92bc68c6fdc9ab5d333bd96d2b614cf75e6c15e968bcfe6459788ff
Opcode Fuzzy Hash: f8d11526cb3e0c97667efc20a61aa2108bb6d5ed5f4ab4bd00d595dca7856f30
Instruction Fuzzy Hash: DA110A75380341FAEA211756EC07EA73B6CEB51B54F0400A4F940A61D1DD62DA11F7B1

Function 00DAE4AD Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 71COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB3E7E

Strings

QueryContextAttributesW: %s (0x%08X), xrefs: 00DB3EBE
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB3EC8, 00DB3F07
sspi_QueryContextAttributesW, xrefs: 00DB3EC3, 00DB3EFB, 00DB3F00, 00DB3F06
[%s]: Security module does not provide an implementation, xrefs: 00DB3F01

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$QueryContextAttributesW: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_QueryContextAttributesW
API String ID: 689400697-2578917824
Opcode ID: 38f2a77e898e7e163c11fdc0bfcc9f65d14a511f9a656ed72ba8f386fba3ff76
Instruction ID: 10bcb6ab69531a0aca6f23e91eebb113bf73fc2f975c91fca904e8748798339a
Opcode Fuzzy Hash: 38f2a77e898e7e163c11fdc0bfcc9f65d14a511f9a656ed72ba8f386fba3ff76
Instruction Fuzzy Hash: BB110636384300FBEA325A56EC03FAB3B6CEB95F64F040155F901A60D1D962DA11F771

Function 00DAE4A4 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 71COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB3F3E

Strings

C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB3F88, 00DB3FC7
sspi_QueryContextAttributesA, xrefs: 00DB3F83, 00DB3FBB, 00DB3FC0, 00DB3FC6
QueryContextAttributesA: %s (0x%08X), xrefs: 00DB3F7E
[%s]: Security module does not provide an implementation, xrefs: 00DB3FC1

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$QueryContextAttributesA: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_QueryContextAttributesA
API String ID: 689400697-3211427146
Opcode ID: b1dc4295e170f856977553b8e1e652cf5c0624be3037165d26d98fe6798714de
Instruction ID: d7056a98cee6e8cbd47c9d80d97d890a5378d7e7efe5ff176d0a28d55d5a0a86
Opcode Fuzzy Hash: b1dc4295e170f856977553b8e1e652cf5c0624be3037165d26d98fe6798714de
Instruction Fuzzy Hash: EB11C135784301FAEA226A56EC03EBB3F6DEB95B60F040094F940A60D1D9B2DA10A771

Function 00DAE4DA Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB30AD

Strings

sspi_QuerySecurityPackageInfoW, xrefs: 00DB30EF, 00DB3127, 00DB312C, 00DB3132
QuerySecurityPackageInfoW: %s (0x%08X), xrefs: 00DB30EA
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB30F4, 00DB3133
[%s]: Security module does not provide an implementation, xrefs: 00DB312D

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$QuerySecurityPackageInfoW: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_QuerySecurityPackageInfoW
API String ID: 689400697-2261828479
Opcode ID: 479954bcacd58462f064905597a1cf0662988a32b5ebacc39d15cd97721b4f16
Instruction ID: 29b1fd94e8362ca86afcf5ca7f755991f49405afd8851eb643728b2e683139ba
Opcode Fuzzy Hash: 479954bcacd58462f064905597a1cf0662988a32b5ebacc39d15cd97721b4f16
Instruction Fuzzy Hash: 3011E535388301BAEA31665AEC07FA73BACDB92F64F040094F905A61D1D9A2DA10F7B1

Function 00DAE4D1 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB316A

Strings

sspi_QuerySecurityPackageInfoA, xrefs: 00DB31AC, 00DB31E4, 00DB31E9, 00DB31EF
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB31B1, 00DB31F0
QuerySecurityPackageInfoA: %s (0x%08X), xrefs: 00DB31A7
[%s]: Security module does not provide an implementation, xrefs: 00DB31EA

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$QuerySecurityPackageInfoA: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_QuerySecurityPackageInfoA
API String ID: 689400697-3351603741
Opcode ID: 3fdb74aa583da4b10fa1f679e6d3788faae2f47ce1203347492f9f2a37764dc1
Instruction ID: d61e4e64d0efc07c5fd5e13082f808007015ab2ba8af43fcf7caf4042f5f9962
Opcode Fuzzy Hash: 3fdb74aa583da4b10fa1f679e6d3788faae2f47ce1203347492f9f2a37764dc1
Instruction Fuzzy Hash: 4711E935784305BAEA31265AEC07FA73F6CDB92B50F0400A4F941A61D2DAA2DA10F7B1

Function 00DAE4C8 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB3FFE

Strings

QuerySecurityContextToken: %s (0x%08X), xrefs: 00DB403B
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB4045, 00DB4084
sspi_QuerySecurityContextToken, xrefs: 00DB4040, 00DB4078, 00DB407D, 00DB4083
[%s]: Security module does not provide an implementation, xrefs: 00DB407E

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$QuerySecurityContextToken: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_QuerySecurityContextToken
API String ID: 689400697-2156878011
Opcode ID: a4ff2916a27b452caa9e82b9a34f3abf3892de5e0ce0fb46b0075721acc985c1
Instruction ID: 5c3d553feabd92e531ca834255a982a26fcb479e8932d6c676dc6d6db17decf7
Opcode Fuzzy Hash: a4ff2916a27b452caa9e82b9a34f3abf3892de5e0ce0fb46b0075721acc985c1
Instruction Fuzzy Hash: 75110C39384305FBE631B656EC07F673B6CDB91B64F040054F645A60D2D9A2D910E7B5

Function 00DAE449 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB2F33

Strings

EnumerateSecurityPackagesW: %s (0x%08X), xrefs: 00DB2F70
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB2F7A, 00DB2FB9
sspi_EnumerateSecurityPackagesW, xrefs: 00DB2F75, 00DB2FAD, 00DB2FB2, 00DB2FB8
[%s]: Security module does not provide an implementation, xrefs: 00DB2FB3

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$EnumerateSecurityPackagesW: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_EnumerateSecurityPackagesW
API String ID: 689400697-255015424
Opcode ID: c7434e5d4cd3d8e42e0a2f4f77ac716c28d993c0389cc0c4fb20377075966082
Instruction ID: 5d03a45bc6d7432c2bb7df8efd4d2650badde5cfccf72cb24ac055a3a49876af
Opcode Fuzzy Hash: c7434e5d4cd3d8e42e0a2f4f77ac716c28d993c0389cc0c4fb20377075966082
Instruction Fuzzy Hash: 4011C636788305BAEA216657EC07FB73F6CDF95B60F040094F905A60E1D962D910E7B1

Function 00DAE440 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB2FF0

Strings

EnumerateSecurityPackagesA: %s (0x%08X), xrefs: 00DB302D
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB3037, 00DB3076
sspi_EnumerateSecurityPackagesA, xrefs: 00DB3032, 00DB306A, 00DB306F, 00DB3075
[%s]: Security module does not provide an implementation, xrefs: 00DB3070

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$EnumerateSecurityPackagesA: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_EnumerateSecurityPackagesA
API String ID: 689400697-1149382491
Opcode ID: ef5b085fc55fbc7905c4695608fa6360fce87cddd9d7b3805d02c5c29cec0183
Instruction ID: b5564198682657a00847c51bdac65331266f4ba04c0c0c793ac9b02a34d6acc2
Opcode Fuzzy Hash: ef5b085fc55fbc7905c4695608fa6360fce87cddd9d7b3805d02c5c29cec0183
Instruction Fuzzy Hash: C311C635784340BAE7312A5AEC07EAB3B6CDF92B64F0400D4F904A60D1D9A2DE10F7B1

Function 00DAE41C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB3920

Strings

ApplyControlToken: %s (0x%08X), xrefs: 00DB395D
sspi_ApplyControlToken, xrefs: 00DB3962, 00DB399A, 00DB399F, 00DB39A5
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB3967, 00DB39A6
[%s]: Security module does not provide an implementation, xrefs: 00DB39A0

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: ApplyControlToken: %s (0x%08X)$C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$[%s]: Security module does not provide an implementation$sspi_ApplyControlToken
API String ID: 689400697-2845897268
Opcode ID: 686be234af18e3545d6e883262fb2a6769b4cbb9d40d24f308dc26010e85b475
Instruction ID: 21c72281ed06f16267e44013f8c90a35e8c5a5158f0ded67f7d1824354aa7ff3
Opcode Fuzzy Hash: 686be234af18e3545d6e883262fb2a6769b4cbb9d40d24f308dc26010e85b475
Instruction Fuzzy Hash: AD11E935384300FBEE21265AEC07EA73F6CDB91BA4F040168F540A60D1D9A2CE10FBB5

Function 00DAE425 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB39DD

Strings

sspi_CompleteAuthToken, xrefs: 00DB3A1F, 00DB3A57, 00DB3A5C, 00DB3A62
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB3A24, 00DB3A63
CompleteAuthToken: %s (0x%08X), xrefs: 00DB3A1A
[%s]: Security module does not provide an implementation, xrefs: 00DB3A5D

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$CompleteAuthToken: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_CompleteAuthToken
API String ID: 689400697-1972714555
Opcode ID: 02e07b05f845aaddfe4f1da853e31e7959541ef7989d2cd1f2d1e2a11ca649c4
Instruction ID: 4aa0f167b85b42ca8ff6b14526edbca7b413c4a4e50f33d463af29e609189d2b
Opcode Fuzzy Hash: 02e07b05f845aaddfe4f1da853e31e7959541ef7989d2cd1f2d1e2a11ca649c4
Instruction Fuzzy Hash: 29118635384301FBEA216656EC07E673B6CDB91F54F140164F541A61D1D9A2DA10F6B1

Function 00D8954D Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

freerdp_image_copy.GETSCREEN-156413884-X86(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00D895B5

Strings

C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\color.c, xrefs: 00D895F0
com.freerdp.color, xrefs: 00D895C8
SmartScaling requested but compiled without libcairo support!, xrefs: 00D895E6
freerdp_image_scale, xrefs: 00D895EB

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: freerdp_image_copy
String ID: C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\color.c$SmartScaling requested but compiled without libcairo support!$com.freerdp.color$freerdp_image_scale
API String ID: 1523062921-212429655
Opcode ID: 7670fec4113b2f21ce419415567660a2b9db773eb64ea27869a9fbb05041631b
Instruction ID: 34f3b93c13310a42f0bb55862021cc83e53feddc6b80ddd4d5050efdda4ab531
Opcode Fuzzy Hash: 7670fec4113b2f21ce419415567660a2b9db773eb64ea27869a9fbb05041631b
Instruction Fuzzy Hash: 6021D67224020DBBDF15AF14DC12FBE3BA9EB14700F485105FD04A61A0E372E951DF60

Function 00DAE4E3 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 69COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB4241

Strings

C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB4285, 00DB42C4
sspi_RevertSecurityContext, xrefs: 00DB4280, 00DB42B8, 00DB42BD, 00DB42C3
RevertSecurityContext: %s (0x%08X), xrefs: 00DB427B
[%s]: Security module does not provide an implementation, xrefs: 00DB42BE

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$RevertSecurityContext: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_RevertSecurityContext
API String ID: 689400697-954186549
Opcode ID: bfa845a104817d139d4c298e76ab31afdcbcdfc91bf428712e5623bfed8f384b
Instruction ID: 74c60c9320d5f8ff0b8a1f62143b0aea4e7ceda483665ebc893f2b28e7659466
Opcode Fuzzy Hash: bfa845a104817d139d4c298e76ab31afdcbcdfc91bf428712e5623bfed8f384b
Instruction Fuzzy Hash: 3E11C275384300BAEA216656BC07FA73B5CDB91B64F0400A5F900A60D2D9A2DA10F6B9

Function 00DAE45B Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 69COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB3B54

Strings

C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB3B98, 00DB3BD7
FreeContextBuffer: %s (0x%08X), xrefs: 00DB3B8E
sspi_FreeContextBuffer, xrefs: 00DB3B93, 00DB3BCB, 00DB3BD0, 00DB3BD6
[%s]: Security module does not provide an implementation, xrefs: 00DB3BD1

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$FreeContextBuffer: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_FreeContextBuffer
API String ID: 689400697-1791514552
Opcode ID: 5c63f8e7fcc6626b28fe669cc521de06139d53c88114aee292fa02794c0f3f99
Instruction ID: 44c1f1793e30786f5d6c551bd1b94906e2b077dec11e737fb184aaaadc32a0fb
Opcode Fuzzy Hash: 5c63f8e7fcc6626b28fe669cc521de06139d53c88114aee292fa02794c0f3f99
Instruction Fuzzy Hash: 8711A535384301BBEA212656EC07EA73B5CDB92B54F0400A4F941AA1D1EDA2DA10B7B9

Function 00DAE464 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 69COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB3C0E

Strings

C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB3C52, 00DB3C91
sspi_ImpersonateSecurityContext, xrefs: 00DB3C4D, 00DB3C85, 00DB3C8A, 00DB3C90
ImpersonateSecurityContext: %s (0x%08X), xrefs: 00DB3C48
[%s]: Security module does not provide an implementation, xrefs: 00DB3C8B

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$ImpersonateSecurityContext: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_ImpersonateSecurityContext
API String ID: 689400697-4242683877
Opcode ID: 871fc2bbcf2c46159d6b0661d6b2b5a7a44a5fe97f004d292dc4e7985ec164f0
Instruction ID: 431a5f2e896169f4d81a2cf06e9a7c7cdcb26d05f3dafb39bb01086e9fd13225
Opcode Fuzzy Hash: 871fc2bbcf2c46159d6b0661d6b2b5a7a44a5fe97f004d292dc4e7985ec164f0
Instruction Fuzzy Hash: D611C835384300FBE6212656EC07FA73F5CDB92F50F0401A4F941A61E2D992DB11F6B5

Function 00DAE510 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 69COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB348E

Strings

FreeCredentialsHandle: %s (0x%08X), xrefs: 00DB34C8
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB34D2, 00DB3511
sspi_FreeCredentialsHandle, xrefs: 00DB34CD, 00DB3505, 00DB350A, 00DB3510
[%s]: Security module does not provide an implementation, xrefs: 00DB350B

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$FreeCredentialsHandle: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_FreeCredentialsHandle
API String ID: 689400697-3116451197
Opcode ID: 1409ef787062f5453defe90b9ba9f8e1a566c10a8ac02463e99c8e07e4509588
Instruction ID: 3b941353c5ec6e0560fe93aa40b6b9c04dfcf444844c52fe4f49971b83152074
Opcode Fuzzy Hash: 1409ef787062f5453defe90b9ba9f8e1a566c10a8ac02463e99c8e07e4509588
Instruction Fuzzy Hash: 01110835384301FAEA322626EC07F673B9CDB92B54F0440A4F545A60D1D992DE50F6B5

Function 00DAE507 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 69COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB3A9A

Strings

sspi_DeleteSecurityContext, xrefs: 00DB3AD9, 00DB3B11, 00DB3B16, 00DB3B1C
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB3ADE, 00DB3B1D
DeleteSecurityContext: %s (0x%08X), xrefs: 00DB3AD4
[%s]: Security module does not provide an implementation, xrefs: 00DB3B17

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$DeleteSecurityContext: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_DeleteSecurityContext
API String ID: 689400697-4185332897
Opcode ID: 42d94eeae4b5b9a598ea7349f333e4a0021de697c8b6a4960d89686d9679c88a
Instruction ID: 1efd685cf09d506ea53561d1de4bdd83493ca27a540bc868c24e2d4f69ed7731
Opcode Fuzzy Hash: 42d94eeae4b5b9a598ea7349f333e4a0021de697c8b6a4960d89686d9679c88a
Instruction Fuzzy Hash: 0511E535784300FAE632665AEC07FA73B5CDB92B54F040168F944E60E1D992DA11B6B5

Function 00E365C5 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 52COMMON

Download Yara Rule

APIs

primitives_get.GETSCREEN-156413884-X86 ref: 00E365CB

Strings

com.freerdp.codec, xrefs: 00E3660B
yuv_process_work_callback, xrefs: 00E3662E
C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\yuv.c, xrefs: 00E36633
error when decoding lines, xrefs: 00E36629

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: primitives_get
String ID: C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\yuv.c$com.freerdp.codec$error when decoding lines$yuv_process_work_callback
API String ID: 2017034601-2620645302
Opcode ID: 5f235f30597290e64c0b663bf6157f4d58c2ee7ca260f72bdd303ace9b5944de
Instruction ID: 0658d8e2b553374ff7192685a6f3cd1725393b054ec1ee39a915d34824c9b826
Opcode Fuzzy Hash: 5f235f30597290e64c0b663bf6157f4d58c2ee7ca260f72bdd303ace9b5944de
Instruction Fuzzy Hash: CB0196B1600306BFDB14DF64DC02F5A7BA8FF06718F004159F904EA281EAB5E940CBB5

Function 00D89EF7 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

region16_extents.GETSCREEN-156413884-X86(?), ref: 00D89F06
region16_extents.GETSCREEN-156413884-X86(?,?), ref: 00D89F12
region16_n_rects.GETSCREEN-156413884-X86(?,?,?), ref: 00D89F1D
region16_n_rects.GETSCREEN-156413884-X86(?), ref: 00D89F7D

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: region16_extentsregion16_n_rects
String ID:
API String ID: 2062899502-0
Opcode ID: a777aa3e440b79e1151d2e5a78892d79e860e14bb9abc1479bfd8844a7d2d6d9
Instruction ID: 0117f150602412b3be55513778fe053282ae775071e97130aba6e26abd5f369b
Opcode Fuzzy Hash: a777aa3e440b79e1151d2e5a78892d79e860e14bb9abc1479bfd8844a7d2d6d9
Instruction Fuzzy Hash: 87512875A0022AABCB14DF99C8408BEF7F5FF18310B15816AE859E7250E335AE40CBB4

Function 007A8E40 Relevance: 7.6, APIs: 5, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(00FE1278,007A8C90,007A8EC0,00000000), ref: 007A8E6A
GetLastError.KERNEL32 ref: 007A8E7F
TlsGetValue.KERNEL32 ref: 007A8E8D
SetLastError.KERNEL32(00000000), ref: 007A8E96
TlsAlloc.KERNEL32 ref: 007A8EC3

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: ErrorLastOnce$AllocExecuteInitValue
String ID:
API String ID: 2822033501-0
Opcode ID: 10e15f695bce760c7e9cfb5ce4c038cc2aba84e6765c7987a933adc9bad3728d
Instruction ID: df1ea4469e373195183c178e20251ef794ba4659a3b25d75efd74e0968f767a5
Opcode Fuzzy Hash: 10e15f695bce760c7e9cfb5ce4c038cc2aba84e6765c7987a933adc9bad3728d
Instruction Fuzzy Hash: 6301C87960020C9FCB009FB6EC49B6E77B8FB46B11B404225F915E7290EB3099088B61

Function 00E349E4 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 80COMMON

Download Yara Rule

APIs

audio_format_print.GETSCREEN-156413884-X86(?,?,?), ref: 00E34A72

Strings

AUDIO_FORMATS (%hu) ={, xrefs: 00E34A12
audio_formats_print, xrefs: 00E34A17, 00E34A54, 00E34A95
C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\audio.c, xrefs: 00E34A1C, 00E34A59, 00E34A9A

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: audio_format_print
String ID: AUDIO_FORMATS (%hu) ={$C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\audio.c$audio_formats_print
API String ID: 2744001552-3527835062
Opcode ID: 190b4eed6e8eb1bfef3c354a6c4be8922e1d4cc71d4c945d923ffda63c261f84
Instruction ID: b78a942341c6e3ef25444726e57ef43ec42734cb83659480e3f1fbda42139c21
Opcode Fuzzy Hash: 190b4eed6e8eb1bfef3c354a6c4be8922e1d4cc71d4c945d923ffda63c261f84
Instruction Fuzzy Hash: 9511B4B228031536DB11AE155C46FAF2F9CDF63B64F040015FD14B21C2F6A1E601D2BB

Function 00D311D7 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

getChannelError.GETSCREEN-156413884-X86(?), ref: 00D31248

Strings

freerdp, xrefs: 00D31278
(, xrefs: 00D31295
ChannelDetached, xrefs: 00D3127F

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: ChannelError
String ID: ($ChannelDetached$freerdp
API String ID: 1163697128-436519898
Opcode ID: d41152332e34c1132b17fc4ebc57e4b237890b6d19fcfe298640a9fb059c40de
Instruction ID: fc80bfe549b8597e74f5623f85120fd146f05f3c631305c3a6c06a9ddc4a1d40
Opcode Fuzzy Hash: d41152332e34c1132b17fc4ebc57e4b237890b6d19fcfe298640a9fb059c40de
Instruction Fuzzy Hash: 7C212C75A00209EFDB10DF98C885FAEBBF9FF08344F144469E944EB251D770AA549BA0

Function 00D30B41 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

getChannelError.GETSCREEN-156413884-X86(?), ref: 00D30BB2

Strings

freerdp, xrefs: 00D30BE2
(, xrefs: 00D30BFF
ChannelAttached, xrefs: 00D30BE9

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: ChannelError
String ID: ($ChannelAttached$freerdp
API String ID: 1163697128-2646891115
Opcode ID: 068b98a21e688adcc1a7a8ef4bb56f7f67ea8c15b542e4d7e67dc6f7d4de20b9
Instruction ID: f91ad36d8a6de8015f64d295c82b2d5ed3997809a739205efbd6b358ca96a36e
Opcode Fuzzy Hash: 068b98a21e688adcc1a7a8ef4bb56f7f67ea8c15b542e4d7e67dc6f7d4de20b9
Instruction Fuzzy Hash: 82210C71A00209EFDF14DF98C885FAEBBF9FF08344F1445A9E944A7252D771AA509BA0

Function 00DA783A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 56COMMON

Download Yara Rule

Strings

audin, xrefs: 00DA78F8
rdpsnd, xrefs: 00DA78CA

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID:
String ID: audin$rdpsnd
API String ID: 0-930729200
Opcode ID: 6f8f7c70f85235a5e8cfa22d1d5172d6193b23b90d8a430442da5d604fd0f399
Instruction ID: f8d5fcc491c9a5b0804bee04886522f5f4ebedceeef8fc4138f87d240f1a78ee
Opcode Fuzzy Hash: 6f8f7c70f85235a5e8cfa22d1d5172d6193b23b90d8a430442da5d604fd0f399
Instruction Fuzzy Hash: 8D116071A09E16ABDB24CF34CC806AAF3A4FB06B41F19422AE45853140D730A990CBF2

Function 00E34701 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

audio_format_get_tag_string.GETSCREEN-156413884-X86(?,?,?,?,?,?,?,?), ref: 00E34737

Strings

%s: wFormatTag: 0x%04hX nChannels: %hu nSamplesPerSec: %u nAvgBytesPerSec: %u nBlockAlign: %hu wBitsPerSample: %hu cbSize: %hu, xrefs: 00E3473E
C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\audio.c, xrefs: 00E34748
audio_format_print, xrefs: 00E34743

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: audio_format_get_tag_string
String ID: %s: wFormatTag: 0x%04hX nChannels: %hu nSamplesPerSec: %u nAvgBytesPerSec: %u nBlockAlign: %hu wBitsPerSample: %hu cbSize: %hu$C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\audio.c$audio_format_print
API String ID: 2866491501-3564663344
Opcode ID: c52e0dd6431addf09f15b8af9c1846588221c8247c802d37eaa2d35c0adcb67b
Instruction ID: c2d6e60e98c7b835152735da8c56021c325244e8a3b4f5dbb22e345a41e2b73d
Opcode Fuzzy Hash: c52e0dd6431addf09f15b8af9c1846588221c8247c802d37eaa2d35c0adcb67b
Instruction Fuzzy Hash: 00F030B6140308BADB411F51CC02E763B6DEB49B14F248089FD5C9C1D2E677D9A2E775

Function 00D22713 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

freerdp_get_last_error.GETSCREEN-156413884-X86(?), ref: 00D22725
freerdp_set_last_error_ex.GETSCREEN-156413884-X86(?,0002000B,freerdp_abort_connect,C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\freerdp.c,0000013A), ref: 00D22745

Strings

C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\freerdp.c, xrefs: 00D22734
freerdp_abort_connect, xrefs: 00D22739

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: freerdp_get_last_errorfreerdp_set_last_error_ex
String ID: C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\freerdp.c$freerdp_abort_connect
API String ID: 3690923134-629580617
Opcode ID: 8b84df513927c2faf32e9f7b4c90c45f57ed35bad4788dd2aa2a229fc031dfbd
Instruction ID: 77cffd4ec60be4181f7003ad927b34deaf9b401c806ea308a7082c46035d468c
Opcode Fuzzy Hash: 8b84df513927c2faf32e9f7b4c90c45f57ed35bad4788dd2aa2a229fc031dfbd
Instruction Fuzzy Hash: 89E0D831244334FADA312D10FC02B65F794DF20B98F180425B9C476091E6625A52D5B0

Function 00E3632D Relevance: 6.2, APIs: 4, Instructions: 174COMMON

Download Yara Rule

APIs

primitives_get.GETSCREEN-156413884-X86 ref: 00E3633F
primitives_flags.GETSCREEN-156413884-X86(00000000), ref: 00E36353
TpWaitForWork.NTDLL(00000000,00000000), ref: 00E364A9
TpReleaseWork.NTDLL(00000000), ref: 00E364B2

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Work$ReleaseWaitprimitives_flagsprimitives_get
String ID:
API String ID: 704174238-0
Opcode ID: b920dafea80bb627aefb0e9e8478b1e68d6ca8f887ac2a9f61730828152ae3fc
Instruction ID: 2b7fc61857ff02761cc6b341b4245fba17855e57bcc136ed75aeafbd03bf2853
Opcode Fuzzy Hash: b920dafea80bb627aefb0e9e8478b1e68d6ca8f887ac2a9f61730828152ae3fc
Instruction Fuzzy Hash: 706129B5A0060AEFCB04CF68C985AAEBBF5FF48310B14856AE815E7350D734E951CF90

Function 00D8C297 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

gdi_SetRgn.GETSCREEN-156413884-X86(?,?,?,?,00000000,00000001,?,?), ref: 00D8C324

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: gdi_
String ID:
API String ID: 2273374161-0
Opcode ID: 2ead09a44aba127efa6001147bae376ec00e50ab3ae76740fbfd5d3136eef1b6
Instruction ID: 865086a72daf1fc43b38fa515c4be89aa5b458284a2074a5c771625b1c1c0e67
Opcode Fuzzy Hash: 2ead09a44aba127efa6001147bae376ec00e50ab3ae76740fbfd5d3136eef1b6
Instruction Fuzzy Hash: F131B5B1910209EFCB10EF99C9859AEBBF9FF48310F14806AE915E7211D335EA45CBB0

Function 00DB5C02 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 00DB5C16
RtlLeaveCriticalSection.NTDLL(?), ref: 00DB5C34
RtlLeaveCriticalSection.NTDLL(?), ref: 00DB5C54
RtlLeaveCriticalSection.NTDLL(?), ref: 00DB5C9A

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: 2051ef1a389456390ea4a02a62146902d93c7182408f966d18c8a74e2836429c
Instruction ID: e38ed5523884334c0f83bde73e0370e7a495f8a60b77feac70ee047c77d25a78
Opcode Fuzzy Hash: 2051ef1a389456390ea4a02a62146902d93c7182408f966d18c8a74e2836429c
Instruction Fuzzy Hash: FD21AF75200B05EFDB208F15E980BA97BF5FB45321F144469F883A7294E770AD82CB60

Function 00E0B6E0 Relevance: 6.1, APIs: 4, Instructions: 66threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00E1F42C: GetLastError.KERNEL32(00000000,?,00E05FDD,00E1F0E3,?,?,00DAF77A,0000000C,?,?,?,?,00D227D2,?,?,?), ref: 00E1F581
Part of subcall function 00E1F42C: SetLastError.KERNEL32(00000000,000000FF,00000006), ref: 00E1F623

CloseHandle.KERNEL32(?,?,?,00E0B817,?,?,00E0B689,00000000), ref: 00E0B711
FreeLibraryAndExitThread.KERNEL32(?,?,?,?,00E0B817,?,?,00E0B689,00000000), ref: 00E0B727
RtlExitUserThread.NTDLL(?,?,?,00E0B817,?,?,00E0B689,00000000), ref: 00E0B730
GetModuleHandleExW.KERNEL32(00000004,?,0000000C), ref: 00E0B76E

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: ErrorExitHandleLastThread$CloseFreeLibraryModuleUser
String ID:
API String ID: 1062721995-0
Opcode ID: 5fdca9eb63c1685f58f9aeef6c9b09c5ed7425e20f72609187b24c96ae3ccb29
Instruction ID: ba0cb5e9fc13dfc67c326608319cbcd06c7e4502fe827571840ed75a7e2226d9
Opcode Fuzzy Hash: 5fdca9eb63c1685f58f9aeef6c9b09c5ed7425e20f72609187b24c96ae3ccb29
Instruction Fuzzy Hash: E311E9B5500204AFC7209F66DC09E9A7BE8EFC0764F185226F925E72D0DB70DD85C690

Function 00D89BBD Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

region16_rects.GETSCREEN-156413884-X86(?,00000000), ref: 00D89BDC
region16_extents.GETSCREEN-156413884-X86(?), ref: 00D89BEC
rectangles_intersects.GETSCREEN-156413884-X86(00000000,?), ref: 00D89BF7

Part of subcall function 00D897FD: rectangles_intersection.GETSCREEN-156413884-X86(?,?,?), ref: 00D8980C

rectangles_intersects.GETSCREEN-156413884-X86(00000000,?), ref: 00D89C1A

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: rectangles_intersects$rectangles_intersectionregion16_extentsregion16_rects
String ID:
API String ID: 3854534691-0
Opcode ID: 3ae0e6e2282d69f6a29daa640538588f82f3507cb970e478017c8bd43d05d967
Instruction ID: 0575a324d9b2fa8be085287289a6ccd6c0cf7cd34b7bd0c6f810b4baa4b384e3
Opcode Fuzzy Hash: 3ae0e6e2282d69f6a29daa640538588f82f3507cb970e478017c8bd43d05d967
Instruction Fuzzy Hash: 02018833114219599B14BA95D8A167BE3DCDB40B65F1C401AFCD996040EB36EC41E3B4

Function 00DA1F3D Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

freerdp_new.GETSCREEN-156413884-X86 ref: 00DA1F56
freerdp_context_new.GETSCREEN-156413884-X86(00000000,00000000,?,?), ref: 00DA1FA4
freerdp_register_addin_provider.GETSCREEN-156413884-X86(?,00000000), ref: 00DA1FC7

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: freerdp_context_newfreerdp_newfreerdp_register_addin_provider
String ID:
API String ID: 3731710698-0
Opcode ID: 74a280b276fa9d87e9d62b2bbf8a32d4bd07aa9f8dacbb2c23376f3b90678468
Instruction ID: e591f37dd9937fec0c38606d067f006661a19f183e342d3829314738e0e16862
Opcode Fuzzy Hash: 74a280b276fa9d87e9d62b2bbf8a32d4bd07aa9f8dacbb2c23376f3b90678468
Instruction Fuzzy Hash: 41119E36604B126FC725AB66D801B96B7E9FF56324F14041DF85887281EB70E890CAB0

Function 00DB68CF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00000FA0,?,?,?,00DB6A0A,?,?,00000000,?,00DAE976,00000000), ref: 00DB697B

Strings

%s: unknown handler type %u, xrefs: 00DB6903
WLog_Appender_New, xrefs: 00DB68FE

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: %s: unknown handler type %u$WLog_Appender_New
API String ID: 2593887523-3466059274
Opcode ID: edd1ce3d46c7b373a171b8ea6b81a68c115e6608419e51f733cad571ce48b65e
Instruction ID: c5110ca0ada2ce926ef0bf8d43e1cd3b6f421ce4bc4164a16208b23e8d0b8fb4
Opcode Fuzzy Hash: edd1ce3d46c7b373a171b8ea6b81a68c115e6608419e51f733cad571ce48b65e
Instruction Fuzzy Hash: DF112536108301E68E323A799C4ADFF6B68DB42F30B180019F547A6192DE3CE8016D72

Function 00D23FD6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

Strings

DeviceServiceEntry, xrefs: 00D2419C
%s%s-client.%s, xrefs: 00D2415A

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID:
String ID: %s%s-client.%s$DeviceServiceEntry
API String ID: 0-2733899524
Opcode ID: 3a0462b2f0e3e23754738fcb9b3071a3023d73991357c137ac18e7a06c72f3a4
Instruction ID: f7a36ce2ae6b223a27ec4c6182b0829b2dbd0397efc93a064b9640213c867174
Opcode Fuzzy Hash: 3a0462b2f0e3e23754738fcb9b3071a3023d73991357c137ac18e7a06c72f3a4
Instruction Fuzzy Hash: 2011C872A003256BDB119F99D981AAF7BACDF50754F0C4019FD10D7241D770CE5187B0

Function 00D64029 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000080,00000000), ref: 00D64060
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00D64076

Strings

%s %hu %s %s %s, xrefs: 00D640FC

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: File$CreatePointer
String ID: %s %hu %s %s %s
API String ID: 2024441833-2916857029
Opcode ID: 33480d54ee1fc694bfc67d7ce4117a60aca3bc79cb853f8b12fd1bf61899e848
Instruction ID: b490dff442f3aeb5440e35ec35a8f1f2b186badf70c9bdda6671abf84705406f
Opcode Fuzzy Hash: 33480d54ee1fc694bfc67d7ce4117a60aca3bc79cb853f8b12fd1bf61899e848
Instruction Fuzzy Hash: A901D635201220BBDB212B66EC4EFA77F2DEF46774F248154FA1D990E2D722C856D6B0

Function 00DAEBD0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(WLOG_FILTER,00000000,00000000,00000000,?,00DAE987), ref: 00DAEBF6
GetEnvironmentVariableA.KERNEL32(WLOG_FILTER,00000000,00000000,?,?,00DAE987), ref: 00DAEC1A

Strings

WLOG_FILTER, xrefs: 00DAEBE5, 00DAEC15

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: EnvironmentVariable
String ID: WLOG_FILTER
API String ID: 1431749950-2006202657
Opcode ID: 722a116722c3e7fcc9e1ed5b7da1f6f22f4268371e69f2cdb388a42c938a2fa4
Instruction ID: 7f01110f6393b80d2f5ee6e9a5a862490ca5927c4fb9701740dd86147845830d
Opcode Fuzzy Hash: 722a116722c3e7fcc9e1ed5b7da1f6f22f4268371e69f2cdb388a42c938a2fa4
Instruction Fuzzy Hash: 39F0963331421A2E96202766BC49D1B7FADDAD67B9350002AF409D7191EB6E4C52C6B5

Function 00DB4BC1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(WINPR_NATIVE_SSPI,00000000,00000000,?,?,00DB4AE3), ref: 00DB4BCC
GetEnvironmentVariableA.KERNEL32(WINPR_NATIVE_SSPI,00000000,00000000,?,?,00DB4AE3), ref: 00DB4BEC

Strings

WINPR_NATIVE_SSPI, xrefs: 00DB4BC7, 00DB4BE7

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: EnvironmentVariable
String ID: WINPR_NATIVE_SSPI
API String ID: 1431749950-1020623567
Opcode ID: 2b516e857c476f855e7bc51fc317a6296e7317a3ae8ac5490c45f6ff7916a1a0
Instruction ID: 8645578d329a741f9e3308693758075d967ba0ddc93bf59bc947d978e4183e4b
Opcode Fuzzy Hash: 2b516e857c476f855e7bc51fc317a6296e7317a3ae8ac5490c45f6ff7916a1a0
Instruction Fuzzy Hash: 22F0823B75A6326AD625626A6C05FBB4E65CB82F21B291119F502E30C3CA44984365F6

Function 00D7A2AA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

rfx_context_new.GETSCREEN-156413884-X86(?), ref: 00D7A2ED

Part of subcall function 00D6E4DD: GetVersionExA.KERNEL32(?), ref: 00D6E5CD
Part of subcall function 00D6E4DD: GetNativeSystemInfo.KERNEL32(?), ref: 00D6E5E7
Part of subcall function 00D6E4DD: RegOpenKeyExA.ADVAPI32(80000002,Software\FreeRDP\FreeRDP\RemoteFX,00000000,00020119,?), ref: 00D6E612

progressive_context_free.GETSCREEN-156413884-X86(00000000), ref: 00D7A36D

Strings

com.freerdp.codec.progressive, xrefs: 00D7A2CA

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: InfoNativeOpenSystemVersionprogressive_context_freerfx_context_new
String ID: com.freerdp.codec.progressive
API String ID: 2699998398-3622116780
Opcode ID: e80f1ca7b0b9a3f536b6ae6a096d8657c092011a7513b15a642b448b699064a0
Instruction ID: 38825a15cd94c9ba1e78fd72761be04ef39e501aa24b79336810cbcbf51792ba
Opcode Fuzzy Hash: e80f1ca7b0b9a3f536b6ae6a096d8657c092011a7513b15a642b448b699064a0
Instruction Fuzzy Hash: 63F08936A057025AE2247BB99802F5F7BD8DF82B70F28402EF54DA65C2FA709441C676

Function 00D61ED8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

freerdp_settings_get_key_for_name.GETSCREEN-156413884-X86(?), ref: 00D61EEF
freerdp_settings_get_type_for_key.GETSCREEN-156413884-X86(00000000), ref: 00D61F51

Strings

TRUE, xrefs: 00D61F65

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: freerdp_settings_get_key_for_namefreerdp_settings_get_type_for_key
String ID: TRUE
API String ID: 1888880752-3412697401
Opcode ID: 9bb1714707bed91c75a052e2304897d19b04baa083934ea9be81d208935aae6f
Instruction ID: b59e18c45f76e8cb7834602dbca05ee10fd7ab38f0e2da75da32075b9a8c48f1
Opcode Fuzzy Hash: 9bb1714707bed91c75a052e2304897d19b04baa083934ea9be81d208935aae6f
Instruction Fuzzy Hash: 56E02B373043287BDA115A9ADC82D9F735CEF46F75B0D006AF504A7242EB70D94045B0

Function 00DB717D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(WTSAPI_LIBRARY,00000000,00000000,?,00DB7163), ref: 00DB7190
GetEnvironmentVariableA.KERNEL32(WTSAPI_LIBRARY,00000000,00000000,?,?,00DB7163), ref: 00DB71B1

Part of subcall function 00DB7310: LoadLibraryA.KERNEL32(?,?,00DB71C4,00000000,?,?,00DB7163), ref: 00DB7316
Part of subcall function 00DB7310: GetProcAddress.KERNEL32(00000000,InitWtsApi), ref: 00DB732B

Strings

WTSAPI_LIBRARY, xrefs: 00DB718B, 00DB71AC

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: EnvironmentVariable$AddressLibraryLoadProc
String ID: WTSAPI_LIBRARY
API String ID: 3590464466-1122459656
Opcode ID: e12addbdc36646cee03b243a29ca750c606ef4fb6162b47a6bb0b2e203fba580
Instruction ID: ebb701fc6179a25c96baba2534b81a498419048c04fef450f2c414f7084b9228
Opcode Fuzzy Hash: e12addbdc36646cee03b243a29ca750c606ef4fb6162b47a6bb0b2e203fba580
Instruction Fuzzy Hash: 4BE09B3620D713AFD231226DBC0AFDF1B55DBC3BA5F241119F402AA1C5AF54584295B6

Function 00DB7310 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,00DB71C4,00000000,?,?,00DB7163), ref: 00DB7316
GetProcAddress.KERNEL32(00000000,InitWtsApi), ref: 00DB732B

Strings

InitWtsApi, xrefs: 00DB7325

Memory Dump Source

Source File: 00000000.00000002.20746483920.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000000.00000002.20746373194.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20746483920.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.20758848514.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: InitWtsApi
API String ID: 2574300362-3428673357
Opcode ID: b7cef5466d7c6a348d9e61d2ae311140cd5e13b7d601afb1794d727de40a3ad3
Instruction ID: 8b2d8612ac34271469e120eacf3ed32b65b090a5f906fd2829dfd24e13e10197
Opcode Fuzzy Hash: b7cef5466d7c6a348d9e61d2ae311140cd5e13b7d601afb1794d727de40a3ad3
Instruction Fuzzy Hash: BCD0C271708605DF8B00AFF6AC065123BDC9740F447040432E819C6190EB71C410A660

Analysis Process: getscreen-156413884-x86.exePID: 6696, Parent PID: 4144COMMON

Execution Graph

Execution Coverage:	0.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	57
Total number of Limit Nodes:	4

Executed Functions

Function 01E929E0 Relevance: 7.7, APIs: 5, Instructions: 212
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?), ref: 01E92B13
GetProcAddress.KERNELBASE(?,01E6CFF9), ref: 01E92B31
ExitProcess.KERNEL32(?,01E6CFF9), ref: 01E92B42
VirtualProtect.KERNELBASE(00740000,00001000,00000004,?,00000000), ref: 01E92B90
VirtualProtect.KERNELBASE(00740000,00001000), ref: 01E92BA5

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: ProtectVirtual$AddressExitLibraryLoadProcProcess
String ID:
API String ID: 1996367037-0
Opcode ID: 3c3e4e1660f31b76f3217510b8a4a34511a40d85c57fd981d39193e29dff6a9b
Instruction ID: 391c61bb0c683ec58ecfee36cbc39f1b252ca285cad72aaf2d7eb62838771f35
Opcode Fuzzy Hash: 3c3e4e1660f31b76f3217510b8a4a34511a40d85c57fd981d39193e29dff6a9b
Instruction Fuzzy Hash: C0510473A103136ADF318E6CDCC06ACB795EB452247581738DBE2D73C6E7E858468364

Function 00E0B62B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(00F60388,0000000C), ref: 00E0B63E
RtlExitUserThread.NTDLL(00000000), ref: 00E0B645

Strings

hp", xrefs: 00E0B632

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: ErrorExitLastThreadUser
String ID: hp"
API String ID: 1750398979-3535749429
Opcode ID: 20c702f8eb4a4f1d09fa1df70841d5b491034839501e3b64d69212977764bbf0
Instruction ID: e70983f9302ad3213ab65a109bf384cab2291cba1f74aeca5e1488578c76322e
Opcode Fuzzy Hash: 20c702f8eb4a4f1d09fa1df70841d5b491034839501e3b64d69212977764bbf0
Instruction Fuzzy Hash: 93F0C2B5A406049FDB04AFB0E80AB6E7BB4FF41710F205188F011BB2E2CB319981CBA1

Non-executed Functions

Function 00DAE437 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB43BE

Strings

EncryptMessage: %s (0x%08X), xrefs: 00DB4401
sspi_EncryptMessage, xrefs: 00DB4406, 00DB443E, 00DB4443, 00DB4449
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB440B, 00DB444A
[%s]: Security module does not provide an implementation, xrefs: 00DB4444

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$EncryptMessage: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_EncryptMessage
API String ID: 689400697-3976766517
Opcode ID: f369313ce97d77256c537f2cd269f98f8828213c85fe734e9aed2eadb1d5a78d
Instruction ID: b9081319dcaf33b24754beb8ac5c78ab50d4c5ef5aaeac8cc1ecbdc5ad09c99c
Opcode Fuzzy Hash: f369313ce97d77256c537f2cd269f98f8828213c85fe734e9aed2eadb1d5a78d
Instruction Fuzzy Hash: 10114635784305BBEA21AE56EC07F673A5CDB91B60F040054F541A61E2D9A2D921E671

Function 00DAE42E Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB42FB

Strings

sspi_DecryptMessage, xrefs: 00DB4343, 00DB437B, 00DB4380, 00DB4386
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB4348, 00DB4387
[%s]: Security module does not provide an implementation, xrefs: 00DB4381
DecryptMessage: %s (0x%08X), xrefs: 00DB433E

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$DecryptMessage: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_DecryptMessage
API String ID: 689400697-3301108232
Opcode ID: 3bd30c57549016c991fe5c43270f22717075e25eed3e706dcfc899111b149208
Instruction ID: dd33cee2726611f6ec9e59f22ed0059c62e60ab8a3d6583eb77e36d44d2969aa
Opcode Fuzzy Hash: 3bd30c57549016c991fe5c43270f22717075e25eed3e706dcfc899111b149208
Instruction Fuzzy Hash: 4011AB357C4305BBEA216A56EC43E6F3FACEB95B60F080054F541A61D2D962DA10E771

Function 00D55E14 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

crypto_cert_fingerprint.GETSCREEN-156413884-X86(?), ref: 00D55E1C

Part of subcall function 00D5576E: crypto_cert_fingerprint_by_hash.GETSCREEN-156413884-X86(?,sha256), ref: 00D55779

crypto_cert_issuer.GETSCREEN-156413884-X86(?), ref: 00D55E30
crypto_cert_subject.GETSCREEN-156413884-X86(?,?), ref: 00D55E3A
certificate_data_new.GETSCREEN-156413884-X86(?,?,00000000,00000000,00000000,?,?), ref: 00D55E4A

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: certificate_data_newcrypto_cert_fingerprintcrypto_cert_fingerprint_by_hashcrypto_cert_issuercrypto_cert_subject
String ID:
API String ID: 1865246629-0
Opcode ID: b22f0af09afbb53f47c67a66392b01df666bde5d5b51faeba4ef9e6157e0229e
Instruction ID: 1c0b49ac72356f5ad9bb6363ab6a0902b68539d48f6c4c0547ab9c3a12defea7
Opcode Fuzzy Hash: b22f0af09afbb53f47c67a66392b01df666bde5d5b51faeba4ef9e6157e0229e
Instruction Fuzzy Hash: ACE0DF36400608BF8F122F69EC06C9F3EBDDF853E0B084124BC1856129DA31CE1096B0

Function 00DFFCA9 Relevance: 6.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00DFFDC9,00F2C654), ref: 00DFFCAE
UnhandledExceptionFilter.KERNEL32(00DFFDC9,?,00DFFDC9,00F2C654), ref: 00DFFCB7
GetCurrentProcess.KERNEL32(C0000409,?,00DFFDC9,00F2C654), ref: 00DFFCC2
TerminateProcess.KERNEL32(00000000,?,00DFFDC9,00F2C654), ref: 00DFFCC9

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: 016b122b261de21273483e79371318767e93e4d76e6305f054fed9ede04224c6
Instruction ID: a7857dc23f70debcd977cb2c300a531c34c70a76bf39b72adb1ed1a1a4242ea3
Opcode Fuzzy Hash: 016b122b261de21273483e79371318767e93e4d76e6305f054fed9ede04224c6
Instruction Fuzzy Hash: B3D012BA200208AFCB002BE2FD0DB493F2CFB4A61AF050000F31AA20F0CB71440A8B65

Function 00DB7449 Relevance: 224.3, APIs: 64, Strings: 64, Instructions: 269
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(wtsapi32.dll,00DB7168), ref: 00DB744E
GetProcAddress.KERNEL32(00000000,WTSStopRemoteControlSession), ref: 00DB746B
GetProcAddress.KERNEL32(WTSStartRemoteControlSessionW), ref: 00DB747D
GetProcAddress.KERNEL32(WTSStartRemoteControlSessionA), ref: 00DB748F
GetProcAddress.KERNEL32(WTSConnectSessionW), ref: 00DB74A1
GetProcAddress.KERNEL32(WTSConnectSessionA), ref: 00DB74B3
GetProcAddress.KERNEL32(WTSEnumerateServersW), ref: 00DB74C5
GetProcAddress.KERNEL32(WTSEnumerateServersA), ref: 00DB74D7
GetProcAddress.KERNEL32(WTSOpenServerW), ref: 00DB74E9
GetProcAddress.KERNEL32(WTSOpenServerA), ref: 00DB74FB
GetProcAddress.KERNEL32(WTSOpenServerExW), ref: 00DB750D
GetProcAddress.KERNEL32(WTSOpenServerExA), ref: 00DB751F
GetProcAddress.KERNEL32(WTSCloseServer), ref: 00DB7531
GetProcAddress.KERNEL32(WTSEnumerateSessionsW), ref: 00DB7543
GetProcAddress.KERNEL32(WTSEnumerateSessionsA), ref: 00DB7555
GetProcAddress.KERNEL32(WTSEnumerateSessionsExW), ref: 00DB7567
GetProcAddress.KERNEL32(WTSEnumerateSessionsExA), ref: 00DB7579
GetProcAddress.KERNEL32(WTSEnumerateProcessesW), ref: 00DB758B
GetProcAddress.KERNEL32(WTSEnumerateProcessesA), ref: 00DB759D
GetProcAddress.KERNEL32(WTSTerminateProcess), ref: 00DB75AF
GetProcAddress.KERNEL32(WTSQuerySessionInformationW), ref: 00DB75C1
GetProcAddress.KERNEL32(WTSQuerySessionInformationA), ref: 00DB75D3
GetProcAddress.KERNEL32(WTSQueryUserConfigW), ref: 00DB75E5
GetProcAddress.KERNEL32(WTSQueryUserConfigA), ref: 00DB75F7
GetProcAddress.KERNEL32(WTSSetUserConfigW), ref: 00DB7609

Strings

WTSEnumerateSessionsW, xrefs: 00DB7533
WTSOpenServerW, xrefs: 00DB74D9
WTSDisconnectSession, xrefs: 00DB7641
WTSQueryUserToken, xrefs: 00DB7773
WTSOpenServerExA, xrefs: 00DB750F
WTSShutdownSystem, xrefs: 00DB7665
wtsapi32.dll, xrefs: 00DB7449
WTSWaitSystemEvent, xrefs: 00DB7677
WTSConnectSessionA, xrefs: 00DB74A3
WTSCreateListenerW, xrefs: 00DB7815
WTSVirtualChannelClose, xrefs: 00DB76AD
WTSQueryUserConfigW, xrefs: 00DB75D5
WTSVirtualChannelPurgeInput, xrefs: 00DB76E3
WTSRegisterSessionNotificationEx, xrefs: 00DB774F
WTSEnumerateProcessesW, xrefs: 00DB757B
WTSQuerySessionInformationA, xrefs: 00DB75C3
WTSCloseServer, xrefs: 00DB7521
WTSEnumerateListenersA, xrefs: 00DB77DF
WTSSetListenerSecurityA, xrefs: 00DB784B
WTSGetChildSessionId, xrefs: 00DB78A5
WTSVirtualChannelQuery, xrefs: 00DB7707
WTSUnRegisterSessionNotificationEx, xrefs: 00DB7761
WTSEnumerateProcessesExW, xrefs: 00DB77A9
WTSVirtualChannelRead, xrefs: 00DB76BF
WTSTerminateProcess, xrefs: 00DB759F
WTSOpenServerExW, xrefs: 00DB74FD
WTSEnumerateListenersW, xrefs: 00DB77CD
WTSStartRemoteControlSessionA, xrefs: 00DB747F
WTSEnumerateSessionsExW, xrefs: 00DB7557
WTSQueryUserConfigA, xrefs: 00DB75E7
WTSVirtualChannelOpen, xrefs: 00DB7689
WTSEnumerateProcessesExA, xrefs: 00DB77BB
WTSFreeMemoryExA, xrefs: 00DB7797
WTSLogoffSession, xrefs: 00DB7653
WTSGetListenerSecurityW, xrefs: 00DB785D
WTSVirtualChannelWrite, xrefs: 00DB76D1
WTSGetActiveConsoleSessionId, xrefs: 00DB78B7
WTSQueryListenerConfigW, xrefs: 00DB77F1
WTSSendMessageA, xrefs: 00DB762F
WTSQueryListenerConfigA, xrefs: 00DB7803
WTSEnableChildSessions, xrefs: 00DB7881
WTSEnumerateSessionsExA, xrefs: 00DB7569
WTSUnRegisterSessionNotification, xrefs: 00DB773D
WTSCreateListenerA, xrefs: 00DB7827
WTSStartRemoteControlSessionW, xrefs: 00DB746D
WTSFreeMemoryExW, xrefs: 00DB7785
WTSEnumerateSessionsA, xrefs: 00DB7545
WTSIsChildSessionsEnabled, xrefs: 00DB7898
WTSSetListenerSecurityW, xrefs: 00DB7839
WTSSetUserConfigA, xrefs: 00DB760B
WTSGetListenerSecurityA, xrefs: 00DB786F
WTSStopRemoteControlSession, xrefs: 00DB7465
WTSEnumerateServersA, xrefs: 00DB74C7
WTSFreeMemory, xrefs: 00DB7719
WTSVirtualChannelOpenEx, xrefs: 00DB769B
WTSRegisterSessionNotification, xrefs: 00DB7730
WTSEnumerateProcessesA, xrefs: 00DB758D
WTSQuerySessionInformationW, xrefs: 00DB75B1
WTSSendMessageW, xrefs: 00DB761D
WTSEnumerateServersW, xrefs: 00DB74B5
WTSVirtualChannelPurgeOutput, xrefs: 00DB76F5
WTSSetUserConfigW, xrefs: 00DB75F9
WTSOpenServerA, xrefs: 00DB74EB
WTSConnectSessionW, xrefs: 00DB7491

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: WTSCloseServer$WTSConnectSessionA$WTSConnectSessionW$WTSCreateListenerA$WTSCreateListenerW$WTSDisconnectSession$WTSEnableChildSessions$WTSEnumerateListenersA$WTSEnumerateListenersW$WTSEnumerateProcessesA$WTSEnumerateProcessesExA$WTSEnumerateProcessesExW$WTSEnumerateProcessesW$WTSEnumerateServersA$WTSEnumerateServersW$WTSEnumerateSessionsA$WTSEnumerateSessionsExA$WTSEnumerateSessionsExW$WTSEnumerateSessionsW$WTSFreeMemory$WTSFreeMemoryExA$WTSFreeMemoryExW$WTSGetActiveConsoleSessionId$WTSGetChildSessionId$WTSGetListenerSecurityA$WTSGetListenerSecurityW$WTSIsChildSessionsEnabled$WTSLogoffSession$WTSOpenServerA$WTSOpenServerExA$WTSOpenServerExW$WTSOpenServerW$WTSQueryListenerConfigA$WTSQueryListenerConfigW$WTSQuerySessionInformationA$WTSQuerySessionInformationW$WTSQueryUserConfigA$WTSQueryUserConfigW$WTSQueryUserToken$WTSRegisterSessionNotification$WTSRegisterSessionNotificationEx$WTSSendMessageA$WTSSendMessageW$WTSSetListenerSecurityA$WTSSetListenerSecurityW$WTSSetUserConfigA$WTSSetUserConfigW$WTSShutdownSystem$WTSStartRemoteControlSessionA$WTSStartRemoteControlSessionW$WTSStopRemoteControlSession$WTSTerminateProcess$WTSUnRegisterSessionNotification$WTSUnRegisterSessionNotificationEx$WTSVirtualChannelClose$WTSVirtualChannelOpen$WTSVirtualChannelOpenEx$WTSVirtualChannelPurgeInput$WTSVirtualChannelPurgeOutput$WTSVirtualChannelQuery$WTSVirtualChannelRead$WTSVirtualChannelWrite$WTSWaitSystemEvent$wtsapi32.dll
API String ID: 2238633743-2998606599
Opcode ID: 58f037b4dfcc0c0f6153050d52cb80cf1f43709ff7803f71061a8f5da0502f32
Instruction ID: 889e04a529bee836fa364e9f33b3c2be857b4fef63ba590a49f0ca02da6b30e0
Opcode Fuzzy Hash: 58f037b4dfcc0c0f6153050d52cb80cf1f43709ff7803f71061a8f5da0502f32
Instruction Fuzzy Hash: 56B158B4D44315EBCB315F79AC4A8063EA3E7047783808917E9845E2BAE6BF8050FF91

Function 00DA14E3 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 194
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

freerdp_error_info.GETSCREEN-156413884-X86(?,?,?,?,?,?,?,00DA14DF,?,00000000), ref: 00DA1519
freerdp_get_error_info_string.GETSCREEN-156413884-X86(00000000,?,?,?,?,?,?,00DA14DF,?,00000000), ref: 00DA155D
freerdp_reconnect.GETSCREEN-156413884-X86(?,?,?,?,?,?,?,00DA14DF,?,00000000), ref: 00DA1601
freerdp_get_last_error.GETSCREEN-156413884-X86(?,?,?,?,?,?,?,00DA14DF,?,00000000), ref: 00DA1611
Sleep.KERNEL32(0000000A,?,?,?,?,?,?,00DA14DF,?,00000000), ref: 00DA167E

Strings

Network disconnect!, xrefs: 00DA1710
client_auto_reconnect_ex, xrefs: 00DA1568, 00DA15DF, 00DA1646, 00DA16BC, 00DA1715
Maximum reconnect retries exceeded, xrefs: 00DA16B7
Attempting reconnect (%u of %u), xrefs: 00DA15DA
C:\Project\agent-windows\freerdp\FreeRDP\client\common\client.c, xrefs: 00DA156D, 00DA15E4, 00DA164B, 00DA16C1, 00DA171A
Autoreconnect aborted by user, xrefs: 00DA1641
com.freerdp.client.common, xrefs: 00DA153E, 00DA1589, 00DA15BC, 00DA1627, 00DA169D, 00DA16E9, 00DA16F2
Disconnected by server hitting a bug or resource limit [%s], xrefs: 00DA1563

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Sleepfreerdp_error_infofreerdp_get_error_info_stringfreerdp_get_last_errorfreerdp_reconnect
String ID: Attempting reconnect (%u of %u)$Autoreconnect aborted by user$C:\Project\agent-windows\freerdp\FreeRDP\client\common\client.c$Disconnected by server hitting a bug or resource limit [%s]$Maximum reconnect retries exceeded$Network disconnect!$client_auto_reconnect_ex$com.freerdp.client.common
API String ID: 968149013-2963753137
Opcode ID: 52e07c33af9fc13d6e074c0f836e5f8e7aea98aecd7a1dfff7b1998b3a5752e1
Instruction ID: 1b780f5c1893d4df400537a90cfae4965274cec3d1a900c8f12ba80652d98e88
Opcode Fuzzy Hash: 52e07c33af9fc13d6e074c0f836e5f8e7aea98aecd7a1dfff7b1998b3a5752e1
Instruction Fuzzy Hash: 9751D776B4030577EB257B25EC43F7A27A8DF62B50F1C4029F610FA1D1EA76DA808674

Function 00D6A89E Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 127
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

gdi_get_pixel_format.GETSCREEN-156413884-X86(?,?,?,?,?,00D6A899,?,?,00000000,00000000,Function_006DAA7A), ref: 00D6A8B3
gdi_free.GETSCREEN-156413884-X86(?,?,?,?,?,00D6A899,?,?,00000000,00000000,Function_006DAA7A), ref: 00D6AA40

Strings

failed to initialize gdi, xrefs: 00D6AA6D
gdi_init_ex, xrefs: 00D6AA72
C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\gdi\gdi.c, xrefs: 00D6AA77
com.freerdp.gdi, xrefs: 00D6A8D7, 00D6AA4F

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: gdi_freegdi_get_pixel_format
String ID: C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\gdi\gdi.c$com.freerdp.gdi$failed to initialize gdi$gdi_init_ex
API String ID: 1251975138-534786182
Opcode ID: 736e6e28bfab0f4d5ff8517606a17aaf4e9ac39a32e281fa7f1c25b6275a8a44
Instruction ID: 048db22db05d0468b72fba943d9835b19abd880d5ce30f0cf61c222ec5a33d59
Opcode Fuzzy Hash: 736e6e28bfab0f4d5ff8517606a17aaf4e9ac39a32e281fa7f1c25b6275a8a44
Instruction Fuzzy Hash: 984172712007026FDB54AF68DC42B6AB7A5FF15310F18442AF598AB192EF71A851CF71

Function 00D30E1F Relevance: 17.6, APIs: 2, Strings: 8, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 00D30F64
RtlLeaveCriticalSection.NTDLL(?), ref: 00D30F79

Strings

error: channel export function call failed, xrefs: 00D30FB9
freerdp_channels_client_load_ex, xrefs: 00D30E64, 00D30EBD, 00D30FBE
PDRF, xrefs: 00D30F4B
C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\client.c, xrefs: 00D30E69, 00D30EC2, 00D30FC3
error: too many channels, xrefs: 00D30E5F
com.freerdp.core.client, xrefs: 00D30E3D, 00D30E9A, 00D30F9B
Skipping, channel already loaded, xrefs: 00D30EB8
,, xrefs: 00D30F23

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: ,$C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\client.c$PDRF$Skipping, channel already loaded$com.freerdp.core.client$error: channel export function call failed$error: too many channels$freerdp_channels_client_load_ex
API String ID: 3168844106-1571615648
Opcode ID: e196fda8aa3df71ec429677dd426a63e709925eb21032b98280bf9f47e7f55da
Instruction ID: 329d81fc3df4a899cedadc6a72d75e6cba0eb4365c05580b2ca61c68765f337e
Opcode Fuzzy Hash: e196fda8aa3df71ec429677dd426a63e709925eb21032b98280bf9f47e7f55da
Instruction Fuzzy Hash: 6741D571B4030AAFDB209F69EC42B597BE8EB09714F144429F654F72D0D7B5A9018BA4

Function 00DA6C86 Relevance: 16.1, APIs: 4, Strings: 5, Instructions: 337
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

freerdp_device_collection_add.GETSCREEN-156413884-X86(?,?), ref: 00DA6D79
freerdp_device_collection_add.GETSCREEN-156413884-X86(?,00000000), ref: 00DA6E1D
freerdp_device_collection_add.GETSCREEN-156413884-X86(?,00000000), ref: 00DA6F6F
freerdp_device_collection_add.GETSCREEN-156413884-X86(?,00000000), ref: 00DA7044

Strings

parallel, xrefs: 00DA6FAF
drive, xrefs: 00DA6C95
smartcard, xrefs: 00DA6DA3
serial, xrefs: 00DA6E3D
printer, xrefs: 00DA6CDF

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: freerdp_device_collection_add
String ID: drive$parallel$printer$serial$smartcard
API String ID: 2538329621-807955808
Opcode ID: 8b8e51b5fc2b59d3695008d5171141d1fa826ae87ffdd48c750bd05bd26807b5
Instruction ID: 4fdefb2aadd57d8e8ca45f8235a31c89f0d83400624acd8d5ba121443c7c77a2
Opcode Fuzzy Hash: 8b8e51b5fc2b59d3695008d5171141d1fa826ae87ffdd48c750bd05bd26807b5
Instruction Fuzzy Hash: 2DB1A036608602DBDF15AF18D84199E7BE1FF46350B188069F804AF292EF72DD919FA4

Function 00D30C4D Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 00D30D92
RtlLeaveCriticalSection.NTDLL(?), ref: 00D30DB2

Strings

error: channel export function call failed, xrefs: 00D30DF1
freerdp_channels_client_load, xrefs: 00D30C93, 00D30CED, 00D30DF6
C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\client.c, xrefs: 00D30C98, 00D30CF2, 00D30DFB
error: too many channels, xrefs: 00D30C8E
com.freerdp.core.client, xrefs: 00D30C6C, 00D30CCA, 00D30DD3
Skipping, channel already loaded, xrefs: 00D30CE8
PDRF, xrefs: 00D30D76

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\client.c$PDRF$Skipping, channel already loaded$com.freerdp.core.client$error: channel export function call failed$error: too many channels$freerdp_channels_client_load
API String ID: 3168844106-4217659166
Opcode ID: 51e591a06f08c591435b422d6e952d2ddc77b0e0d15d6984e73f578023353a9d
Instruction ID: d2acf971fe50968f178ca803bba6dce10a18dfd0ca66655c62a2c63ab1213201
Opcode Fuzzy Hash: 51e591a06f08c591435b422d6e952d2ddc77b0e0d15d6984e73f578023353a9d
Instruction Fuzzy Hash: E751AF71A40305AFEB24DF65EC46B5A7BA8EB05714F144029F644BB2D1EBB4A900CB64

Function 00E358B8 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

audio_format_get_tag_string.GETSCREEN-156413884-X86(00000000,?,?,00E35425,?,?,?,?,00000000,?), ref: 00E358FA
audio_format_get_tag_string.GETSCREEN-156413884-X86(00000001,00000000,?,?,00E35425,?,?,?,?,00000000,?), ref: 00E35902
audio_format_compatible.GETSCREEN-156413884-X86(%T,?,?,?,?,00E35425,?,?,?,?,00000000,?), ref: 00E3594D

Strings

%T, xrefs: 00E35937, 00E35949, 00E3594C
com.freerdp.dsp, xrefs: 00E358D4, 00E35966
C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\dsp.c, xrefs: 00E35915, 00E3598E
freerdp_dsp_resample, xrefs: 00E35909, 00E3590E, 00E35914, 00E35989
Missing resample support, recompile -DWITH_SOXR=ON or -DWITH_DSP_FFMPEG=ON, xrefs: 00E35984
%s requires %s for sample input, got %s, xrefs: 00E3590F

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: audio_format_get_tag_string$audio_format_compatible
String ID: %T$%s requires %s for sample input, got %s$C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\dsp.c$Missing resample support, recompile -DWITH_SOXR=ON or -DWITH_DSP_FFMPEG=ON$com.freerdp.dsp$freerdp_dsp_resample
API String ID: 204136587-1473788660
Opcode ID: 29c281bf8f68dacc1c6ecbc63b5716983a06f941abb9707eafc645fe31ac66ec
Instruction ID: 1798c5e9b03cc595c653d2a1446ba90b8626bdce48c38534dee020eb9ed1cae7
Opcode Fuzzy Hash: 29c281bf8f68dacc1c6ecbc63b5716983a06f941abb9707eafc645fe31ac66ec
Instruction Fuzzy Hash: 8521AAB27443016AE7245B64AC47F6B3BDCDB5173CF10141AFA54FA1C1EDA1E840D67A

Function 00E33B76 Relevance: 15.1, APIs: 10, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

freerdp_settings_set_bool.GETSCREEN-156413884-X86(?,00000400,00000001), ref: 00E33B87
freerdp_settings_set_string.GETSCREEN-156413884-X86(?,00000401,00000000), ref: 00E33BB7
freerdp_settings_set_string.GETSCREEN-156413884-X86(?,00000404,?), ref: 00E33BDB
freerdp_settings_set_string.GETSCREEN-156413884-X86(?,00000402,00000000), ref: 00E33BFA
freerdp_settings_set_string.GETSCREEN-156413884-X86(?,00000014,?), ref: 00E33C12
freerdp_settings_set_string.GETSCREEN-156413884-X86(?,000006C1,?), ref: 00E33C2B
freerdp_settings_set_string.GETSCREEN-156413884-X86(?,00000403,?), ref: 00E33C44
freerdp_settings_set_string.GETSCREEN-156413884-X86(?,00000015,00000000), ref: 00E33C60
freerdp_settings_set_uint32.GETSCREEN-156413884-X86(?,00000013,?), ref: 00E33C82
freerdp_target_net_addresses_free.GETSCREEN-156413884-X86(?), ref: 00E33C93

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: freerdp_settings_set_string$freerdp_settings_set_boolfreerdp_settings_set_uint32freerdp_target_net_addresses_free
String ID:
API String ID: 949014189-0
Opcode ID: 12f87a41451c66bc5c8156e90c5a793ed94ff3185f274a213cefdbc36b09d4f7
Instruction ID: 3cc2f8fa1af4a78d03d4e5adae9df05d7f39a7578fcc74f9f9acc278b3b8a316
Opcode Fuzzy Hash: 12f87a41451c66bc5c8156e90c5a793ed94ff3185f274a213cefdbc36b09d4f7
Instruction Fuzzy Hash: C841D971600A06BBE7315F34EC4EF9A7B94FF04308F441024FA05E6591E776EA60CBA4

Function 00DE1612 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 220
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00DB5CD5: InitializeCriticalSectionAndSpinCount.KERNEL32(00000004,00000FA0,?,00000000,?,00DE1701,00000001), ref: 00DB5CF9

zgfx_context_new.GETSCREEN-156413884-X86(00000000), ref: 00DE1874

Part of subcall function 00E3693A: zgfx_context_reset.GETSCREEN-156413884-X86(00000000,00000000,00000000,?,00DE1879,00000000), ref: 00E36964

Strings

com.freerdp.channels.rdpgfx.client, xrefs: 00DE1635, 00DE167A, 00DE167F, 00DE16A0, 00DE16BE, 00DE1719, 00DE17ED, 00DE1898
calloc failed!, xrefs: 00DE1657, 00DE180B
zgfx_context_new failed!, xrefs: 00DE18B2
HashTable_New failed!, xrefs: 00DE1737
C:\Project\agent-windows\freerdp\FreeRDP\channels\rdpgfx\client\rdpgfx_main.c, xrefs: 00DE1661, 00DE16C9, 00DE1741, 00DE1815, 00DE18BC
rdpgfx_client_context_new, xrefs: 00DE165C, 00DE16C4, 00DE173C, 00DE1810, 00DE18B7
Failed to acquire reference to WLog %s, xrefs: 00DE16BF

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpinzgfx_context_newzgfx_context_reset
String ID: C:\Project\agent-windows\freerdp\FreeRDP\channels\rdpgfx\client\rdpgfx_main.c$Failed to acquire reference to WLog %s$HashTable_New failed!$calloc failed!$com.freerdp.channels.rdpgfx.client$rdpgfx_client_context_new$zgfx_context_new failed!
API String ID: 3732774510-3243565116
Opcode ID: a9f86d6ee6c1bf7d75e60ac473ecaeef782e87272a9f5bf328b803e7f78dd39e
Instruction ID: a7884d76c1402203b4a71a9339bf000f96533329993c787448c501b47fe49e02
Opcode Fuzzy Hash: a9f86d6ee6c1bf7d75e60ac473ecaeef782e87272a9f5bf328b803e7f78dd39e
Instruction Fuzzy Hash: 29711974784742BAD320AF26AC46B5677D8FB15B64F140129F544EB6C1DBB4E840CBB4

Function 00D6E4DD Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 138registrythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00DB6B05: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00000FA0,00000000,00000000,00000000,?,00D6E59B,00000001,00006060,00000010), ref: 00DB6B3E

GetVersionExA.KERNEL32(?), ref: 00D6E5CD
GetNativeSystemInfo.KERNEL32(?), ref: 00D6E5E7
RegOpenKeyExA.ADVAPI32(80000002,Software\FreeRDP\FreeRDP\RemoteFX,00000000,00020119,?), ref: 00D6E612
primitives_get.GETSCREEN-156413884-X86 ref: 00D6E6DC
CreateThreadpool.KERNEL32(00000000), ref: 00D6E6E2

Strings

Software\FreeRDP\FreeRDP\RemoteFX, xrefs: 00D6E605
com.freerdp.codec.rfx, xrefs: 00D6E530

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: CountCreateCriticalInfoInitializeNativeOpenSectionSpinSystemThreadpoolVersionprimitives_get
String ID: Software\FreeRDP\FreeRDP\RemoteFX$com.freerdp.codec.rfx
API String ID: 3882483829-2530424157
Opcode ID: d516d2f4fb4fb947890f0f34c17779c9cccf0d2fe72e074f2e386071ae2e7d95
Instruction ID: 5c4e0ae59249631e6cc24edc33fd482fdee636d76ee8ea35f24eae6d19730bd6
Opcode Fuzzy Hash: d516d2f4fb4fb947890f0f34c17779c9cccf0d2fe72e074f2e386071ae2e7d95
Instruction Fuzzy Hash: 0041AEB5A0070AAFEB109FB5DC86B6AB7F8FF44704F10442DE549A6282EB74D9458F70

Function 00DAE889 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 106COMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(WLOG_APPENDER,00000000,00000000), ref: 00DAE8B2
GetEnvironmentVariableA.KERNEL32(WLOG_APPENDER,00000000,00000000), ref: 00DAE8D6

Strings

UDP, xrefs: 00DAE94E
BINARY, xrefs: 00DAE938
CONSOLE, xrefs: 00DAE911
FILE, xrefs: 00DAE922
WLOG_APPENDER, xrefs: 00DAE8A6, 00DAE8D1, 00DAE8E3
%s environment variable modified in my back, xrefs: 00DAE8E8

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: EnvironmentVariable
String ID: %s environment variable modified in my back$BINARY$CONSOLE$FILE$UDP$WLOG_APPENDER
API String ID: 1431749950-225596728
Opcode ID: 59cd61ef45497802f9306aa52deaf7dfba3cea3ce77d0897025a33b3194e8a4c
Instruction ID: ee82b75be1a7cbf690fccbfebfb7c04767cf7637468d7e82a100162d7369ee3d
Opcode Fuzzy Hash: 59cd61ef45497802f9306aa52deaf7dfba3cea3ce77d0897025a33b3194e8a4c
Instruction Fuzzy Hash: D521A13734835629E6647366AC8BE3B1B99CB93B74724043AF405F50C2EE55C891EDB2

Function 00D23971 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 95COMMON

Download Yara Rule

APIs

freerdp_set_last_error_ex.GETSCREEN-156413884-X86(?,?,rdp_set_error_info,C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\rdp.c,0000015B), ref: 00D348D9
freerdp_set_last_error_ex.GETSCREEN-156413884-X86(?,00000000,rdp_set_error_info,C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\rdp.c,0000016A), ref: 00D3498F

Strings

ErrorInfo, xrefs: 00D3490B
C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\rdp.c, xrefs: 00D348C7, 00D3495F, 00D34982
%s missing context=%p, xrefs: 00D34959
freerdp, xrefs: 00D34919
com.freerdp.core.rdp, xrefs: 00D34933
rdp_set_error_info, xrefs: 00D348CC, 00D34953, 00D34958, 00D3495E, 00D34987

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: freerdp_set_last_error_ex
String ID: %s missing context=%p$C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\rdp.c$ErrorInfo$com.freerdp.core.rdp$freerdp$rdp_set_error_info
API String ID: 270715978-29603548
Opcode ID: 6805e0f0f859e76f837a4a9d0c547b024f1cb982e7fd7b7dafe110a540c0051d
Instruction ID: d3638f7f4958cd93d300bb98f490a1a99c7581fee34172c24aa3615508b6c4d9
Opcode Fuzzy Hash: 6805e0f0f859e76f837a4a9d0c547b024f1cb982e7fd7b7dafe110a540c0051d
Instruction Fuzzy Hash: D8210B72A40305BADB106F55DC03FAB7B6CDB51B14F184169FA047A2C5E6F8A640CEB5

Function 00DB4B0C Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 37libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(secur32.dll,?,00DB4AEC), ref: 00DB4B18
LoadLibraryA.KERNEL32(security.dll,?,00DB4AEC), ref: 00DB4B28
GetProcAddress.KERNEL32(00000000,InitSecurityInterfaceW), ref: 00DB4B42
GetProcAddress.KERNEL32(InitSecurityInterfaceA), ref: 00DB4B51

Strings

secur32.dll, xrefs: 00DB4B13
security.dll, xrefs: 00DB4B23
InitSecurityInterfaceA, xrefs: 00DB4B44
InitSecurityInterfaceW, xrefs: 00DB4B3C

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: InitSecurityInterfaceA$InitSecurityInterfaceW$secur32.dll$security.dll
API String ID: 2574300362-4081094439
Opcode ID: 6dc9c195ef71b49740e96efa3b3d7dac41623b4274284e34f788f6e9c7118604
Instruction ID: c6c5fb9d0c236541ea0d90f628031eaa7f36e9349fb369af3d771d2e5b6abcc1
Opcode Fuzzy Hash: 6dc9c195ef71b49740e96efa3b3d7dac41623b4274284e34f788f6e9c7118604
Instruction Fuzzy Hash: 9AF08976D54326D69732EBBABC00D967AE8AB84B543090263E940E3154E6B5D8019FB1

Function 00D642E5 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 181fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000003,00000080,00000000), ref: 00D64320
GetFileSize.KERNEL32(00000000,?), ref: 00D6433A

Strings

%s %hu %s %s %s, xrefs: 00D64610

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: File$CreateSize
String ID: %s %hu %s %s %s
API String ID: 2791376181-2916857029
Opcode ID: d9df6ff7510dfcab3bf1b4de9475d128590aa922005345c4e6c5195d3a73e665
Instruction ID: 237e39134405a733fd206d3881dc8a96382620f8a7c352e027a9d41c61ed9067
Opcode Fuzzy Hash: d9df6ff7510dfcab3bf1b4de9475d128590aa922005345c4e6c5195d3a73e665
Instruction Fuzzy Hash: 54514FB5A00215AFEB11ABB5EC45ABF77FCEF05720B14412AF911F6290EB3499408B74

Function 00D4501B Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 140COMMON

Download Yara Rule

APIs

ber_read_universal_tag.GETSCREEN-156413884-X86(?,00000002,00000000), ref: 00D4502A
ber_read_length.GETSCREEN-156413884-X86(?,?), ref: 00D4503F

Strings

C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\crypto\ber.c, xrefs: 00D45132, 00D45182
should implement reading an 8 bytes integer, xrefs: 00D45128
should implement reading an integer with length=%d, xrefs: 00D45178
ber_read_integer, xrefs: 00D4512D, 00D4517D
com.freerdp.crypto, xrefs: 00D4510A, 00D45159

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: ber_read_lengthber_read_universal_tag
String ID: C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\crypto\ber.c$ber_read_integer$com.freerdp.crypto$should implement reading an 8 bytes integer$should implement reading an integer with length=%d
API String ID: 3186670568-2454464461
Opcode ID: ba375764ba7af731fbd1cde8059592c2cac3e763f6c2fd08624046a6823b2fc2
Instruction ID: 4e51c84c7c1c4a5764acaec974826a5cb9dc166e84ddfb10d4ec214304261f3c
Opcode Fuzzy Hash: ba375764ba7af731fbd1cde8059592c2cac3e763f6c2fd08624046a6823b2fc2
Instruction Fuzzy Hash: 354147B1704B426BDB208F25EC82B2A37E5EB52720F184169F5999B2CFE675D900CB70

Function 00D89C5D Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 109COMMON

Download Yara Rule

APIs

region16_rects.GETSCREEN-156413884-X86(?,?), ref: 00D89C6E

Strings

region16_print, xrefs: 00D89CA7, 00D89D09, 00D89D69
com.freerdp.codec, xrefs: 00D89C80, 00D89CE5, 00D89D33
C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\region.c, xrefs: 00D89CAC, 00D89D0E, 00D89D6E
nrects=%u, xrefs: 00D89CA2
(%hu,%hu-%hu,%hu), xrefs: 00D89D64
band %d: , xrefs: 00D89D04

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: region16_rects
String ID: (%hu,%hu-%hu,%hu)$C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\region.c$band %d: $com.freerdp.codec$nrects=%u$region16_print
API String ID: 844131241-2640574824
Opcode ID: a0621893c0bcdac7eb9a1e157bffbd7a1cc333f7abe26ecca077089619322ab3
Instruction ID: d14cf10fe670c30fddff6f47bd896c1f8f0084ad19bf62500fb6d94763b53b0e
Opcode Fuzzy Hash: a0621893c0bcdac7eb9a1e157bffbd7a1cc333f7abe26ecca077089619322ab3
Instruction Fuzzy Hash: A231A472780306B9E6306B65AC53F76B3D8DB56B11F181015FA94F62D0FA97A9808374

Function 00D22BCF Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 102COMMON

Download Yara Rule

APIs

freerdp_set_last_error_ex.GETSCREEN-156413884-X86(?,00000000,freerdp_connect,C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\freerdp.c,000000AA), ref: 00D22C14
clearChannelError.GETSCREEN-156413884-X86(?,?,00000000,freerdp_connect,C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\freerdp.c,000000AA), ref: 00D22C1B

Part of subcall function 00D226E1: ResetEvent.KERNEL32(?), ref: 00D2270A

Part of subcall function 00D38142: ResetEvent.KERNEL32(?,?,00D22C27,?,?,?,00000000,freerdp_connect,C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\freerdp.c,000000AA), ref: 00D3814E

Strings

freerdp, xrefs: 00D23062
ConnectionResult, xrefs: 00D23077
C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\freerdp.c, xrefs: 00D22BFC
freerdp_connect, xrefs: 00D22C01

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: EventReset$ChannelErrorclearfreerdp_set_last_error_ex
String ID: C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\freerdp.c$ConnectionResult$freerdp$freerdp_connect
API String ID: 3632380314-3564821047
Opcode ID: 234f31b0c01cfaf9f1cda493291af777aadd0dae43b85d6ba32b240952c63d3a
Instruction ID: 47f9ff579d0f6bd4f8c6551b647dceb0c06b388598284b870d4b857142b52a35
Opcode Fuzzy Hash: 234f31b0c01cfaf9f1cda493291af777aadd0dae43b85d6ba32b240952c63d3a
Instruction Fuzzy Hash: 79317E71600215AFEB10DF69E985BAAB7F4FF18304F180079F914E7291DB759A548B70

Function 00D453FD Relevance: 12.1, APIs: 8, Instructions: 80COMMON

Download Yara Rule

APIs

ber_write_universal_tag.GETSCREEN-156413884-X86(?,00000002,00000000), ref: 00D45415
ber_write_length.GETSCREEN-156413884-X86(?,00000001,?,00000002,00000000), ref: 00D4541D
ber_write_universal_tag.GETSCREEN-156413884-X86(?,00000002,00000000), ref: 00D45440
ber_write_length.GETSCREEN-156413884-X86(?,00000002,?,00000002,00000000), ref: 00D45448

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: ber_write_lengthber_write_universal_tag
String ID:
API String ID: 1889070510-0
Opcode ID: 18ef3f9f5ae11241768caf1c4dc31a824dec3e3bd5586f49f269dacf6024e569
Instruction ID: 2370a199a7cdf897bc0aefee0484073bb4ceb46cef0d095266aff33809bbaf7c
Opcode Fuzzy Hash: 18ef3f9f5ae11241768caf1c4dc31a824dec3e3bd5586f49f269dacf6024e569
Instruction Fuzzy Hash: 1F21D731205F44EFDB125B08ED42B6A77A5EF11B01F058459FA8E1FA87C265AE41CBB1

Function 00D4CB5F Relevance: 12.1, APIs: 8, Instructions: 65COMMON

Download Yara Rule

APIs

glyph_cache_new.GETSCREEN-156413884-X86(?), ref: 00D4CB79
brush_cache_new.GETSCREEN-156413884-X86(?), ref: 00D4CB86
pointer_cache_new.GETSCREEN-156413884-X86(?), ref: 00D4CB94
bitmap_cache_new.GETSCREEN-156413884-X86(?), ref: 00D4CBA2
offscreen_cache_new.GETSCREEN-156413884-X86(?), ref: 00D4CBB0
palette_cache_new.GETSCREEN-156413884-X86(?), ref: 00D4CBBE
nine_grid_cache_new.GETSCREEN-156413884-X86(?), ref: 00D4CBCC
cache_free.GETSCREEN-156413884-X86(00000000), ref: 00D4CBDE

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: bitmap_cache_newbrush_cache_newcache_freeglyph_cache_newnine_grid_cache_newoffscreen_cache_newpalette_cache_newpointer_cache_new
String ID:
API String ID: 2332728789-0
Opcode ID: 42906154869710506a0c67ebba1e6bbb42983877cc0118c6e46d3c0bd67e0258
Instruction ID: fff0f8e958aee5268df8f76507cf07d66487e8d42236f9fcc16d47005cc25ea2
Opcode Fuzzy Hash: 42906154869710506a0c67ebba1e6bbb42983877cc0118c6e46d3c0bd67e0258
Instruction Fuzzy Hash: E501803625AB075BE364AEB6A853D3B67E8CF42B70718543FE480E6981FF24D40186B1

Function 00D6EFD0 Relevance: 10.7, APIs: 7, Instructions: 160COMMON

Download Yara Rule

APIs

region16_init.GETSCREEN-156413884-X86(?), ref: 00D6F58A

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: region16_init
String ID:
API String ID: 4140821900-0
Opcode ID: 3e8d829aa97f6b1ed1f2f2cf94f42bc771981313d169c183af5fd76dbc63c424
Instruction ID: 305966164178dc0f8d3ba639d6ef2abdbb41c12daa4f928cff9ce80e3619b53f
Opcode Fuzzy Hash: 3e8d829aa97f6b1ed1f2f2cf94f42bc771981313d169c183af5fd76dbc63c424
Instruction Fuzzy Hash: A8517CB2D00219ABDF18EFA9D8819EEBBF9FF48304F14412AF559E7240E7359941CB60

Function 00D6AA9A Relevance: 10.6, APIs: 7, Instructions: 147windowCOMMON

Download Yara Rule

APIs

gdi_CreateCompatibleDC.GETSCREEN-156413884-X86(?,00000000,?,?,?,00D6A9C7,00000000,?,?,?,?,?,?,?,?,00D6A899), ref: 00D6AAE7
gdi_CreateCompatibleBitmap.GETSCREEN-156413884-X86(?,?,?,00000000,?,?,?,00D6A9C7,00000000,?,?,?,?), ref: 00D6AB0E
gdi_CreateBitmapEx.GETSCREEN-156413884-X86(?,?,?,?,?,?,00000000,?,?,?,00D6A9C7,00000000,?,?,?,?), ref: 00D6AB2A
gdi_SelectObject.GETSCREEN-156413884-X86(?,?), ref: 00D6AB60
gdi_CreateRectRgn.GETSCREEN-156413884-X86(00000000,00000000,00000000,00000000), ref: 00D6ABA5
gdi_DeleteObject.GETSCREEN-156413884-X86(?), ref: 00D6AC39
gdi_DeleteDC.GETSCREEN-156413884-X86(?), ref: 00D6AC48

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: gdi_$Create$BitmapCompatibleDeleteObject$RectSelect
String ID:
API String ID: 412453062-0
Opcode ID: 63bcb7db3704573387d602035f9edcf4ce94fd8292c8b1d92a53da2faae9183a
Instruction ID: fdf687e987cde5e3a753ed0a5395322451627d44377fe6879c6aa63682e1b8c5
Opcode Fuzzy Hash: 63bcb7db3704573387d602035f9edcf4ce94fd8292c8b1d92a53da2faae9183a
Instruction Fuzzy Hash: 3B5106792007059FC725DF28C885EA6B7E1FF1C310B0945AEE98A8B762E771E841CF60

Function 00DBEA62 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(WLOG_FILEAPPENDER_OUTPUT_FILE_PATH,00000000,00000000,00000000,?,?,?,?,?,00DB6939,?,?,?,?,00DB6A0A,?), ref: 00DBEABD
GetEnvironmentVariableA.KERNEL32(WLOG_FILEAPPENDER_OUTPUT_FILE_PATH,00000000,?,?,?,?,00DB6939,?,?,?,?,00DB6A0A,?,?,00000000), ref: 00DBEAE7
GetEnvironmentVariableA.KERNEL32(WLOG_FILEAPPENDER_OUTPUT_FILE_NAME,00000000,00000000,?,?,?,00DB6939,?,?,?,?,00DB6A0A,?,?,00000000), ref: 00DBEB14
GetEnvironmentVariableA.KERNEL32(WLOG_FILEAPPENDER_OUTPUT_FILE_NAME,00000000,?,?,?,?,00DB6939,?,?,?,?,00DB6A0A,?,?,00000000), ref: 00DBEB37

Strings

WLOG_FILEAPPENDER_OUTPUT_FILE_NAME, xrefs: 00DBEB0F, 00DBEB32
WLOG_FILEAPPENDER_OUTPUT_FILE_PATH, xrefs: 00DBEA87, 00DBEAE2

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: EnvironmentVariable
String ID: WLOG_FILEAPPENDER_OUTPUT_FILE_NAME$WLOG_FILEAPPENDER_OUTPUT_FILE_PATH
API String ID: 1431749950-2760771567
Opcode ID: 3003672d8f8ac8353af05bb60af147140f761dca6eac61b0cf911b5a80fed5a2
Instruction ID: 90133b353b5cf1063962a4ace7bdf70f69dd8727c235b759bd6964edd19ed087
Opcode Fuzzy Hash: 3003672d8f8ac8353af05bb60af147140f761dca6eac61b0cf911b5a80fed5a2
Instruction Fuzzy Hash: 5031D1B6A00A16FF87146FA69849DEFBFA8FF407643140018F403A3681DB709C519AF9

Function 007A8EE0 Relevance: 10.6, APIs: 7, Instructions: 87COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(00FE1278,Function_00068C90,007A8EC0,00000000), ref: 007A8F0A
GetLastError.KERNEL32 ref: 007A8F38
TlsGetValue.KERNEL32 ref: 007A8F46
SetLastError.KERNEL32(00000000), ref: 007A8F4F
RtlAcquireSRWLockExclusive.NTDLL(00FE1284), ref: 007A8F61
RtlReleaseSRWLockExclusive.NTDLL(00FE1284), ref: 007A8F73
TlsSetValue.KERNEL32(00000000,?,?,00000000,0078B080), ref: 007A8FB5

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: ErrorExclusiveLastLockOnceValue$AcquireExecuteInitRelease
String ID:
API String ID: 389898287-0
Opcode ID: d82df07462a115ee3f0cc6b4226ffbe6275affee18ae113974017ee9efc692e2
Instruction ID: e2a4279d735c18e1b95dfaebc6676b0b4821ef0f2c36977a78e068d3e474efea
Opcode Fuzzy Hash: d82df07462a115ee3f0cc6b4226ffbe6275affee18ae113974017ee9efc692e2
Instruction Fuzzy Hash: 3C21F6B570020AAFD7405FA6EC49BAE3BA5FB47701F000120FE15E62D0EB759919DBA2

Function 00DBF61C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000002,00000011), ref: 00DBF673
GetEnvironmentVariableA.KERNEL32(WLOG_UDP_TARGET,00000000,00000000,?,00DB6921,?,?,?,?,00DB6A0A,?,?,00000000,?,00DAE976,00000000), ref: 00DBF68A
GetEnvironmentVariableA.KERNEL32(WLOG_UDP_TARGET,00000000,00000000,?,00DB6921,?,?,?,?,00DB6A0A,?,?,00000000,?,00DAE976,00000000), ref: 00DBF6AB
closesocket.WS2_32(?), ref: 00DBF6E6

Strings

127.0.0.1:20000, xrefs: 00DBF6CB
WLOG_UDP_TARGET, xrefs: 00DBF685, 00DBF6A6

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: EnvironmentVariable$closesocketsocket
String ID: 127.0.0.1:20000$WLOG_UDP_TARGET
API String ID: 65193492-3368084233
Opcode ID: 1eb5259095c9f59c9b1c2d168aadc1d36cd4503f6d79c8977cb25e4217055946
Instruction ID: ce4c73165f8e39fe9115eda3647c98a578ad6a325e3d0917779317582e933391
Opcode Fuzzy Hash: 1eb5259095c9f59c9b1c2d168aadc1d36cd4503f6d79c8977cb25e4217055946
Instruction Fuzzy Hash: 97219F76644B02EFD3305F669C09B977BE4EF41714F24042DF543AAAE1DBB1E4418B64

Function 00DC001B Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(winsta.dll,?,00DB78D9,01067120), ref: 00DC0023
GetProcAddress.KERNEL32(00000000,WinStationVirtualOpen), ref: 00DC003C
GetProcAddress.KERNEL32(WinStationVirtualOpenEx), ref: 00DC0052

Strings

WinStationVirtualOpen, xrefs: 00DC0036
winsta.dll, xrefs: 00DC001E
WinStationVirtualOpenEx, xrefs: 00DC0042

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: WinStationVirtualOpen$WinStationVirtualOpenEx$winsta.dll
API String ID: 2238633743-2382846951
Opcode ID: bca72f749f963809c03aaa0275ada407960eddc3121bd1f100a8fb5f62a59976
Instruction ID: a8fd1ac4370bff82f7a7cb31ba5c699696b6b56c3ffe79f8a697d2f120e9f33e
Opcode Fuzzy Hash: bca72f749f963809c03aaa0275ada407960eddc3121bd1f100a8fb5f62a59976
Instruction Fuzzy Hash: 770125B0A41742CFD7009FB1A80DF623EE4BB05794F0A40BDE489EB362DBB58044AF64

Function 00D4CB11 Relevance: 10.5, APIs: 7, Instructions: 26COMMON

Download Yara Rule

APIs

glyph_cache_free.GETSCREEN-156413884-X86(?), ref: 00D4CB1E
brush_cache_free.GETSCREEN-156413884-X86(?,?), ref: 00D4CB26
pointer_cache_free.GETSCREEN-156413884-X86(?,?,?), ref: 00D4CB2E
bitmap_cache_free.GETSCREEN-156413884-X86(?,?,?,?), ref: 00D4CB36
offscreen_cache_free.GETSCREEN-156413884-X86(?,?,?,?,?), ref: 00D4CB3E
palette_cache_free.GETSCREEN-156413884-X86(?,?,?,?,?,?), ref: 00D4CB46
nine_grid_cache_free.GETSCREEN-156413884-X86(?,?,?,?,?,?,?), ref: 00D4CB4E

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: bitmap_cache_freebrush_cache_freeglyph_cache_freenine_grid_cache_freeoffscreen_cache_freepalette_cache_freepointer_cache_free
String ID:
API String ID: 637575458-0
Opcode ID: 7ad28be861358ee9bde9c91c788d2f392276a4a1cd27f1ec8984fa40b200d7dc
Instruction ID: 7d2ad1be38f40f5d9100628832ae03b041193a76f72864a167362ba3ee387bbb
Opcode Fuzzy Hash: 7ad28be861358ee9bde9c91c788d2f392276a4a1cd27f1ec8984fa40b200d7dc
Instruction Fuzzy Hash: 71E01231411A14ABCA323F61DC03C5ABBAAEF117617445929F49625473CB22AC60AEB5

Function 00D8DFDE Relevance: 9.2, APIs: 6, Instructions: 160COMMON

Download Yara Rule

APIs

gdi_CRgnToRect.GETSCREEN-156413884-X86(00000000,00000000,00000000,00000000,?,?,?,?,?,?), ref: 00D8E040
gdi_RgnToRect.GETSCREEN-156413884-X86(?,?,?,?,?), ref: 00D8E04F
gdi_CRgnToRect.GETSCREEN-156413884-X86(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00D8E062
gdi_RgnToRect.GETSCREEN-156413884-X86(?,?,?,?,?), ref: 00D8E0A3
gdi_CRgnToRect.GETSCREEN-156413884-X86(?,?,?,?,?,?,?,?,?,?), ref: 00D8E0C8
gdi_RectToCRgn.GETSCREEN-156413884-X86(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00D8E147

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Rectgdi_
String ID:
API String ID: 2404991910-0
Opcode ID: 65c5216e4ca2f334d45f2cd06848fd1547205e4cfa29124a99895a26d202aa1a
Instruction ID: 59c4b9f716e6fafceaa9a279b9c9673c2ddaf35ae519084c4ba5e651d87cacde
Opcode Fuzzy Hash: 65c5216e4ca2f334d45f2cd06848fd1547205e4cfa29124a99895a26d202aa1a
Instruction Fuzzy Hash: 0C51C072E01219EFCF14EF99C8858EEBBB9FF48710B14842AE515A7250D771AA41CFB0

Function 00D61D8F Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

freerdp_settings_set_uint32.GETSCREEN-156413884-X86(?,000007C0,?), ref: 00D61DA2
freerdp_settings_set_bool.GETSCREEN-156413884-X86(?,000007C8,00000001), ref: 00D61DCC
freerdp_settings_set_bool.GETSCREEN-156413884-X86(?,000007C8,00000000), ref: 00D61DE8
freerdp_settings_set_bool.GETSCREEN-156413884-X86(?,000007C9,00000000), ref: 00D61DFC
freerdp_settings_set_bool.GETSCREEN-156413884-X86(?,000007C8,00000000), ref: 00D61E19
freerdp_settings_set_bool.GETSCREEN-156413884-X86(?,000007C9,00000000), ref: 00D61E2D

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: freerdp_settings_set_bool$freerdp_settings_set_uint32
String ID:
API String ID: 4272850885-0
Opcode ID: 3ea0a0162d7e9506aea58fcc0c8a3655e8c344f224c799a42870156a752d33d1
Instruction ID: feb49c3982a8684006756a8fdfe54064ca500717821cece9542d44e8f719cad9
Opcode Fuzzy Hash: 3ea0a0162d7e9506aea58fcc0c8a3655e8c344f224c799a42870156a752d33d1
Instruction Fuzzy Hash: 7A11D66EF8920277F96020654C82F6F129C8F62B59F5C0025FE08E51C3EA96EE0088F6

Function 00D88AF6 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 154COMMON

Download Yara Rule

APIs

freerdp_image_copy.GETSCREEN-156413884-X86(?,?,?,?,?,?,?,?,08008000,00000000,00000000,00000000,?,00000001,?,?), ref: 00D88C2B

Strings

freerdp_image_copy_from_icon_data, xrefs: 00D88DBA
C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\color.c, xrefs: 00D88DBF
1bpp and 4bpp icons are not supported, xrefs: 00D88DB5
com.freerdp.color, xrefs: 00D88D98

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: freerdp_image_copy
String ID: 1bpp and 4bpp icons are not supported$C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\color.c$com.freerdp.color$freerdp_image_copy_from_icon_data
API String ID: 1523062921-332027372
Opcode ID: f47f52faf731e1e0bcd6cd1c87dcbd4d30f769a5dc7a7d2c0dd584dfc727d97b
Instruction ID: 34ea53ca85ac2f1719ac225b7316df33585b6dcfc5fcce39badb4d22dfae884b
Opcode Fuzzy Hash: f47f52faf731e1e0bcd6cd1c87dcbd4d30f769a5dc7a7d2c0dd584dfc727d97b
Instruction Fuzzy Hash: 0851B5B1A0021DAEDF24AF15CD41BFA77A8EF14300F4881A9FE14A2191D7719E81DF74

Function 00DA8423 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 92COMMON

Download Yara Rule

Strings

monitor-list, xrefs: 00DA85E3
kbd-lang-list, xrefs: 00DA84D3
kbd-list, xrefs: 00DA84F5

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID:
String ID: kbd-lang-list$kbd-list$monitor-list
API String ID: 0-1393584692
Opcode ID: 4fd9e4ee0ffaca3aed8f3a2ee95e57f5b96aa7382adc5e00e085069b725a13b7
Instruction ID: 6e075998fd72a7b786a2918271cbd35609f93a4e6f0503c882ee7d8e1406be28
Opcode Fuzzy Hash: 4fd9e4ee0ffaca3aed8f3a2ee95e57f5b96aa7382adc5e00e085069b725a13b7
Instruction Fuzzy Hash: 9431A732901218ABDB20EB68DD46DDBB7ECEB05310F0841A5FD18A71D2DA70DE40EAF1

Function 00D79962 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 82COMMON

Download Yara Rule

Strings

com.freerdp.codec, xrefs: 00D79AD0
interleaved_compress: width (%u) or height (%u) is greater than 64, xrefs: 00D79AF0
C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\interleaved.c, xrefs: 00D79AFA
interleaved_compress, xrefs: 00D79AF5

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID:
String ID: C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\interleaved.c$com.freerdp.codec$interleaved_compress$interleaved_compress: width (%u) or height (%u) is greater than 64
API String ID: 0-4054760794
Opcode ID: d85437afc43ce44ab5132420aab3533f95c215e4be3900ba6292be4bf386adf8
Instruction ID: b9cf6b2ac3b1e1ba26c8d4c733676cf33304a4dcd19a13ac3aa60de0457c31dc
Opcode Fuzzy Hash: d85437afc43ce44ab5132420aab3533f95c215e4be3900ba6292be4bf386adf8
Instruction Fuzzy Hash: E521C273341209BFEF255E56DC96FAB7B68EB05754F088119FA08661A0F672EC50CB70

Function 00DAE492 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 80COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB3CC8

Strings

C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB3D2D, 00DB3D6C
sspi_InitializeSecurityContextW, xrefs: 00DB3D28, 00DB3D60, 00DB3D65, 00DB3D6B
[%s]: Security module does not provide an implementation, xrefs: 00DB3D66
InitializeSecurityContextW: %s (0x%08X), xrefs: 00DB3D23

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$InitializeSecurityContextW: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_InitializeSecurityContextW
API String ID: 689400697-743139187
Opcode ID: b3b805675f9222908816f167d5fb7b1162adb8a8f0cdaea20a55787a871de2c8
Instruction ID: c61b74a6778c36063c0bb2a1ffa8d1edb47d65641b055684fbe2395195ff3fc3
Opcode Fuzzy Hash: b3b805675f9222908816f167d5fb7b1162adb8a8f0cdaea20a55787a871de2c8
Instruction Fuzzy Hash: C221A536280244FBEF225E96DC02EEB3F69EB55B54F040154FA04660E1DA62DA60FBB1

Function 00DAE489 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 80COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB3DA3

Strings

C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB3E08, 00DB3E47
sspi_InitializeSecurityContextA, xrefs: 00DB3E03, 00DB3E3B, 00DB3E40, 00DB3E46
InitializeSecurityContextA: %s (0x%08X), xrefs: 00DB3DFE
[%s]: Security module does not provide an implementation, xrefs: 00DB3E41

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$InitializeSecurityContextA: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_InitializeSecurityContextA
API String ID: 689400697-1744466472
Opcode ID: 2eea3a3e51f6079cc079a12b7f81ffe647e431201094f2e9324180b18d59b907
Instruction ID: 0db3efcb9d8d3e86031f11ffc3e329e15d9f953f7646301bfee65671ced8692d
Opcode Fuzzy Hash: 2eea3a3e51f6079cc079a12b7f81ffe647e431201094f2e9324180b18d59b907
Instruction Fuzzy Hash: C421C336240204FBEF225E96EC02EEB3F69EB45B54F040154FA44650E1D672DA21FB70

Function 00DAE413 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 77COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB3227

Strings

sspi_AcquireCredentialsHandleW, xrefs: 00DB327E, 00DB32B6, 00DB32BB, 00DB32C1
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB3283, 00DB32C2
AcquireCredentialsHandleW: %s (0x%08X), xrefs: 00DB3279
[%s]: Security module does not provide an implementation, xrefs: 00DB32BC

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: AcquireCredentialsHandleW: %s (0x%08X)$C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$[%s]: Security module does not provide an implementation$sspi_AcquireCredentialsHandleW
API String ID: 689400697-2657764935
Opcode ID: 3608575d8dcd4481cd5f3055395dec5de9a26248fa144b46edfc1a51ccdbaf8e
Instruction ID: fdcda2abf87abb33374589a7c2a86917b64a7dd425e847e6d722d69d0728af92
Opcode Fuzzy Hash: 3608575d8dcd4481cd5f3055395dec5de9a26248fa144b46edfc1a51ccdbaf8e
Instruction Fuzzy Hash: 3A11E432684305FBEF221E56EC07EAB3B69EB55B14F040094FA01A50E1D572DA20F7B5

Function 00DAE40A Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 77COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB32F9

Strings

AcquireCredentialsHandleA: %s (0x%08X), xrefs: 00DB334B
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB3355, 00DB3394
[%s]: Security module does not provide an implementation, xrefs: 00DB338E
sspi_AcquireCredentialsHandleA, xrefs: 00DB3350, 00DB3388, 00DB338D, 00DB3393

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: AcquireCredentialsHandleA: %s (0x%08X)$C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$[%s]: Security module does not provide an implementation$sspi_AcquireCredentialsHandleA
API String ID: 689400697-1172745827
Opcode ID: ee8330f766247ef7580ab77b56b9b2ac2045816d24b17fa03d64e72467238a28
Instruction ID: 10bf43b068e49bd497b97c3fcc99fe516e99f4f27280dc1cfd64e8af1dd408c8
Opcode Fuzzy Hash: ee8330f766247ef7580ab77b56b9b2ac2045816d24b17fa03d64e72467238a28
Instruction Fuzzy Hash: 3611A536344205FBEF222E569C06EAB3FA9EB45B54F040054FA04651E1DA62D920F7B1

Function 00DAE401 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 77COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB384E

Strings

C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB38AA, 00DB38E9
[%s]: Security module does not provide an implementation, xrefs: 00DB38E3
sspi_AcceptSecurityContext, xrefs: 00DB38A5, 00DB38DD, 00DB38E2, 00DB38E8
AcceptSecurityContext: %s (0x%08X), xrefs: 00DB38A0

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: AcceptSecurityContext: %s (0x%08X)$C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$[%s]: Security module does not provide an implementation$sspi_AcceptSecurityContext
API String ID: 689400697-2008077614
Opcode ID: ccefbb1fe2f2e385423ef8aa5d2334f9ed660c910b16205ec69a1fc16b740488
Instruction ID: 99fe409885ad976f5129006e109f3b164fdba013604cc5fdb1efff9062ed6bc5
Opcode Fuzzy Hash: ccefbb1fe2f2e385423ef8aa5d2334f9ed660c910b16205ec69a1fc16b740488
Instruction Fuzzy Hash: 6311D636240204FBEF225E56EC07EAB3F69EB55B54F040055FA00A51E1D966CA21FBB1

Function 00DAE4FE Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB4544

Strings

C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB4591, 00DB45D0
[%s]: Security module does not provide an implementation, xrefs: 00DB45CA
sspi_VerifySignature, xrefs: 00DB458C, 00DB45C4, 00DB45C9, 00DB45CF
VerifySignature: %s (0x%08X), xrefs: 00DB4587

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$VerifySignature: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_VerifySignature
API String ID: 689400697-1495805676
Opcode ID: 307cbb9edf8a4ebff92783441eab19cdcaf0d103a63b8c2a8886c8410c94a2fc
Instruction ID: 98b3351dc559f1c5d86aee85d2f7a1c82c6d7f02ad04834b08163a97289a2162
Opcode Fuzzy Hash: 307cbb9edf8a4ebff92783441eab19cdcaf0d103a63b8c2a8886c8410c94a2fc
Instruction Fuzzy Hash: CC11E775384704BBEA31AA56EC07FA73BACDB51B50F040054FA01A61E2D9A2CD10E775

Function 00DAE4F5 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB40BB

Strings

C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB4108, 00DB4147
sspi_SetContextAttributesW, xrefs: 00DB4103, 00DB413B, 00DB4140, 00DB4146
[%s]: Security module does not provide an implementation, xrefs: 00DB4141
SetContextAttributesW: %s (0x%08X), xrefs: 00DB40FE

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$SetContextAttributesW: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_SetContextAttributesW
API String ID: 689400697-247170817
Opcode ID: 8fbfbfd4e0a825d081d4a12aba37a5dfaa4f6f380db60e38efc816a182c25d0a
Instruction ID: cb79550c6f617bfaa4b7ce11790babc97080b350c82d278fcca72b1439d18cd1
Opcode Fuzzy Hash: 8fbfbfd4e0a825d081d4a12aba37a5dfaa4f6f380db60e38efc816a182c25d0a
Instruction Fuzzy Hash: 98110A36784305FBEA22AA5AEC03EAB3F6CEB91B60F044054F941A60D2D966CD50E771

Function 00DAE4EC Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB417E

Strings

SetContextAttributesA: %s (0x%08X), xrefs: 00DB41C1
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB41CB, 00DB420A
[%s]: Security module does not provide an implementation, xrefs: 00DB4204
sspi_SetContextAttributesA, xrefs: 00DB41C6, 00DB41FE, 00DB4203, 00DB4209

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$SetContextAttributesA: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_SetContextAttributesA
API String ID: 689400697-1164902870
Opcode ID: bea88b7b22939bf934497e077808359eb8e6a2e0534cb70cd60e5d03e430364e
Instruction ID: a8904db56472dead351d7abe508bd6a5f4a1bfb2fc1115e403d61f3f2f8bcc4f
Opcode Fuzzy Hash: bea88b7b22939bf934497e077808359eb8e6a2e0534cb70cd60e5d03e430364e
Instruction Fuzzy Hash: 32110D39784305FBEA31AA56EC03E673F6CDB51B60F040054F901A50D3D962CA50E771

Function 00DAE49B Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB4481

Strings

sspi_MakeSignature, xrefs: 00DB44C9, 00DB4501, 00DB4506, 00DB450C
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB44CE, 00DB450D
MakeSignature: %s (0x%08X), xrefs: 00DB44C4
[%s]: Security module does not provide an implementation, xrefs: 00DB4507

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$MakeSignature: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_MakeSignature
API String ID: 689400697-3834539683
Opcode ID: 8fff4197dd1dac2a00c8d5ad8cbb4b930f8cb7b9d9af8445e52f2d71828b2080
Instruction ID: 9c96ad772089bde2f9169dc48410110a3975094eacd190773c5293c4526f8a76
Opcode Fuzzy Hash: 8fff4197dd1dac2a00c8d5ad8cbb4b930f8cb7b9d9af8445e52f2d71828b2080
Instruction Fuzzy Hash: F111E775380304FBEA316A56AC03FAB3B6CDB81B60F044054FA01A65E3D9A2CD20E771

Function 00DAE452 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB33CB

Strings

sspi_ExportSecurityContext, xrefs: 00DB3413, 00DB344B, 00DB3450, 00DB3456
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB3418, 00DB3457
[%s]: Security module does not provide an implementation, xrefs: 00DB3451
ExportSecurityContext: %s (0x%08X), xrefs: 00DB340E

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$ExportSecurityContext: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_ExportSecurityContext
API String ID: 689400697-3640258815
Opcode ID: 080f00bc6b52f8b4c90e95ccc08b55ec7e2501dc662a57880aaafce68d5d65f2
Instruction ID: 4f57cd32bab2273443919f188ac44c2e473d00e22c2901cb0347818e3de2850a
Opcode Fuzzy Hash: 080f00bc6b52f8b4c90e95ccc08b55ec7e2501dc662a57880aaafce68d5d65f2
Instruction Fuzzy Hash: 4111E735384304FAEB221A56EC07FA73B6CEB91B54F040064FA41A70E1D962DA10F771

Function 00DAE476 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB3548

Strings

sspi_ImportSecurityContextW, xrefs: 00DB3590, 00DB35C8, 00DB35CD, 00DB35D3
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB3595, 00DB35D4
[%s]: Security module does not provide an implementation, xrefs: 00DB35CE
ImportSecurityContextW: %s (0x%08X), xrefs: 00DB358B

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$ImportSecurityContextW: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_ImportSecurityContextW
API String ID: 689400697-3257054040
Opcode ID: deb4a1c2086ca34d2869eebd00ccf5e504d8730b312efbf1b265f6d338d2c72d
Instruction ID: 64977588999548d6247546f1d7fe72f77c10104e888ea0dbd4ce5c53f87dddd8
Opcode Fuzzy Hash: deb4a1c2086ca34d2869eebd00ccf5e504d8730b312efbf1b265f6d338d2c72d
Instruction Fuzzy Hash: 77119435384305BAEA315E56EC07FA73BADEB51B54F040054FA01A61D1E9A2DA10F775

Function 00DAE46D Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB360B

Strings

C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB3658, 00DB3697
sspi_ImportSecurityContextA, xrefs: 00DB3653, 00DB368B, 00DB3690, 00DB3696
[%s]: Security module does not provide an implementation, xrefs: 00DB3691
ImportSecurityContextA: %s (0x%08X), xrefs: 00DB364E

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$ImportSecurityContextA: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_ImportSecurityContextA
API String ID: 689400697-848437295
Opcode ID: 633087edfde2f68bb47261b14267e125a5daf245b454dbb2927d5e57ae45b585
Instruction ID: d7a1cdd970deefc0b9ba524ce1c3a78a833dc5445281ec20ed0ccf819f42b62e
Opcode Fuzzy Hash: 633087edfde2f68bb47261b14267e125a5daf245b454dbb2927d5e57ae45b585
Instruction Fuzzy Hash: 73110A35380304FAEB325A56EC07FAB3B6CDB51B64F040054F941A61E1D9A2DA11F7B5

Function 00D81A7D Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 71COMMON

Download Yara Rule

APIs

ncrush_context_reset.GETSCREEN-156413884-X86(00000000,00000000), ref: 00D81B36

Strings

com.freerdp.codec, xrefs: 00D81AF1
ncrush_context_new, xrefs: 00D81B14
ncrush_context_new: failed to initialize tables, xrefs: 00D81B0F
C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\ncrush.c, xrefs: 00D81B19

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: ncrush_context_reset
String ID: C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\ncrush.c$com.freerdp.codec$ncrush_context_new$ncrush_context_new: failed to initialize tables
API String ID: 2838332675-904927664
Opcode ID: 5beb58443ae4acf6553ade6ffe48762b4b104013af54215ae2096fca8978c0e7
Instruction ID: 92ea939e86af608edb07a1b05139b89813acb907b2eb101fa3b390d080ead838
Opcode Fuzzy Hash: 5beb58443ae4acf6553ade6ffe48762b4b104013af54215ae2096fca8978c0e7
Instruction Fuzzy Hash: C01108723007067AE314BB15AC42FA7B7DCEB41754F20411DF608A66C1EBB2A951CBB0

Function 00DAE4BF Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 71COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB36CE

Strings

C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB3718, 00DB3757
QueryCredentialsAttributesW: %s (0x%08X), xrefs: 00DB370E
sspi_QueryCredentialsAttributesW, xrefs: 00DB3713, 00DB374B, 00DB3750, 00DB3756
[%s]: Security module does not provide an implementation, xrefs: 00DB3751

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$QueryCredentialsAttributesW: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_QueryCredentialsAttributesW
API String ID: 689400697-3413647607
Opcode ID: e1f6dbac7b1aecb37c71ce92d399cd3bf0e4fa6a14009dd2e1820232b963d726
Instruction ID: 13d2b840c005fe16bd761178484a735cc88847a3272b82e0f65e5ccd2380754b
Opcode Fuzzy Hash: e1f6dbac7b1aecb37c71ce92d399cd3bf0e4fa6a14009dd2e1820232b963d726
Instruction Fuzzy Hash: 9E11E9B5384340FBEB215A56EC07FA73BACEB92B54F040094F941AA1E1DDA2DA11F771

Function 00DAE4B6 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 71COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB378E

Strings

C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB37D8, 00DB3817
[%s]: Security module does not provide an implementation, xrefs: 00DB3811
sspi_QueryCredentialsAttributesA, xrefs: 00DB37D3, 00DB380B, 00DB3810, 00DB3816
QueryCredentialsAttributesA: %s (0x%08X), xrefs: 00DB37CE

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$QueryCredentialsAttributesA: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_QueryCredentialsAttributesA
API String ID: 689400697-3754301720
Opcode ID: f8d11526cb3e0c97667efc20a61aa2108bb6d5ed5f4ab4bd00d595dca7856f30
Instruction ID: c806a74fe92bc68c6fdc9ab5d333bd96d2b614cf75e6c15e968bcfe6459788ff
Opcode Fuzzy Hash: f8d11526cb3e0c97667efc20a61aa2108bb6d5ed5f4ab4bd00d595dca7856f30
Instruction Fuzzy Hash: DA110A75380341FAEA211756EC07EA73B6CEB51B54F0400A4F940A61D1DD62DA11F7B1

Function 00DAE4AD Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 71COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB3E7E

Strings

sspi_QueryContextAttributesW, xrefs: 00DB3EC3, 00DB3EFB, 00DB3F00, 00DB3F06
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB3EC8, 00DB3F07
QueryContextAttributesW: %s (0x%08X), xrefs: 00DB3EBE
[%s]: Security module does not provide an implementation, xrefs: 00DB3F01

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$QueryContextAttributesW: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_QueryContextAttributesW
API String ID: 689400697-2578917824
Opcode ID: 38f2a77e898e7e163c11fdc0bfcc9f65d14a511f9a656ed72ba8f386fba3ff76
Instruction ID: 10bcb6ab69531a0aca6f23e91eebb113bf73fc2f975c91fca904e8748798339a
Opcode Fuzzy Hash: 38f2a77e898e7e163c11fdc0bfcc9f65d14a511f9a656ed72ba8f386fba3ff76
Instruction Fuzzy Hash: BB110636384300FBEA325A56EC03FAB3B6CEB95F64F040155F901A60D1D962DA11F771

Function 00DAE4A4 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 71COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB3F3E

Strings

sspi_QueryContextAttributesA, xrefs: 00DB3F83, 00DB3FBB, 00DB3FC0, 00DB3FC6
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB3F88, 00DB3FC7
QueryContextAttributesA: %s (0x%08X), xrefs: 00DB3F7E
[%s]: Security module does not provide an implementation, xrefs: 00DB3FC1

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$QueryContextAttributesA: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_QueryContextAttributesA
API String ID: 689400697-3211427146
Opcode ID: b1dc4295e170f856977553b8e1e652cf5c0624be3037165d26d98fe6798714de
Instruction ID: d7056a98cee6e8cbd47c9d80d97d890a5378d7e7efe5ff176d0a28d55d5a0a86
Opcode Fuzzy Hash: b1dc4295e170f856977553b8e1e652cf5c0624be3037165d26d98fe6798714de
Instruction Fuzzy Hash: EB11C135784301FAEA226A56EC03EBB3F6DEB95B60F040094F940A60D1D9B2DA10A771

Function 00DAE4DA Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB30AD

Strings

C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB30F4, 00DB3133
sspi_QuerySecurityPackageInfoW, xrefs: 00DB30EF, 00DB3127, 00DB312C, 00DB3132
[%s]: Security module does not provide an implementation, xrefs: 00DB312D
QuerySecurityPackageInfoW: %s (0x%08X), xrefs: 00DB30EA

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$QuerySecurityPackageInfoW: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_QuerySecurityPackageInfoW
API String ID: 689400697-2261828479
Opcode ID: 479954bcacd58462f064905597a1cf0662988a32b5ebacc39d15cd97721b4f16
Instruction ID: 29b1fd94e8362ca86afcf5ca7f755991f49405afd8851eb643728b2e683139ba
Opcode Fuzzy Hash: 479954bcacd58462f064905597a1cf0662988a32b5ebacc39d15cd97721b4f16
Instruction Fuzzy Hash: 3011E535388301BAEA31665AEC07FA73BACDB92F64F040094F905A61D1D9A2DA10F7B1

Function 00DAE4D1 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB316A

Strings

C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB31B1, 00DB31F0
QuerySecurityPackageInfoA: %s (0x%08X), xrefs: 00DB31A7
sspi_QuerySecurityPackageInfoA, xrefs: 00DB31AC, 00DB31E4, 00DB31E9, 00DB31EF
[%s]: Security module does not provide an implementation, xrefs: 00DB31EA

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$QuerySecurityPackageInfoA: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_QuerySecurityPackageInfoA
API String ID: 689400697-3351603741
Opcode ID: 3fdb74aa583da4b10fa1f679e6d3788faae2f47ce1203347492f9f2a37764dc1
Instruction ID: d61e4e64d0efc07c5fd5e13082f808007015ab2ba8af43fcf7caf4042f5f9962
Opcode Fuzzy Hash: 3fdb74aa583da4b10fa1f679e6d3788faae2f47ce1203347492f9f2a37764dc1
Instruction Fuzzy Hash: 4711E935784305BAEA31265AEC07FA73F6CDB92B50F0400A4F941A61D2DAA2DA10F7B1

Function 00DAE4C8 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB3FFE

Strings

QuerySecurityContextToken: %s (0x%08X), xrefs: 00DB403B
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB4045, 00DB4084
[%s]: Security module does not provide an implementation, xrefs: 00DB407E
sspi_QuerySecurityContextToken, xrefs: 00DB4040, 00DB4078, 00DB407D, 00DB4083

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$QuerySecurityContextToken: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_QuerySecurityContextToken
API String ID: 689400697-2156878011
Opcode ID: a4ff2916a27b452caa9e82b9a34f3abf3892de5e0ce0fb46b0075721acc985c1
Instruction ID: 5c3d553feabd92e531ca834255a982a26fcb479e8932d6c676dc6d6db17decf7
Opcode Fuzzy Hash: a4ff2916a27b452caa9e82b9a34f3abf3892de5e0ce0fb46b0075721acc985c1
Instruction Fuzzy Hash: 75110C39384305FBE631B656EC07F673B6CDB91B64F040054F645A60D2D9A2D910E7B5

Function 00DAE449 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB2F33

Strings

C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB2F7A, 00DB2FB9
EnumerateSecurityPackagesW: %s (0x%08X), xrefs: 00DB2F70
[%s]: Security module does not provide an implementation, xrefs: 00DB2FB3
sspi_EnumerateSecurityPackagesW, xrefs: 00DB2F75, 00DB2FAD, 00DB2FB2, 00DB2FB8

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$EnumerateSecurityPackagesW: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_EnumerateSecurityPackagesW
API String ID: 689400697-255015424
Opcode ID: c7434e5d4cd3d8e42e0a2f4f77ac716c28d993c0389cc0c4fb20377075966082
Instruction ID: 5d03a45bc6d7432c2bb7df8efd4d2650badde5cfccf72cb24ac055a3a49876af
Opcode Fuzzy Hash: c7434e5d4cd3d8e42e0a2f4f77ac716c28d993c0389cc0c4fb20377075966082
Instruction Fuzzy Hash: 4011C636788305BAEA216657EC07FB73F6CDF95B60F040094F905A60E1D962D910E7B1

Function 00DAE440 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB2FF0

Strings

sspi_EnumerateSecurityPackagesA, xrefs: 00DB3032, 00DB306A, 00DB306F, 00DB3075
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB3037, 00DB3076
EnumerateSecurityPackagesA: %s (0x%08X), xrefs: 00DB302D
[%s]: Security module does not provide an implementation, xrefs: 00DB3070

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$EnumerateSecurityPackagesA: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_EnumerateSecurityPackagesA
API String ID: 689400697-1149382491
Opcode ID: ef5b085fc55fbc7905c4695608fa6360fce87cddd9d7b3805d02c5c29cec0183
Instruction ID: b5564198682657a00847c51bdac65331266f4ba04c0c0c793ac9b02a34d6acc2
Opcode Fuzzy Hash: ef5b085fc55fbc7905c4695608fa6360fce87cddd9d7b3805d02c5c29cec0183
Instruction Fuzzy Hash: C311C635784340BAE7312A5AEC07EAB3B6CDF92B64F0400D4F904A60D1D9A2DE10F7B1

Function 00DAE41C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB3920

Strings

C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB3967, 00DB39A6
ApplyControlToken: %s (0x%08X), xrefs: 00DB395D
[%s]: Security module does not provide an implementation, xrefs: 00DB39A0
sspi_ApplyControlToken, xrefs: 00DB3962, 00DB399A, 00DB399F, 00DB39A5

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: ApplyControlToken: %s (0x%08X)$C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$[%s]: Security module does not provide an implementation$sspi_ApplyControlToken
API String ID: 689400697-2845897268
Opcode ID: 686be234af18e3545d6e883262fb2a6769b4cbb9d40d24f308dc26010e85b475
Instruction ID: 21c72281ed06f16267e44013f8c90a35e8c5a5158f0ded67f7d1824354aa7ff3
Opcode Fuzzy Hash: 686be234af18e3545d6e883262fb2a6769b4cbb9d40d24f308dc26010e85b475
Instruction Fuzzy Hash: AD11E935384300FBEE21265AEC07EA73F6CDB91BA4F040168F540A60D1D9A2CE10FBB5

Function 00DAE425 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB39DD

Strings

sspi_CompleteAuthToken, xrefs: 00DB3A1F, 00DB3A57, 00DB3A5C, 00DB3A62
CompleteAuthToken: %s (0x%08X), xrefs: 00DB3A1A
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB3A24, 00DB3A63
[%s]: Security module does not provide an implementation, xrefs: 00DB3A5D

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$CompleteAuthToken: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_CompleteAuthToken
API String ID: 689400697-1972714555
Opcode ID: 02e07b05f845aaddfe4f1da853e31e7959541ef7989d2cd1f2d1e2a11ca649c4
Instruction ID: 4aa0f167b85b42ca8ff6b14526edbca7b413c4a4e50f33d463af29e609189d2b
Opcode Fuzzy Hash: 02e07b05f845aaddfe4f1da853e31e7959541ef7989d2cd1f2d1e2a11ca649c4
Instruction Fuzzy Hash: 29118635384301FBEA216656EC07E673B6CDB91F54F140164F541A61D1D9A2DA10F6B1

Function 00D8954D Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

freerdp_image_copy.GETSCREEN-156413884-X86(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00D895B5

Strings

C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\color.c, xrefs: 00D895F0
com.freerdp.color, xrefs: 00D895C8
SmartScaling requested but compiled without libcairo support!, xrefs: 00D895E6
freerdp_image_scale, xrefs: 00D895EB

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: freerdp_image_copy
String ID: C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\color.c$SmartScaling requested but compiled without libcairo support!$com.freerdp.color$freerdp_image_scale
API String ID: 1523062921-212429655
Opcode ID: 7670fec4113b2f21ce419415567660a2b9db773eb64ea27869a9fbb05041631b
Instruction ID: 34f3b93c13310a42f0bb55862021cc83e53feddc6b80ddd4d5050efdda4ab531
Opcode Fuzzy Hash: 7670fec4113b2f21ce419415567660a2b9db773eb64ea27869a9fbb05041631b
Instruction Fuzzy Hash: 6021D67224020DBBDF15AF14DC12FBE3BA9EB14700F485105FD04A61A0E372E951DF60

Function 00DAE4E3 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 69COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB4241

Strings

RevertSecurityContext: %s (0x%08X), xrefs: 00DB427B
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB4285, 00DB42C4
sspi_RevertSecurityContext, xrefs: 00DB4280, 00DB42B8, 00DB42BD, 00DB42C3
[%s]: Security module does not provide an implementation, xrefs: 00DB42BE

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$RevertSecurityContext: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_RevertSecurityContext
API String ID: 689400697-954186549
Opcode ID: bfa845a104817d139d4c298e76ab31afdcbcdfc91bf428712e5623bfed8f384b
Instruction ID: 74c60c9320d5f8ff0b8a1f62143b0aea4e7ceda483665ebc893f2b28e7659466
Opcode Fuzzy Hash: bfa845a104817d139d4c298e76ab31afdcbcdfc91bf428712e5623bfed8f384b
Instruction Fuzzy Hash: 3E11C275384300BAEA216656BC07FA73B5CDB91B64F0400A5F900A60D2D9A2DA10F6B9

Function 00DAE45B Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 69COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB3B54

Strings

C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB3B98, 00DB3BD7
sspi_FreeContextBuffer, xrefs: 00DB3B93, 00DB3BCB, 00DB3BD0, 00DB3BD6
FreeContextBuffer: %s (0x%08X), xrefs: 00DB3B8E
[%s]: Security module does not provide an implementation, xrefs: 00DB3BD1

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$FreeContextBuffer: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_FreeContextBuffer
API String ID: 689400697-1791514552
Opcode ID: 5c63f8e7fcc6626b28fe669cc521de06139d53c88114aee292fa02794c0f3f99
Instruction ID: 44c1f1793e30786f5d6c551bd1b94906e2b077dec11e737fb184aaaadc32a0fb
Opcode Fuzzy Hash: 5c63f8e7fcc6626b28fe669cc521de06139d53c88114aee292fa02794c0f3f99
Instruction Fuzzy Hash: 8711A535384301BBEA212656EC07EA73B5CDB92B54F0400A4F941AA1D1EDA2DA10B7B9

Function 00DAE464 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 69COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB3C0E

Strings

C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB3C52, 00DB3C91
ImpersonateSecurityContext: %s (0x%08X), xrefs: 00DB3C48
[%s]: Security module does not provide an implementation, xrefs: 00DB3C8B
sspi_ImpersonateSecurityContext, xrefs: 00DB3C4D, 00DB3C85, 00DB3C8A, 00DB3C90

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$ImpersonateSecurityContext: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_ImpersonateSecurityContext
API String ID: 689400697-4242683877
Opcode ID: 871fc2bbcf2c46159d6b0661d6b2b5a7a44a5fe97f004d292dc4e7985ec164f0
Instruction ID: 431a5f2e896169f4d81a2cf06e9a7c7cdcb26d05f3dafb39bb01086e9fd13225
Opcode Fuzzy Hash: 871fc2bbcf2c46159d6b0661d6b2b5a7a44a5fe97f004d292dc4e7985ec164f0
Instruction Fuzzy Hash: D611C835384300FBE6212656EC07FA73F5CDB92F50F0401A4F941A61E2D992DB11F6B5

Function 00DAE510 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 69COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB348E

Strings

C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB34D2, 00DB3511
sspi_FreeCredentialsHandle, xrefs: 00DB34CD, 00DB3505, 00DB350A, 00DB3510
FreeCredentialsHandle: %s (0x%08X), xrefs: 00DB34C8
[%s]: Security module does not provide an implementation, xrefs: 00DB350B

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$FreeCredentialsHandle: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_FreeCredentialsHandle
API String ID: 689400697-3116451197
Opcode ID: 1409ef787062f5453defe90b9ba9f8e1a566c10a8ac02463e99c8e07e4509588
Instruction ID: 3b941353c5ec6e0560fe93aa40b6b9c04dfcf444844c52fe4f49971b83152074
Opcode Fuzzy Hash: 1409ef787062f5453defe90b9ba9f8e1a566c10a8ac02463e99c8e07e4509588
Instruction Fuzzy Hash: 01110835384301FAEA322626EC07F673B9CDB92B54F0440A4F545A60D1D992DE50F6B5

Function 00DAE507 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 69COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010670C8,00DB4AA1,00000000,00000000), ref: 00DB3A9A

Strings

C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00DB3ADE, 00DB3B1D
sspi_DeleteSecurityContext, xrefs: 00DB3AD9, 00DB3B11, 00DB3B16, 00DB3B1C
DeleteSecurityContext: %s (0x%08X), xrefs: 00DB3AD4
[%s]: Security module does not provide an implementation, xrefs: 00DB3B17

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$DeleteSecurityContext: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_DeleteSecurityContext
API String ID: 689400697-4185332897
Opcode ID: 42d94eeae4b5b9a598ea7349f333e4a0021de697c8b6a4960d89686d9679c88a
Instruction ID: 1efd685cf09d506ea53561d1de4bdd83493ca27a540bc868c24e2d4f69ed7731
Opcode Fuzzy Hash: 42d94eeae4b5b9a598ea7349f333e4a0021de697c8b6a4960d89686d9679c88a
Instruction Fuzzy Hash: 0511E535784300FAE632665AEC07FA73B5CDB92B54F040168F944E60E1D992DA11B6B5

Function 00E365C5 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 52COMMON

Download Yara Rule

APIs

primitives_get.GETSCREEN-156413884-X86 ref: 00E365CB

Strings

com.freerdp.codec, xrefs: 00E3660B
C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\yuv.c, xrefs: 00E36633
yuv_process_work_callback, xrefs: 00E3662E
error when decoding lines, xrefs: 00E36629

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: primitives_get
String ID: C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\yuv.c$com.freerdp.codec$error when decoding lines$yuv_process_work_callback
API String ID: 2017034601-2620645302
Opcode ID: 5f235f30597290e64c0b663bf6157f4d58c2ee7ca260f72bdd303ace9b5944de
Instruction ID: 0658d8e2b553374ff7192685a6f3cd1725393b054ec1ee39a915d34824c9b826
Opcode Fuzzy Hash: 5f235f30597290e64c0b663bf6157f4d58c2ee7ca260f72bdd303ace9b5944de
Instruction Fuzzy Hash: CB0196B1600306BFDB14DF64DC02F5A7BA8FF06718F004159F904EA281EAB5E940CBB5

Function 00D89EF7 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

region16_extents.GETSCREEN-156413884-X86(?), ref: 00D89F06
region16_extents.GETSCREEN-156413884-X86(?,?), ref: 00D89F12
region16_n_rects.GETSCREEN-156413884-X86(?,?,?), ref: 00D89F1D
region16_n_rects.GETSCREEN-156413884-X86(?), ref: 00D89F7D

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: region16_extentsregion16_n_rects
String ID:
API String ID: 2062899502-0
Opcode ID: a777aa3e440b79e1151d2e5a78892d79e860e14bb9abc1479bfd8844a7d2d6d9
Instruction ID: 0117f150602412b3be55513778fe053282ae775071e97130aba6e26abd5f369b
Opcode Fuzzy Hash: a777aa3e440b79e1151d2e5a78892d79e860e14bb9abc1479bfd8844a7d2d6d9
Instruction Fuzzy Hash: 87512875A0022AABCB14DF99C8408BEF7F5FF18310B15816AE859E7250E335AE40CBB4

Function 007A8E40 Relevance: 7.6, APIs: 5, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(00FE1278,007A8C90,007A8EC0,00000000), ref: 007A8E6A
GetLastError.KERNEL32 ref: 007A8E7F
TlsGetValue.KERNEL32 ref: 007A8E8D
SetLastError.KERNEL32(00000000), ref: 007A8E96
TlsAlloc.KERNEL32 ref: 007A8EC3

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: ErrorLastOnce$AllocExecuteInitValue
String ID:
API String ID: 2822033501-0
Opcode ID: db51f4c6e5405456cf08b14f38c2e0a05b43aaba6587951bfd86496e2d2758e3
Instruction ID: df1ea4469e373195183c178e20251ef794ba4659a3b25d75efd74e0968f767a5
Opcode Fuzzy Hash: db51f4c6e5405456cf08b14f38c2e0a05b43aaba6587951bfd86496e2d2758e3
Instruction Fuzzy Hash: 6301C87960020C9FCB009FB6EC49B6E77B8FB46B11B404225F915E7290EB3099088B61

Function 00E349E4 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 80COMMON

Download Yara Rule

APIs

audio_format_print.GETSCREEN-156413884-X86(?,?,?), ref: 00E34A72

Strings

C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\audio.c, xrefs: 00E34A1C, 00E34A59, 00E34A9A
AUDIO_FORMATS (%hu) ={, xrefs: 00E34A12
audio_formats_print, xrefs: 00E34A17, 00E34A54, 00E34A95

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: audio_format_print
String ID: AUDIO_FORMATS (%hu) ={$C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\audio.c$audio_formats_print
API String ID: 2744001552-3527835062
Opcode ID: 190b4eed6e8eb1bfef3c354a6c4be8922e1d4cc71d4c945d923ffda63c261f84
Instruction ID: b78a942341c6e3ef25444726e57ef43ec42734cb83659480e3f1fbda42139c21
Opcode Fuzzy Hash: 190b4eed6e8eb1bfef3c354a6c4be8922e1d4cc71d4c945d923ffda63c261f84
Instruction Fuzzy Hash: 9511B4B228031536DB11AE155C46FAF2F9CDF63B64F040015FD14B21C2F6A1E601D2BB

Function 00D311D7 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

getChannelError.GETSCREEN-156413884-X86(?), ref: 00D31248

Strings

ChannelDetached, xrefs: 00D3127F
freerdp, xrefs: 00D31278
(, xrefs: 00D31295

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: ChannelError
String ID: ($ChannelDetached$freerdp
API String ID: 1163697128-436519898
Opcode ID: d41152332e34c1132b17fc4ebc57e4b237890b6d19fcfe298640a9fb059c40de
Instruction ID: fc80bfe549b8597e74f5623f85120fd146f05f3c631305c3a6c06a9ddc4a1d40
Opcode Fuzzy Hash: d41152332e34c1132b17fc4ebc57e4b237890b6d19fcfe298640a9fb059c40de
Instruction Fuzzy Hash: 7C212C75A00209EFDB10DF98C885FAEBBF9FF08344F144469E944EB251D770AA549BA0

Function 00D30B41 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

getChannelError.GETSCREEN-156413884-X86(?), ref: 00D30BB2

Strings

freerdp, xrefs: 00D30BE2
ChannelAttached, xrefs: 00D30BE9
(, xrefs: 00D30BFF

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: ChannelError
String ID: ($ChannelAttached$freerdp
API String ID: 1163697128-2646891115
Opcode ID: 068b98a21e688adcc1a7a8ef4bb56f7f67ea8c15b542e4d7e67dc6f7d4de20b9
Instruction ID: f91ad36d8a6de8015f64d295c82b2d5ed3997809a739205efbd6b358ca96a36e
Opcode Fuzzy Hash: 068b98a21e688adcc1a7a8ef4bb56f7f67ea8c15b542e4d7e67dc6f7d4de20b9
Instruction Fuzzy Hash: 82210C71A00209EFDF14DF98C885FAEBBF9FF08344F1445A9E944A7252D771AA509BA0

Function 00DA783A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 56COMMON

Download Yara Rule

Strings

audin, xrefs: 00DA78F8
rdpsnd, xrefs: 00DA78CA

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID:
String ID: audin$rdpsnd
API String ID: 0-930729200
Opcode ID: 6f8f7c70f85235a5e8cfa22d1d5172d6193b23b90d8a430442da5d604fd0f399
Instruction ID: f8d5fcc491c9a5b0804bee04886522f5f4ebedceeef8fc4138f87d240f1a78ee
Opcode Fuzzy Hash: 6f8f7c70f85235a5e8cfa22d1d5172d6193b23b90d8a430442da5d604fd0f399
Instruction Fuzzy Hash: 8D116071A09E16ABDB24CF34CC806AAF3A4FB06B41F19422AE45853140D730A990CBF2

Function 00E34701 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

audio_format_get_tag_string.GETSCREEN-156413884-X86(?,?,?,?,?,?,?,?), ref: 00E34737

Strings

audio_format_print, xrefs: 00E34743
C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\audio.c, xrefs: 00E34748
%s: wFormatTag: 0x%04hX nChannels: %hu nSamplesPerSec: %u nAvgBytesPerSec: %u nBlockAlign: %hu wBitsPerSample: %hu cbSize: %hu, xrefs: 00E3473E

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: audio_format_get_tag_string
String ID: %s: wFormatTag: 0x%04hX nChannels: %hu nSamplesPerSec: %u nAvgBytesPerSec: %u nBlockAlign: %hu wBitsPerSample: %hu cbSize: %hu$C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\audio.c$audio_format_print
API String ID: 2866491501-3564663344
Opcode ID: c52e0dd6431addf09f15b8af9c1846588221c8247c802d37eaa2d35c0adcb67b
Instruction ID: c2d6e60e98c7b835152735da8c56021c325244e8a3b4f5dbb22e345a41e2b73d
Opcode Fuzzy Hash: c52e0dd6431addf09f15b8af9c1846588221c8247c802d37eaa2d35c0adcb67b
Instruction Fuzzy Hash: 00F030B6140308BADB411F51CC02E763B6DEB49B14F248089FD5C9C1D2E677D9A2E775

Function 00D22713 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

freerdp_get_last_error.GETSCREEN-156413884-X86(?), ref: 00D22725
freerdp_set_last_error_ex.GETSCREEN-156413884-X86(?,0002000B,freerdp_abort_connect,C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\freerdp.c,0000013A), ref: 00D22745

Strings

freerdp_abort_connect, xrefs: 00D22739
C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\freerdp.c, xrefs: 00D22734

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: freerdp_get_last_errorfreerdp_set_last_error_ex
String ID: C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\freerdp.c$freerdp_abort_connect
API String ID: 3690923134-629580617
Opcode ID: 8b84df513927c2faf32e9f7b4c90c45f57ed35bad4788dd2aa2a229fc031dfbd
Instruction ID: 77cffd4ec60be4181f7003ad927b34deaf9b401c806ea308a7082c46035d468c
Opcode Fuzzy Hash: 8b84df513927c2faf32e9f7b4c90c45f57ed35bad4788dd2aa2a229fc031dfbd
Instruction Fuzzy Hash: 89E0D831244334FADA312D10FC02B65F794DF20B98F180425B9C476091E6625A52D5B0

Function 00E3632D Relevance: 6.2, APIs: 4, Instructions: 174COMMON

Download Yara Rule

APIs

primitives_get.GETSCREEN-156413884-X86 ref: 00E3633F
primitives_flags.GETSCREEN-156413884-X86(00000000), ref: 00E36353
TpWaitForWork.NTDLL(00000000,00000000), ref: 00E364A9
TpReleaseWork.NTDLL(00000000), ref: 00E364B2

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: Work$ReleaseWaitprimitives_flagsprimitives_get
String ID:
API String ID: 704174238-0
Opcode ID: 770e272acda34966134cf913e7d735ec8a6edee504f15f3f9643633075e34d19
Instruction ID: 2b7fc61857ff02761cc6b341b4245fba17855e57bcc136ed75aeafbd03bf2853
Opcode Fuzzy Hash: 770e272acda34966134cf913e7d735ec8a6edee504f15f3f9643633075e34d19
Instruction Fuzzy Hash: 706129B5A0060AEFCB04CF68C985AAEBBF5FF48310B14856AE815E7350D734E951CF90

Function 00D8C297 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

gdi_SetRgn.GETSCREEN-156413884-X86(?,?,?,?,00000000,00000001,?,?), ref: 00D8C324

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: gdi_
String ID:
API String ID: 2273374161-0
Opcode ID: 2ead09a44aba127efa6001147bae376ec00e50ab3ae76740fbfd5d3136eef1b6
Instruction ID: 865086a72daf1fc43b38fa515c4be89aa5b458284a2074a5c771625b1c1c0e67
Opcode Fuzzy Hash: 2ead09a44aba127efa6001147bae376ec00e50ab3ae76740fbfd5d3136eef1b6
Instruction Fuzzy Hash: F131B5B1910209EFCB10EF99C9859AEBBF9FF48310F14806AE915E7211D335EA45CBB0

Function 00DB5C02 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 00DB5C16
RtlLeaveCriticalSection.NTDLL(?), ref: 00DB5C34
RtlLeaveCriticalSection.NTDLL(?), ref: 00DB5C54
RtlLeaveCriticalSection.NTDLL(?), ref: 00DB5C9A

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: 2051ef1a389456390ea4a02a62146902d93c7182408f966d18c8a74e2836429c
Instruction ID: e38ed5523884334c0f83bde73e0370e7a495f8a60b77feac70ee047c77d25a78
Opcode Fuzzy Hash: 2051ef1a389456390ea4a02a62146902d93c7182408f966d18c8a74e2836429c
Instruction Fuzzy Hash: FD21AF75200B05EFDB208F15E980BA97BF5FB45321F144469F883A7294E770AD82CB60

Function 00E0B6E0 Relevance: 6.1, APIs: 4, Instructions: 66threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00E1F42C: GetLastError.KERNEL32(00000000,?,00E05FDD,00E1F0E3,?,?,00DAF77A,0000000C,?,?,?,?,00D227D2,?,?,?), ref: 00E1F581
Part of subcall function 00E1F42C: SetLastError.KERNEL32(00000000,00000006), ref: 00E1F623

CloseHandle.KERNEL32(?,?,?,00E0B817,?,?,00E0B689,00000000), ref: 00E0B711
FreeLibraryAndExitThread.KERNEL32(?,?,?,?,00E0B817,?,?,00E0B689,00000000), ref: 00E0B727
RtlExitUserThread.NTDLL(?,?,?,00E0B817,?,?,00E0B689,00000000), ref: 00E0B730
GetModuleHandleExW.KERNEL32(00000004,?,0000000C), ref: 00E0B76E

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: ErrorExitHandleLastThread$CloseFreeLibraryModuleUser
String ID:
API String ID: 1062721995-0
Opcode ID: 5fdca9eb63c1685f58f9aeef6c9b09c5ed7425e20f72609187b24c96ae3ccb29
Instruction ID: ba0cb5e9fc13dfc67c326608319cbcd06c7e4502fe827571840ed75a7e2226d9
Opcode Fuzzy Hash: 5fdca9eb63c1685f58f9aeef6c9b09c5ed7425e20f72609187b24c96ae3ccb29
Instruction Fuzzy Hash: E311E9B5500204AFC7209F66DC09E9A7BE8EFC0764F185226F925E72D0DB70DD85C690

Function 00D89BBD Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

region16_rects.GETSCREEN-156413884-X86(?,00000000), ref: 00D89BDC
region16_extents.GETSCREEN-156413884-X86(?), ref: 00D89BEC
rectangles_intersects.GETSCREEN-156413884-X86(00000000,?), ref: 00D89BF7

Part of subcall function 00D897FD: rectangles_intersection.GETSCREEN-156413884-X86(?,?,?), ref: 00D8980C

rectangles_intersects.GETSCREEN-156413884-X86(00000000,?), ref: 00D89C1A

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: rectangles_intersects$rectangles_intersectionregion16_extentsregion16_rects
String ID:
API String ID: 3854534691-0
Opcode ID: 3ae0e6e2282d69f6a29daa640538588f82f3507cb970e478017c8bd43d05d967
Instruction ID: 0575a324d9b2fa8be085287289a6ccd6c0cf7cd34b7bd0c6f810b4baa4b384e3
Opcode Fuzzy Hash: 3ae0e6e2282d69f6a29daa640538588f82f3507cb970e478017c8bd43d05d967
Instruction Fuzzy Hash: 02018833114219599B14BA95D8A167BE3DCDB40B65F1C401AFCD996040EB36EC41E3B4

Function 00DA1F3D Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

freerdp_new.GETSCREEN-156413884-X86 ref: 00DA1F56
freerdp_context_new.GETSCREEN-156413884-X86(00000000,00000000,?,?), ref: 00DA1FA4
freerdp_register_addin_provider.GETSCREEN-156413884-X86(?,00000000), ref: 00DA1FC7

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: freerdp_context_newfreerdp_newfreerdp_register_addin_provider
String ID:
API String ID: 3731710698-0
Opcode ID: 14ef670117846f8193ecc85148fcc9ed3a6c0848a3febb97312ddb2eef9b83d7
Instruction ID: e591f37dd9937fec0c38606d067f006661a19f183e342d3829314738e0e16862
Opcode Fuzzy Hash: 14ef670117846f8193ecc85148fcc9ed3a6c0848a3febb97312ddb2eef9b83d7
Instruction Fuzzy Hash: 41119E36604B126FC725AB66D801B96B7E9FF56324F14041DF85887281EB70E890CAB0

Function 00D36AF2 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 299COMMON

Download Yara Rule

APIs

freerdp_settings_free.GETSCREEN-156413884-X86(00000000), ref: 00D37326

Part of subcall function 00D37F9B: GetComputerNameExA.KERNEL32(00000000,?,?,00000000), ref: 00D37FCC
Part of subcall function 00D37F9B: freerdp_settings_set_string.GETSCREEN-156413884-X86(?,00000680,?), ref: 00D37FFC

freerdp_settings_set_string.GETSCREEN-156413884-X86(00000000,00000086,?), ref: 00D36D8C

Strings

C:\Windows\System32\mstscax.dll, xrefs: 00D36F3F

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: freerdp_settings_set_string$ComputerNamefreerdp_settings_free
String ID: C:\Windows\System32\mstscax.dll
API String ID: 2334115954-183970058
Opcode ID: e41935eb0da15cc3e54599b8196f18d55dcb7c3f5d736c93c7abc9bde74f5c42
Instruction ID: 86ab1a1b4ba1dff6552174a4c942266a7e98b54b4ac349927e52d19ead6dd3b1
Opcode Fuzzy Hash: e41935eb0da15cc3e54599b8196f18d55dcb7c3f5d736c93c7abc9bde74f5c42
Instruction Fuzzy Hash: 68E1C6B1505F009EE324DF38D885B97BBE4FF08311F50992EE5AE87391D7B5A5808B58

Function 00DB68CF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00000FA0,?,?,?,00DB6A0A,?,?,00000000,?,00DAE976,00000000), ref: 00DB697B

Strings

WLog_Appender_New, xrefs: 00DB68FE
%s: unknown handler type %u, xrefs: 00DB6903

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: %s: unknown handler type %u$WLog_Appender_New
API String ID: 2593887523-3466059274
Opcode ID: edd1ce3d46c7b373a171b8ea6b81a68c115e6608419e51f733cad571ce48b65e
Instruction ID: c5110ca0ada2ce926ef0bf8d43e1cd3b6f421ce4bc4164a16208b23e8d0b8fb4
Opcode Fuzzy Hash: edd1ce3d46c7b373a171b8ea6b81a68c115e6608419e51f733cad571ce48b65e
Instruction Fuzzy Hash: DF112536108301E68E323A799C4ADFF6B68DB42F30B180019F547A6192DE3CE8016D72

Function 00D23FD6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

Strings

DeviceServiceEntry, xrefs: 00D2419C
%s%s-client.%s, xrefs: 00D2415A

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID:
String ID: %s%s-client.%s$DeviceServiceEntry
API String ID: 0-2733899524
Opcode ID: f68c266c4dd2b2394af1b6ed1559e91e23b900a608bc5b1345aeada2deb7c655
Instruction ID: f7a36ce2ae6b223a27ec4c6182b0829b2dbd0397efc93a064b9640213c867174
Opcode Fuzzy Hash: f68c266c4dd2b2394af1b6ed1559e91e23b900a608bc5b1345aeada2deb7c655
Instruction Fuzzy Hash: 2011C872A003256BDB119F99D981AAF7BACDF50754F0C4019FD10D7241D770CE5187B0

Function 00D64029 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000080,00000000), ref: 00D64060
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00D64076

Strings

%s %hu %s %s %s, xrefs: 00D640FC

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: File$CreatePointer
String ID: %s %hu %s %s %s
API String ID: 2024441833-2916857029
Opcode ID: 33480d54ee1fc694bfc67d7ce4117a60aca3bc79cb853f8b12fd1bf61899e848
Instruction ID: b490dff442f3aeb5440e35ec35a8f1f2b186badf70c9bdda6671abf84705406f
Opcode Fuzzy Hash: 33480d54ee1fc694bfc67d7ce4117a60aca3bc79cb853f8b12fd1bf61899e848
Instruction Fuzzy Hash: A901D635201220BBDB212B66EC4EFA77F2DEF46774F248154FA1D990E2D722C856D6B0

Function 00DAEBD0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(WLOG_FILTER,00000000,00000000,00000000,?,00DAE987), ref: 00DAEBF6
GetEnvironmentVariableA.KERNEL32(WLOG_FILTER,00000000,00000000,?,?,00DAE987), ref: 00DAEC1A

Strings

WLOG_FILTER, xrefs: 00DAEBE5, 00DAEC15

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: EnvironmentVariable
String ID: WLOG_FILTER
API String ID: 1431749950-2006202657
Opcode ID: 458f06d61edcd92abaca9b17d233fc8720e29832aa7c3d845260fbe50cc2a8f6
Instruction ID: 7f01110f6393b80d2f5ee6e9a5a862490ca5927c4fb9701740dd86147845830d
Opcode Fuzzy Hash: 458f06d61edcd92abaca9b17d233fc8720e29832aa7c3d845260fbe50cc2a8f6
Instruction Fuzzy Hash: 39F0963331421A2E96202766BC49D1B7FADDAD67B9350002AF409D7191EB6E4C52C6B5

Function 00DB4BC1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(WINPR_NATIVE_SSPI,00000000,00000000,?,?,00DB4AE3), ref: 00DB4BCC
GetEnvironmentVariableA.KERNEL32(WINPR_NATIVE_SSPI,00000000,00000000,?,?,00DB4AE3), ref: 00DB4BEC

Strings

WINPR_NATIVE_SSPI, xrefs: 00DB4BC7, 00DB4BE7

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: EnvironmentVariable
String ID: WINPR_NATIVE_SSPI
API String ID: 1431749950-1020623567
Opcode ID: 52c70321bb8f1da4d248887a55b12b8895842b9544df9fdbae6e96a473e5800b
Instruction ID: 8645578d329a741f9e3308693758075d967ba0ddc93bf59bc947d978e4183e4b
Opcode Fuzzy Hash: 52c70321bb8f1da4d248887a55b12b8895842b9544df9fdbae6e96a473e5800b
Instruction Fuzzy Hash: 22F0823B75A6326AD625626A6C05FBB4E65CB82F21B291119F502E30C3CA44984365F6

Function 00D7A2AA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

rfx_context_new.GETSCREEN-156413884-X86(?), ref: 00D7A2ED

Part of subcall function 00D6E4DD: GetVersionExA.KERNEL32(?), ref: 00D6E5CD
Part of subcall function 00D6E4DD: GetNativeSystemInfo.KERNEL32(?), ref: 00D6E5E7
Part of subcall function 00D6E4DD: RegOpenKeyExA.ADVAPI32(80000002,Software\FreeRDP\FreeRDP\RemoteFX,00000000,00020119,?), ref: 00D6E612

progressive_context_free.GETSCREEN-156413884-X86(00000000), ref: 00D7A36D

Strings

com.freerdp.codec.progressive, xrefs: 00D7A2CA

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: InfoNativeOpenSystemVersionprogressive_context_freerfx_context_new
String ID: com.freerdp.codec.progressive
API String ID: 2699998398-3622116780
Opcode ID: e80f1ca7b0b9a3f536b6ae6a096d8657c092011a7513b15a642b448b699064a0
Instruction ID: 38825a15cd94c9ba1e78fd72761be04ef39e501aa24b79336810cbcbf51792ba
Opcode Fuzzy Hash: e80f1ca7b0b9a3f536b6ae6a096d8657c092011a7513b15a642b448b699064a0
Instruction Fuzzy Hash: 63F08936A057025AE2247BB99802F5F7BD8DF82B70F28402EF54DA65C2FA709441C676

Function 00D61ED8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

freerdp_settings_get_key_for_name.GETSCREEN-156413884-X86(?), ref: 00D61EEF
freerdp_settings_get_type_for_key.GETSCREEN-156413884-X86(00000000), ref: 00D61F51

Strings

TRUE, xrefs: 00D61F65

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: freerdp_settings_get_key_for_namefreerdp_settings_get_type_for_key
String ID: TRUE
API String ID: 1888880752-3412697401
Opcode ID: 9bb1714707bed91c75a052e2304897d19b04baa083934ea9be81d208935aae6f
Instruction ID: b59e18c45f76e8cb7834602dbca05ee10fd7ab38f0e2da75da32075b9a8c48f1
Opcode Fuzzy Hash: 9bb1714707bed91c75a052e2304897d19b04baa083934ea9be81d208935aae6f
Instruction Fuzzy Hash: 56E02B373043287BDA115A9ADC82D9F735CEF46F75B0D006AF504A7242EB70D94045B0

Function 00DB717D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(WTSAPI_LIBRARY,00000000,00000000,?,00DB7163), ref: 00DB7190
GetEnvironmentVariableA.KERNEL32(WTSAPI_LIBRARY,00000000,00000000,?,?,00DB7163), ref: 00DB71B1

Part of subcall function 00DB7310: LoadLibraryA.KERNEL32(?,?,00DB71C4,00000000,?,?,00DB7163), ref: 00DB7316
Part of subcall function 00DB7310: GetProcAddress.KERNEL32(00000000,InitWtsApi), ref: 00DB732B

Strings

WTSAPI_LIBRARY, xrefs: 00DB718B, 00DB71AC

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: EnvironmentVariable$AddressLibraryLoadProc
String ID: WTSAPI_LIBRARY
API String ID: 3590464466-1122459656
Opcode ID: 8c51b60b2ad8229ce6d97111c13b738956319c6998f5e9c4498dbe3aa3c1c7ca
Instruction ID: ebb701fc6179a25c96baba2534b81a498419048c04fef450f2c414f7084b9228
Opcode Fuzzy Hash: 8c51b60b2ad8229ce6d97111c13b738956319c6998f5e9c4498dbe3aa3c1c7ca
Instruction Fuzzy Hash: 4BE09B3620D713AFD231226DBC0AFDF1B55DBC3BA5F241119F402AA1C5AF54584295B6

Function 00DB7310 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,00DB71C4,00000000,?,?,00DB7163), ref: 00DB7316
GetProcAddress.KERNEL32(00000000,InitWtsApi), ref: 00DB732B

Strings

InitWtsApi, xrefs: 00DB7325

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: InitWtsApi
API String ID: 2574300362-3428673357
Opcode ID: b7cef5466d7c6a348d9e61d2ae311140cd5e13b7d601afb1794d727de40a3ad3
Instruction ID: 8b2d8612ac34271469e120eacf3ed32b65b090a5f906fd2829dfd24e13e10197
Opcode Fuzzy Hash: b7cef5466d7c6a348d9e61d2ae311140cd5e13b7d601afb1794d727de40a3ad3
Instruction Fuzzy Hash: BCD0C271708605DF8B00AFF6AC065123BDC9740F447040432E819C6190EB71C410A660

Function 00E1F42C Relevance: 5.2, APIs: 4, Instructions: 154COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00E0B650,00F60388,0000000C), ref: 00E1F430
SetLastError.KERNEL32(00000000), ref: 00E1F4D2
GetLastError.KERNEL32(00000000,?,00E05FDD,00E1F0E3,?,?,00DAF77A,0000000C,?,?,?,?,00D227D2,?,?,?), ref: 00E1F581
SetLastError.KERNEL32(00000000,00000006), ref: 00E1F623

Part of subcall function 00E1F066: HeapFree.KERNEL32(00000000,00000000,?,00E05F2D,?,?,?,00DAFA9A,?,?,?,?,?,00D2293F,?,?), ref: 00E1F07C
Part of subcall function 00E1F066: GetLastError.KERNEL32(?,?,00E05F2D,?,?,?,00DAFA9A,?,?,?,?,?,00D2293F,?,?), ref: 00E1F087

Memory Dump Source

Source File: 00000002.00000002.20747505100.0000000000741000.00000040.00000001.01000000.00000003.sdmp, Offset: 00740000, based on PE: true

Associated: 00000002.00000002.20746770713.0000000000740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000EC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000F8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.000000000125C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001C63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001DCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20747505100.0000000001E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.20757583013.0000000001E93000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_740000_getscreen-156413884-x86.jbxd

Similarity

API ID: ErrorLast$FreeHeap
String ID:
API String ID: 3197834085-0
Opcode ID: 22509804bd682f8eaec2dfd37bf25b93d88e407174ee69ad06ce04db4bb828ff
Instruction ID: d95a92f3901c124252cfcc67b2bccb2aaae44694cdde177fabd28b3c56474311
Opcode Fuzzy Hash: 22509804bd682f8eaec2dfd37bf25b93d88e407174ee69ad06ce04db4bb828ff
Instruction Fuzzy Hash: 59412B7661A3216ED6103B78BC86EEB3289AF15378B112370F634F61E1DB248ED291D1

Analysis Process: nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exePID: 2748, Parent PID: 908COMMON

Execution Graph

Execution Coverage:	0.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	196
Total number of Limit Nodes:	7

Executed Functions

Function 01EE29E0 Relevance: 7.7, APIs: 5, Instructions: 212
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 01EE2B13
GetProcAddress.KERNELBASE(?,01EBCFF9), ref: 01EE2B31
ExitProcess.KERNEL32(?,01EBCFF9), ref: 01EE2B42
VirtualProtect.KERNELBASE(00790000,00001000,00000004,?,00000000), ref: 01EE2B90
VirtualProtect.KERNELBASE(00790000,00001000), ref: 01EE2BA5

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: ProtectVirtual$AddressExitLibraryLoadProcProcess
String ID:
API String ID: 1996367037-0
Opcode ID: a8c6dfa00922057e8da9ed8a420ec6d89a9345aa3fe10763739640caaa4d67f6
Instruction ID: 6eaaf841d81c75a673464194d9a7066c7bc3ee7ff1da78a746860a7c17ac11d2
Opcode Fuzzy Hash: a8c6dfa00922057e8da9ed8a420ec6d89a9345aa3fe10763739640caaa4d67f6
Instruction Fuzzy Hash: E7511572A107134AD7318E7CDCC86ACB7D9EB452287581738DBEADB3C6E7A458068360

Function 00E5B6E0 Relevance: 6.1, APIs: 4, Instructions: 66
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E6F42C: GetLastError.KERNEL32(00000000,?,00E55FDD,00E6F0E3,?,?,00DFF77A,0000000C,?,?,?,?,00D727D2,?,?,?), ref: 00E6F581
Part of subcall function 00E6F42C: SetLastError.KERNEL32(00000000,00000006), ref: 00E6F623

CloseHandle.KERNEL32(?,?,?,00E5B817,?,?,00E5B689,00000000), ref: 00E5B711
FreeLibraryAndExitThread.KERNELBASE(?,?,?,?,00E5B817,?,?,00E5B689,00000000), ref: 00E5B727
RtlExitUserThread.NTDLL(?,?,?,00E5B817,?,?,00E5B689,00000000), ref: 00E5B730
GetModuleHandleExW.KERNEL32(00000004,?,0000000C), ref: 00E5B76E

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: ErrorExitHandleLastThread$CloseFreeLibraryModuleUser
String ID:
API String ID: 1062721995-0
Opcode ID: 6b961a0a04234e62606bb513180cdbd8951994e6b0a9b41d3746a05451c05db9
Instruction ID: 4a8cec16b1cec00662ace7dc6d5cb4f380aa8e0d46a4831c6e3fe88c04a6f0bf
Opcode Fuzzy Hash: 6b961a0a04234e62606bb513180cdbd8951994e6b0a9b41d3746a05451c05db9
Instruction Fuzzy Hash: 5411B9B1500204AFC7209B66DC09E5ABBE8DFC4765F149627FD15E7291DB70DE09C690

Function 00E5B62B Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(00FB0388,0000000C), ref: 00E5B63E
RtlExitUserThread.NTDLL(00000000), ref: 00E5B645

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: ErrorExitLastThreadUser
String ID:
API String ID: 1750398979-0
Opcode ID: 37a3371b6520640fb700f51bf19a8f7cf974577f05dc2604c382fd80b63349e3
Instruction ID: 29f01400bd7d5036cb01e822a295a85ab287ed79c33c312cf3ab2f50fbbd5da7
Opcode Fuzzy Hash: 37a3371b6520640fb700f51bf19a8f7cf974577f05dc2604c382fd80b63349e3
Instruction Fuzzy Hash: 78F0C2B19402049FDB04AFB0D80AF6E7BB4EF40751F20558AF815B7292DB709945CBA1

Function 00E6F717 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000), ref: 00E6F758

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 9f5e83febb37be9699332cd0572b8cd72e1b7a69a35b788b9ab22a52348a0594
Instruction ID: 873ff62d07046abdc760998ddd613d168e41085a8212fd529f3ab32f52770586
Opcode Fuzzy Hash: 9f5e83febb37be9699332cd0572b8cd72e1b7a69a35b788b9ab22a52348a0594
Instruction Fuzzy Hash: 00F054326E5624669B216B66BD55B9A3788AF417E4B156033FC14F7194CB20F80196E0

Non-executed Functions

Function 00DFE437 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010B70C8,00E04AA1,00000000,00000000), ref: 00E043BE

Strings

sspi_EncryptMessage, xrefs: 00E04406, 00E0443E, 00E04443, 00E04449
EncryptMessage: %s (0x%08X), xrefs: 00E04401
[%s]: Security module does not provide an implementation, xrefs: 00E04444
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00E0440B, 00E0444A

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$EncryptMessage: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_EncryptMessage
API String ID: 689400697-3976766517
Opcode ID: 1cd6aa342aea25cc7c0ca7c98b2a5c7675ec7a13016895e6972a8f9994730307
Instruction ID: 00b4ffd8fd512c942273b36e07e3291d2cd1cc0adeef1574bb2f6789495de580
Opcode Fuzzy Hash: 1cd6aa342aea25cc7c0ca7c98b2a5c7675ec7a13016895e6972a8f9994730307
Instruction Fuzzy Hash: 7B1108B53803057BD7216E52ED43F673B6CDBC0B61F044065FB00B50D1E992CA509771

Function 00DFE42E Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010B70C8,00E04AA1,00000000,00000000), ref: 00E042FB

Strings

DecryptMessage: %s (0x%08X), xrefs: 00E0433E
sspi_DecryptMessage, xrefs: 00E04343, 00E0437B, 00E04380, 00E04386
[%s]: Security module does not provide an implementation, xrefs: 00E04381
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00E04348, 00E04387

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$DecryptMessage: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_DecryptMessage
API String ID: 689400697-3301108232
Opcode ID: b908d76626096b599dc38ddb375d3b2a036dac50a3f7b3fb2332be06a3098f5d
Instruction ID: 5230df0488656d3765efc82bf485cba28b17912f51a030ce9e62826735298f00
Opcode Fuzzy Hash: b908d76626096b599dc38ddb375d3b2a036dac50a3f7b3fb2332be06a3098f5d
Instruction Fuzzy Hash: 9011C8B53843057BD6212A66ED43F6B3B6CE7C1B61F045055FB00B50D1EA96CA50D771

Function 00DA5E14 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

crypto_cert_fingerprint.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?), ref: 00DA5E1C

Part of subcall function 00DA576E: crypto_cert_fingerprint_by_hash.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,sha256), ref: 00DA5779

crypto_cert_issuer.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?), ref: 00DA5E30
crypto_cert_subject.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,?), ref: 00DA5E3A
certificate_data_new.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,?,00000000,00000000,00000000,?,?), ref: 00DA5E4A

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: certificate_data_newcrypto_cert_fingerprintcrypto_cert_fingerprint_by_hashcrypto_cert_issuercrypto_cert_subject
String ID:
API String ID: 1865246629-0
Opcode ID: b22f0af09afbb53f47c67a66392b01df666bde5d5b51faeba4ef9e6157e0229e
Instruction ID: 29bb91e61ca1c72291083759c46094960b9afd61ce87268b4e0551546b249161
Opcode Fuzzy Hash: b22f0af09afbb53f47c67a66392b01df666bde5d5b51faeba4ef9e6157e0229e
Instruction Fuzzy Hash: FEE04F75500608BF8F112F6AEC05CAF7EBDDF867E4B184124BC185612ADA71CE1096B0

Function 00E4FCA9 Relevance: 6.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00E4FDC9,00F7C654), ref: 00E4FCAE
UnhandledExceptionFilter.KERNEL32(?,?,00E4FDC9,00F7C654), ref: 00E4FCB7
GetCurrentProcess.KERNEL32(C0000409,?,00E4FDC9,00F7C654), ref: 00E4FCC2
TerminateProcess.KERNEL32(00000000,?,00E4FDC9,00F7C654), ref: 00E4FCC9

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: 194fc4a186346830e5a298f8d0d84510eb302ceab79f8eb9f863f64eeb253e8f
Instruction ID: f5fc143b5afab96c864f2b289b51f813dc03defc9a3ffb0086d926086a1b90cf
Opcode Fuzzy Hash: 194fc4a186346830e5a298f8d0d84510eb302ceab79f8eb9f863f64eeb253e8f
Instruction Fuzzy Hash: 8FD0CAB2000208AFCB002BE2FE0CF893B28BB0860AF050043F71AA20A0CA31440A8B62

Function 00E07449 Relevance: 224.3, APIs: 64, Strings: 64, Instructions: 269
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(wtsapi32.dll,00E07168), ref: 00E0744E
GetProcAddress.KERNEL32(00000000,WTSStopRemoteControlSession), ref: 00E0746B
GetProcAddress.KERNEL32(WTSStartRemoteControlSessionW), ref: 00E0747D
GetProcAddress.KERNEL32(WTSStartRemoteControlSessionA), ref: 00E0748F
GetProcAddress.KERNEL32(WTSConnectSessionW), ref: 00E074A1
GetProcAddress.KERNEL32(WTSConnectSessionA), ref: 00E074B3
GetProcAddress.KERNEL32(WTSEnumerateServersW), ref: 00E074C5
GetProcAddress.KERNEL32(WTSEnumerateServersA), ref: 00E074D7
GetProcAddress.KERNEL32(WTSOpenServerW), ref: 00E074E9
GetProcAddress.KERNEL32(WTSOpenServerA), ref: 00E074FB
GetProcAddress.KERNEL32(WTSOpenServerExW), ref: 00E0750D
GetProcAddress.KERNEL32(WTSOpenServerExA), ref: 00E0751F
GetProcAddress.KERNEL32(WTSCloseServer), ref: 00E07531
GetProcAddress.KERNEL32(WTSEnumerateSessionsW), ref: 00E07543
GetProcAddress.KERNEL32(WTSEnumerateSessionsA), ref: 00E07555
GetProcAddress.KERNEL32(WTSEnumerateSessionsExW), ref: 00E07567
GetProcAddress.KERNEL32(WTSEnumerateSessionsExA), ref: 00E07579
GetProcAddress.KERNEL32(WTSEnumerateProcessesW), ref: 00E0758B
GetProcAddress.KERNEL32(WTSEnumerateProcessesA), ref: 00E0759D
GetProcAddress.KERNEL32(WTSTerminateProcess), ref: 00E075AF
GetProcAddress.KERNEL32(WTSQuerySessionInformationW), ref: 00E075C1
GetProcAddress.KERNEL32(WTSQuerySessionInformationA), ref: 00E075D3
GetProcAddress.KERNEL32(WTSQueryUserConfigW), ref: 00E075E5
GetProcAddress.KERNEL32(WTSQueryUserConfigA), ref: 00E075F7
GetProcAddress.KERNEL32(WTSSetUserConfigW), ref: 00E07609

Strings

WTSQuerySessionInformationW, xrefs: 00E075B1
WTSVirtualChannelPurgeInput, xrefs: 00E076E3
WTSStopRemoteControlSession, xrefs: 00E07465
WTSEnumerateSessionsExA, xrefs: 00E07569
WTSCreateListenerW, xrefs: 00E07815
WTSRegisterSessionNotification, xrefs: 00E07730
WTSOpenServerExW, xrefs: 00E074FD
WTSVirtualChannelClose, xrefs: 00E076AD
WTSSetUserConfigW, xrefs: 00E075F9
WTSConnectSessionW, xrefs: 00E07491
WTSQueryListenerConfigW, xrefs: 00E077F1
WTSFreeMemory, xrefs: 00E07719
WTSVirtualChannelOpenEx, xrefs: 00E0769B
WTSGetListenerSecurityW, xrefs: 00E0785D
WTSGetListenerSecurityA, xrefs: 00E0786F
WTSStartRemoteControlSessionW, xrefs: 00E0746D
WTSSendMessageW, xrefs: 00E0761D
WTSQueryUserToken, xrefs: 00E07773
WTSEnumerateServersA, xrefs: 00E074C7
WTSVirtualChannelWrite, xrefs: 00E076D1
WTSEnumerateSessionsA, xrefs: 00E07545
WTSQueryListenerConfigA, xrefs: 00E07803
WTSCloseServer, xrefs: 00E07521
WTSVirtualChannelPurgeOutput, xrefs: 00E076F5
WTSVirtualChannelRead, xrefs: 00E076BF
WTSCreateListenerA, xrefs: 00E07827
WTSUnRegisterSessionNotification, xrefs: 00E0773D
WTSEnumerateSessionsExW, xrefs: 00E07557
WTSVirtualChannelQuery, xrefs: 00E07707
WTSEnumerateListenersA, xrefs: 00E077DF
WTSWaitSystemEvent, xrefs: 00E07677
WTSShutdownSystem, xrefs: 00E07665
WTSIsChildSessionsEnabled, xrefs: 00E07898
WTSSetListenerSecurityA, xrefs: 00E0784B
WTSQueryUserConfigW, xrefs: 00E075D5
WTSUnRegisterSessionNotificationEx, xrefs: 00E07761
WTSEnumerateProcessesExA, xrefs: 00E077BB
WTSOpenServerExA, xrefs: 00E0750F
WTSOpenServerW, xrefs: 00E074D9
WTSRegisterSessionNotificationEx, xrefs: 00E0774F
WTSSetListenerSecurityW, xrefs: 00E07839
WTSFreeMemoryExW, xrefs: 00E07785
WTSEnumerateSessionsW, xrefs: 00E07533
WTSQueryUserConfigA, xrefs: 00E075E7
WTSQuerySessionInformationA, xrefs: 00E075C3
WTSEnumerateProcessesW, xrefs: 00E0757B
WTSTerminateProcess, xrefs: 00E0759F
WTSSendMessageA, xrefs: 00E0762F
WTSConnectSessionA, xrefs: 00E074A3
WTSEnumerateListenersW, xrefs: 00E077CD
WTSFreeMemoryExA, xrefs: 00E07797
WTSEnumerateServersW, xrefs: 00E074B5
WTSOpenServerA, xrefs: 00E074EB
wtsapi32.dll, xrefs: 00E07449
WTSStartRemoteControlSessionA, xrefs: 00E0747F
WTSLogoffSession, xrefs: 00E07653
WTSEnableChildSessions, xrefs: 00E07881
WTSGetActiveConsoleSessionId, xrefs: 00E078B7
WTSGetChildSessionId, xrefs: 00E078A5
WTSEnumerateProcessesExW, xrefs: 00E077A9
WTSEnumerateProcessesA, xrefs: 00E0758D
WTSVirtualChannelOpen, xrefs: 00E07689
WTSDisconnectSession, xrefs: 00E07641
WTSSetUserConfigA, xrefs: 00E0760B

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: WTSCloseServer$WTSConnectSessionA$WTSConnectSessionW$WTSCreateListenerA$WTSCreateListenerW$WTSDisconnectSession$WTSEnableChildSessions$WTSEnumerateListenersA$WTSEnumerateListenersW$WTSEnumerateProcessesA$WTSEnumerateProcessesExA$WTSEnumerateProcessesExW$WTSEnumerateProcessesW$WTSEnumerateServersA$WTSEnumerateServersW$WTSEnumerateSessionsA$WTSEnumerateSessionsExA$WTSEnumerateSessionsExW$WTSEnumerateSessionsW$WTSFreeMemory$WTSFreeMemoryExA$WTSFreeMemoryExW$WTSGetActiveConsoleSessionId$WTSGetChildSessionId$WTSGetListenerSecurityA$WTSGetListenerSecurityW$WTSIsChildSessionsEnabled$WTSLogoffSession$WTSOpenServerA$WTSOpenServerExA$WTSOpenServerExW$WTSOpenServerW$WTSQueryListenerConfigA$WTSQueryListenerConfigW$WTSQuerySessionInformationA$WTSQuerySessionInformationW$WTSQueryUserConfigA$WTSQueryUserConfigW$WTSQueryUserToken$WTSRegisterSessionNotification$WTSRegisterSessionNotificationEx$WTSSendMessageA$WTSSendMessageW$WTSSetListenerSecurityA$WTSSetListenerSecurityW$WTSSetUserConfigA$WTSSetUserConfigW$WTSShutdownSystem$WTSStartRemoteControlSessionA$WTSStartRemoteControlSessionW$WTSStopRemoteControlSession$WTSTerminateProcess$WTSUnRegisterSessionNotification$WTSUnRegisterSessionNotificationEx$WTSVirtualChannelClose$WTSVirtualChannelOpen$WTSVirtualChannelOpenEx$WTSVirtualChannelPurgeInput$WTSVirtualChannelPurgeOutput$WTSVirtualChannelQuery$WTSVirtualChannelRead$WTSVirtualChannelWrite$WTSWaitSystemEvent$wtsapi32.dll
API String ID: 2238633743-2998606599
Opcode ID: ceab1d860b50672c3d1b0cf81eef32efba1ffe9dab26bc5655570433f48d81d5
Instruction ID: e8802ce76b32d3e14707b00436f41282ad51391084449db4330f6ba418dbb76d
Opcode Fuzzy Hash: ceab1d860b50672c3d1b0cf81eef32efba1ffe9dab26bc5655570433f48d81d5
Instruction Fuzzy Hash: A8B167B4D44314EACB359F79AC8A8863E63E7847723404C16EA84766D8D7BF8054EFB1

Function 00DF14E3 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 194
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

freerdp_error_info.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,?,?,?,?,?,?,00DF14DF,?,00000000), ref: 00DF1519
freerdp_get_error_info_string.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(00000000,?,?,?,?,?,?,00DF14DF,?,00000000), ref: 00DF155D
freerdp_reconnect.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,?,?,?,?,?,?,00DF14DF,?,00000000), ref: 00DF1601
freerdp_get_last_error.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,?,?,?,?,?,?,00DF14DF,?,00000000), ref: 00DF1611
Sleep.KERNEL32(0000000A,?,?,?,?,?,?,00DF14DF,?,00000000), ref: 00DF167E

Strings

Autoreconnect aborted by user, xrefs: 00DF1641
Maximum reconnect retries exceeded, xrefs: 00DF16B7
Disconnected by server hitting a bug or resource limit [%s], xrefs: 00DF1563
C:\Project\agent-windows\freerdp\FreeRDP\client\common\client.c, xrefs: 00DF156D, 00DF15E4, 00DF164B, 00DF16C1, 00DF171A
Network disconnect!, xrefs: 00DF1710
client_auto_reconnect_ex, xrefs: 00DF1568, 00DF15DF, 00DF1646, 00DF16BC, 00DF1715
Attempting reconnect (%u of %u), xrefs: 00DF15DA
com.freerdp.client.common, xrefs: 00DF153E, 00DF1589, 00DF15BC, 00DF1627, 00DF169D, 00DF16E9, 00DF16F2

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: Sleepfreerdp_error_infofreerdp_get_error_info_stringfreerdp_get_last_errorfreerdp_reconnect
String ID: Attempting reconnect (%u of %u)$Autoreconnect aborted by user$C:\Project\agent-windows\freerdp\FreeRDP\client\common\client.c$Disconnected by server hitting a bug or resource limit [%s]$Maximum reconnect retries exceeded$Network disconnect!$client_auto_reconnect_ex$com.freerdp.client.common
API String ID: 968149013-2963753137
Opcode ID: c42da8ca239ce898b107c1912638a48498f090637d0499f67a28c69027066bc4
Instruction ID: 6ec93ff038fbce96fc288b696b88259a304ca6fbe61c6adb3257042018ba9001
Opcode Fuzzy Hash: c42da8ca239ce898b107c1912638a48498f090637d0499f67a28c69027066bc4
Instruction Fuzzy Hash: 0E51DB75B40309B7E7217B25EC87FBA3BA4DB50B10F19C029FB04EA1D1EA75CA809635

Function 00DBA89E Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 127
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

gdi_get_pixel_format.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,?,?,?,?,00DBA899,?,?,00000000,00000000,Function_006DAA7A), ref: 00DBA8B3
gdi_free.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,?,?,?,?,00DBA899,?,?,00000000,00000000,Function_006DAA7A), ref: 00DBAA40

Strings

failed to initialize gdi, xrefs: 00DBAA6D
C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\gdi\gdi.c, xrefs: 00DBAA77
com.freerdp.gdi, xrefs: 00DBA8D7, 00DBAA4F
gdi_init_ex, xrefs: 00DBAA72

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: gdi_freegdi_get_pixel_format
String ID: C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\gdi\gdi.c$com.freerdp.gdi$failed to initialize gdi$gdi_init_ex
API String ID: 1251975138-534786182
Opcode ID: f1b02cd628de1cac183c2eccbedcee1fb773f98a9125d2f9114977f95833268f
Instruction ID: 616c62aae98e2d79bb1ee78e974633deab4f5364bac7dd4f1d1b619f272b53e2
Opcode Fuzzy Hash: f1b02cd628de1cac183c2eccbedcee1fb773f98a9125d2f9114977f95833268f
Instruction Fuzzy Hash: F8418171200702AFDB14AF38DC42BA977E5FF04310F148429FA599A292EF72E851DB71

Function 00D80E1F Relevance: 17.6, APIs: 2, Strings: 8, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 00D80F64
RtlLeaveCriticalSection.NTDLL(?), ref: 00D80F79

Strings

,, xrefs: 00D80F23
Skipping, channel already loaded, xrefs: 00D80EB8
freerdp_channels_client_load_ex, xrefs: 00D80E64, 00D80EBD, 00D80FBE
error: channel export function call failed, xrefs: 00D80FB9
error: too many channels, xrefs: 00D80E5F
com.freerdp.core.client, xrefs: 00D80E3D, 00D80E9A, 00D80F9B
C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\client.c, xrefs: 00D80E69, 00D80EC2, 00D80FC3
PDRF, xrefs: 00D80F4B

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: ,$C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\client.c$PDRF$Skipping, channel already loaded$com.freerdp.core.client$error: channel export function call failed$error: too many channels$freerdp_channels_client_load_ex
API String ID: 3168844106-1571615648
Opcode ID: 619683cd3f89b537ea8e780acc0e8946f87be9cfaf9fd741d3cb30b70b504b9e
Instruction ID: ea41f45de7f7f5e92d8fab339ad28d69cbebc4ec4431fca66bf33007cf516394
Opcode Fuzzy Hash: 619683cd3f89b537ea8e780acc0e8946f87be9cfaf9fd741d3cb30b70b504b9e
Instruction Fuzzy Hash: 8B41F471A4430AABDB60EF68DC42F9A7BE4EF08724F144429F644FB291D774E9049BB4

Function 00D86AF2 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 449
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

freerdp_settings_free.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(00000000), ref: 00D87326

Part of subcall function 00D87F9B: GetComputerNameExA.KERNEL32(00000000,?,?,00000000), ref: 00D87FCC
Part of subcall function 00D87F9B: freerdp_settings_set_string.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,00000680,?), ref: 00D87FFC

freerdp_settings_set_string.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(00000000,00000086,?), ref: 00D86D8C
freerdp_settings_set_bool.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(00000000,00001446,00000001), ref: 00D87177
freerdp_settings_set_uint32.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(00000000,00001447,00000003), ref: 00D8718F
freerdp_settings_set_uint32.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(00000000,00001448,00000005), ref: 00D871A7
freerdp_settings_set_uint32.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(00000000,00001449,00000002), ref: 00D871BF
freerdp_settings_set_uint32.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(00000000,0000144A,00002328), ref: 00D871DA
freerdp_settings_set_uint32.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(00000000,0000144D,00003A98), ref: 00D871F5

Strings

C:\Windows\System32\mstscax.dll, xrefs: 00D86F3F

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: freerdp_settings_set_uint32$freerdp_settings_set_string$ComputerNamefreerdp_settings_freefreerdp_settings_set_bool
String ID: C:\Windows\System32\mstscax.dll
API String ID: 2536960967-183970058
Opcode ID: 82bdff7d3608d2737708f287db7337eb1d03ec5bf27c3f60c916d941e1c921a0
Instruction ID: 7bf49d9aafe527f349d0d8bc83618f3f7e8bf0a72b3b72751e3a456fd108fd8e
Opcode Fuzzy Hash: 82bdff7d3608d2737708f287db7337eb1d03ec5bf27c3f60c916d941e1c921a0
Instruction Fuzzy Hash: 1312F8B1A04F009EE324DF39D885B93B7E4FF08311F64492EE5AE87291DBB1A544CB59

Function 00DF6C86 Relevance: 16.1, APIs: 4, Strings: 5, Instructions: 337
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

freerdp_device_collection_add.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,?), ref: 00DF6D79
freerdp_device_collection_add.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,00000000), ref: 00DF6E1D
freerdp_device_collection_add.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,00000000), ref: 00DF6F6F
freerdp_device_collection_add.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,00000000), ref: 00DF7044

Strings

parallel, xrefs: 00DF6FAF
serial, xrefs: 00DF6E3D
printer, xrefs: 00DF6CDF
smartcard, xrefs: 00DF6DA3
drive, xrefs: 00DF6C95

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: freerdp_device_collection_add
String ID: drive$parallel$printer$serial$smartcard
API String ID: 2538329621-807955808
Opcode ID: 60d5153692331460be96c749f716fcadbf8152338409b10500d5e20831fc47d5
Instruction ID: 995fd6f359ec9e5e2ee7dc54bc1cb1bb892e6b6c424b1348aed3785ce1f85fc2
Opcode Fuzzy Hash: 60d5153692331460be96c749f716fcadbf8152338409b10500d5e20831fc47d5
Instruction Fuzzy Hash: ABB1B03660460AABCF15AF18DC529AD7BE1FF04310B1AC469F904AF652EF32DD558BB0

Function 00D80C4D Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 145COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 00D80D92
RtlLeaveCriticalSection.NTDLL(?), ref: 00D80DB2

Strings

Skipping, channel already loaded, xrefs: 00D80CE8
freerdp_channels_client_load, xrefs: 00D80C93, 00D80CED, 00D80DF6
PDRF, xrefs: 00D80D76
error: channel export function call failed, xrefs: 00D80DF1
error: too many channels, xrefs: 00D80C8E
com.freerdp.core.client, xrefs: 00D80C6C, 00D80CCA, 00D80DD3
C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\client.c, xrefs: 00D80C98, 00D80CF2, 00D80DFB

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\client.c$PDRF$Skipping, channel already loaded$com.freerdp.core.client$error: channel export function call failed$error: too many channels$freerdp_channels_client_load
API String ID: 3168844106-4217659166
Opcode ID: fe8f614941f32d389c5750b2fd4a398d2b867524d9dacaf7cafe7feb5c4e0b8a
Instruction ID: f88f921f52070553799b9bcd070177e3f031b5008f69fd00b28e4de10b132999
Opcode Fuzzy Hash: fe8f614941f32d389c5750b2fd4a398d2b867524d9dacaf7cafe7feb5c4e0b8a
Instruction Fuzzy Hash: B451D671A44305AFEB60EF65DC82F9E7BA4EB04724F144029FA44EB291E7B4E904CB74

Function 00E858B8 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 93COMMON

Download Yara Rule

APIs

audio_format_get_tag_string.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(00000000,?,?,00E85425,?,?,?,?,00000000,?), ref: 00E858FA
audio_format_get_tag_string.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(00000001,00000000,?,?,00E85425,?,?,?,?,00000000,?), ref: 00E85902
audio_format_compatible.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(%T,?,?,?,?,00E85425,?,?,?,?,00000000,?), ref: 00E8594D

Strings

%T, xrefs: 00E85937, 00E85949, 00E8594C
com.freerdp.dsp, xrefs: 00E858D4, 00E85966
C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\dsp.c, xrefs: 00E85915, 00E8598E
%s requires %s for sample input, got %s, xrefs: 00E8590F
freerdp_dsp_resample, xrefs: 00E85909, 00E8590E, 00E85914, 00E85989
Missing resample support, recompile -DWITH_SOXR=ON or -DWITH_DSP_FFMPEG=ON, xrefs: 00E85984

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: audio_format_get_tag_string$audio_format_compatible
String ID: %T$%s requires %s for sample input, got %s$C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\dsp.c$Missing resample support, recompile -DWITH_SOXR=ON or -DWITH_DSP_FFMPEG=ON$com.freerdp.dsp$freerdp_dsp_resample
API String ID: 204136587-1473788660
Opcode ID: 902375e055f29cf71d20c38f1f0a124997741c0a947a1247e5b17cf75dfe31f5
Instruction ID: e633f4ba85abd92e7f272144f4fa666f3062753ea98c28059586aa03374bc90f
Opcode Fuzzy Hash: 902375e055f29cf71d20c38f1f0a124997741c0a947a1247e5b17cf75dfe31f5
Instruction Fuzzy Hash: 692183B26843056AFB247BA4AC43F7A339CDB40B68F11501AF65CFA1C1EDA5D840977A

Function 00E83B76 Relevance: 15.1, APIs: 10, Instructions: 134COMMON

Download Yara Rule

APIs

freerdp_settings_set_bool.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,00000400,00000001), ref: 00E83B87
freerdp_settings_set_string.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,00000401,00000000), ref: 00E83BB7
freerdp_settings_set_string.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,00000404,?), ref: 00E83BDB
freerdp_settings_set_string.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,00000402,00000000), ref: 00E83BFA
freerdp_settings_set_string.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,00000014,?), ref: 00E83C12
freerdp_settings_set_string.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,000006C1,?), ref: 00E83C2B
freerdp_settings_set_string.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,00000403,?), ref: 00E83C44
freerdp_settings_set_string.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,00000015,00000000), ref: 00E83C60
freerdp_settings_set_uint32.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,00000013,?), ref: 00E83C82
freerdp_target_net_addresses_free.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?), ref: 00E83C93

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: freerdp_settings_set_string$freerdp_settings_set_boolfreerdp_settings_set_uint32freerdp_target_net_addresses_free
String ID:
API String ID: 949014189-0
Opcode ID: 6cef6dd10707ff90aaa457e2c58685527288738f0f1d639d76a365eb69d9ad72
Instruction ID: b86fb5ac551fb952c3d39a6107dd5435d2f88993dc7608296e6d8f977c0771a0
Opcode Fuzzy Hash: 6cef6dd10707ff90aaa457e2c58685527288738f0f1d639d76a365eb69d9ad72
Instruction Fuzzy Hash: E441B371600A06BFEB216E34CC45F9AB395FF05708F041024FA0DA66D1E772FA60C7A4

Function 00E31612 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 220COMMON

Download Yara Rule

APIs

Part of subcall function 00E05CD5: InitializeCriticalSectionAndSpinCount.KERNEL32(00000004,00000FA0,?,00000000,?,00E31701,00000001), ref: 00E05CF9

zgfx_context_new.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(00000000), ref: 00E31874

Part of subcall function 00E8693A: zgfx_context_reset.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(00000000,00000000,00000000,?,00E31879,00000000), ref: 00E86964

Strings

zgfx_context_new failed!, xrefs: 00E318B2
Failed to acquire reference to WLog %s, xrefs: 00E316BF
HashTable_New failed!, xrefs: 00E31737
rdpgfx_client_context_new, xrefs: 00E3165C, 00E316C4, 00E3173C, 00E31810, 00E318B7
com.freerdp.channels.rdpgfx.client, xrefs: 00E31635, 00E3167A, 00E3167F, 00E316A0, 00E316BE, 00E31719, 00E317ED, 00E31898
calloc failed!, xrefs: 00E31657, 00E3180B
C:\Project\agent-windows\freerdp\FreeRDP\channels\rdpgfx\client\rdpgfx_main.c, xrefs: 00E31661, 00E316C9, 00E31741, 00E31815, 00E318BC

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpinzgfx_context_newzgfx_context_reset
String ID: C:\Project\agent-windows\freerdp\FreeRDP\channels\rdpgfx\client\rdpgfx_main.c$Failed to acquire reference to WLog %s$HashTable_New failed!$calloc failed!$com.freerdp.channels.rdpgfx.client$rdpgfx_client_context_new$zgfx_context_new failed!
API String ID: 3732774510-3243565116
Opcode ID: c8027c93abac8d1911740ff55ffcaba150e0bcc2bfdd262e00365a836e814375
Instruction ID: 0adf2f1cdf4b897dd36acc03c5f7cadfba1471e366bd4462a06d94c6eeb34ac9
Opcode Fuzzy Hash: c8027c93abac8d1911740ff55ffcaba150e0bcc2bfdd262e00365a836e814375
Instruction Fuzzy Hash: E37125B1680B026EE3249B259C86B567BE4FF14B24F10546EF644FB6D1DBB4E400CFA9

Function 00DBE4DD Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 138registrythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00E06B05: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00000FA0,00000000,00000000,00000000,?,00DBE59B,00000001,00006060,00000010), ref: 00E06B3E

GetVersionExA.KERNEL32(?), ref: 00DBE5CD
GetNativeSystemInfo.KERNEL32(?), ref: 00DBE5E7
RegOpenKeyExA.ADVAPI32(80000002,Software\FreeRDP\FreeRDP\RemoteFX,00000000,00020119,?), ref: 00DBE612
primitives_get.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE ref: 00DBE6DC
CreateThreadpool.KERNEL32(00000000), ref: 00DBE6E2

Strings

com.freerdp.codec.rfx, xrefs: 00DBE530
Software\FreeRDP\FreeRDP\RemoteFX, xrefs: 00DBE605

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: CountCreateCriticalInfoInitializeNativeOpenSectionSpinSystemThreadpoolVersionprimitives_get
String ID: Software\FreeRDP\FreeRDP\RemoteFX$com.freerdp.codec.rfx
API String ID: 3882483829-2530424157
Opcode ID: e94d9f05e4692cc4ae63af79d610a1952f77b9c0d49b428c51dd84272e0953e4
Instruction ID: d96e799d85250d79e989228b51b33ec0f9368ed40a9bebcdf9cf47bcb671d146
Opcode Fuzzy Hash: e94d9f05e4692cc4ae63af79d610a1952f77b9c0d49b428c51dd84272e0953e4
Instruction Fuzzy Hash: C841A0B1A00705AFE720AF75DC86B96B7F8FF44704F10446EE50AA7242DB70D9598BA0

Function 00DFE889 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 106COMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(WLOG_APPENDER,00000000,00000000), ref: 00DFE8B2
GetEnvironmentVariableA.KERNEL32(WLOG_APPENDER,00000000,00000000), ref: 00DFE8D6

Strings

%s environment variable modified in my back, xrefs: 00DFE8E8
FILE, xrefs: 00DFE922
BINARY, xrefs: 00DFE938
CONSOLE, xrefs: 00DFE911
WLOG_APPENDER, xrefs: 00DFE8A6, 00DFE8D1, 00DFE8E3
UDP, xrefs: 00DFE94E

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: EnvironmentVariable
String ID: %s environment variable modified in my back$BINARY$CONSOLE$FILE$UDP$WLOG_APPENDER
API String ID: 1431749950-225596728
Opcode ID: 7b209d3faeb35880f49f28e3e4cd870ebb977d1789e4f8827a1ed6613a682ccd
Instruction ID: bb9b67ba09068053311dfc438a620d5628d385eda827760ad2bad87bc8804c09
Opcode Fuzzy Hash: 7b209d3faeb35880f49f28e3e4cd870ebb977d1789e4f8827a1ed6613a682ccd
Instruction Fuzzy Hash: 97214B3224431A28B6A43335AC4BE3B1798CF41736766442FFB15F60D2EED1C84559B2

Function 00D73971 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 95COMMON

Download Yara Rule

APIs

freerdp_set_last_error_ex.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,?,rdp_set_error_info,C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\rdp.c,0000015B), ref: 00D848D9
freerdp_set_last_error_ex.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,00000000,rdp_set_error_info,C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\rdp.c,0000016A), ref: 00D8498F

Strings

%s missing context=%p, xrefs: 00D84959
ErrorInfo, xrefs: 00D8490B
C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\rdp.c, xrefs: 00D848C7, 00D8495F, 00D84982
com.freerdp.core.rdp, xrefs: 00D84933
freerdp, xrefs: 00D84919
rdp_set_error_info, xrefs: 00D848CC, 00D84953, 00D84958, 00D8495E, 00D84987

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: freerdp_set_last_error_ex
String ID: %s missing context=%p$C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\rdp.c$ErrorInfo$com.freerdp.core.rdp$freerdp$rdp_set_error_info
API String ID: 270715978-29603548
Opcode ID: ad13b5d4b05f3ae3b1d3e295541be05fba896a0d79f16fda00548cbf18024f23
Instruction ID: 46898f6e7285ec71178fa19afbe43465394229eed600a38ca599dc4277d6cb32
Opcode Fuzzy Hash: ad13b5d4b05f3ae3b1d3e295541be05fba896a0d79f16fda00548cbf18024f23
Instruction Fuzzy Hash: 8F21F972A44315B6D7207B54DC43FEB7B689F41B20F188069FA086A1C2E7B0D6409FB2

Function 00E04B0C Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 37libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(secur32.dll,?,00E04AEC), ref: 00E04B18
LoadLibraryA.KERNEL32(security.dll,?,00E04AEC), ref: 00E04B28
GetProcAddress.KERNEL32(00000000,InitSecurityInterfaceW), ref: 00E04B42
GetProcAddress.KERNEL32(InitSecurityInterfaceA), ref: 00E04B51

Strings

secur32.dll, xrefs: 00E04B13
InitSecurityInterfaceA, xrefs: 00E04B44
security.dll, xrefs: 00E04B23
InitSecurityInterfaceW, xrefs: 00E04B3C

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: InitSecurityInterfaceA$InitSecurityInterfaceW$secur32.dll$security.dll
API String ID: 2574300362-4081094439
Opcode ID: 44c26a0b8454c3c7a025a0483302da6d7d792f836b8911591e5af82659464158
Instruction ID: 6bd92f814d477de568f9a8b6f88b7f477cc184f4b468bb5253a60010225640c6
Opcode Fuzzy Hash: 44c26a0b8454c3c7a025a0483302da6d7d792f836b8911591e5af82659464158
Instruction Fuzzy Hash: 56F089F6D6472796C732BBBABC00D567AE8ABC47553060163ED40E31C4FA75C8414F91

Function 00DB42E5 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 181fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000003,00000080,00000000), ref: 00DB4320
GetFileSize.KERNEL32(00000000,?), ref: 00DB433A

Strings

%s %hu %s %s %s, xrefs: 00DB4610

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: File$CreateSize
String ID: %s %hu %s %s %s
API String ID: 2791376181-2916857029
Opcode ID: 249e4c0256f07ce6d3b79974e627c19ddb03b72030835720a2b2d51165147c52
Instruction ID: 826fce232b08b04573e43e64876e306f3bc06a869360831164a6d2b2a1e4dc50
Opcode Fuzzy Hash: 249e4c0256f07ce6d3b79974e627c19ddb03b72030835720a2b2d51165147c52
Instruction Fuzzy Hash: AD513EB1900615AFEB21DBA5EC55AFF77ECEF09720F14452AF912E6291EB7099008A70

Function 00D9501B Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 140COMMON

Download Yara Rule

APIs

ber_read_universal_tag.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,00000002,00000000), ref: 00D9502A
ber_read_length.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,?), ref: 00D9503F

Strings

ber_read_integer, xrefs: 00D9512D, 00D9517D
C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\crypto\ber.c, xrefs: 00D95132, 00D95182
should implement reading an integer with length=%d, xrefs: 00D95178
should implement reading an 8 bytes integer, xrefs: 00D95128
com.freerdp.crypto, xrefs: 00D9510A, 00D95159

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: ber_read_lengthber_read_universal_tag
String ID: C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\crypto\ber.c$ber_read_integer$com.freerdp.crypto$should implement reading an 8 bytes integer$should implement reading an integer with length=%d
API String ID: 3186670568-2454464461
Opcode ID: 2850dc09beca94aa4ccbe778c8a29d30f7d644dcfebc43f3e66442c4f4e91e89
Instruction ID: 4436d8c0da9a2ec1a6e694bb0bb60515438e7b85cbdbce8461aae9aadd9fbda3
Opcode Fuzzy Hash: 2850dc09beca94aa4ccbe778c8a29d30f7d644dcfebc43f3e66442c4f4e91e89
Instruction Fuzzy Hash: B3417AB1704B016BDF228F24EC92B3937E5EB52720F188179F5989B28DE639D901CB71

Function 00DD9C5D Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 109COMMON

Download Yara Rule

APIs

region16_rects.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,?), ref: 00DD9C6E

Strings

region16_print, xrefs: 00DD9CA7, 00DD9D09, 00DD9D69
C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\region.c, xrefs: 00DD9CAC, 00DD9D0E, 00DD9D6E
com.freerdp.codec, xrefs: 00DD9C80, 00DD9CE5, 00DD9D33
band %d: , xrefs: 00DD9D04
nrects=%u, xrefs: 00DD9CA2
(%hu,%hu-%hu,%hu), xrefs: 00DD9D64

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: region16_rects
String ID: (%hu,%hu-%hu,%hu)$C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\region.c$band %d: $com.freerdp.codec$nrects=%u$region16_print
API String ID: 844131241-2640574824
Opcode ID: 16a4f5c82a80f8d039b999ba1026581fefa725d520f072c686992a20dc927ac3
Instruction ID: 4d452d87bfa556f62731092c67ea56ecce3a8df158675344271739697d742501
Opcode Fuzzy Hash: 16a4f5c82a80f8d039b999ba1026581fefa725d520f072c686992a20dc927ac3
Instruction Fuzzy Hash: 9631D47279030179E730AB69AC93FB67BE9EB15B11F140016FA44F61C0FAA7D9809371

Function 00D72BCF Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 102COMMON

Download Yara Rule

APIs

freerdp_set_last_error_ex.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,00000000,freerdp_connect,C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\freerdp.c,000000AA), ref: 00D72C14
clearChannelError.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,?,00000000,freerdp_connect,C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\freerdp.c,000000AA), ref: 00D72C1B

Part of subcall function 00D726E1: ResetEvent.KERNEL32(?), ref: 00D7270A

Part of subcall function 00D88142: ResetEvent.KERNEL32(?,?,00D72C27,?,?,?,00000000,freerdp_connect,C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\freerdp.c,000000AA), ref: 00D8814E

Strings

freerdp_connect, xrefs: 00D72C01
C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\freerdp.c, xrefs: 00D72BFC
ConnectionResult, xrefs: 00D73077
freerdp, xrefs: 00D73062

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: EventReset$ChannelErrorclearfreerdp_set_last_error_ex
String ID: C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\freerdp.c$ConnectionResult$freerdp$freerdp_connect
API String ID: 3632380314-3564821047
Opcode ID: 5083121d53691873a848acf7f63ee88ab4d89f43cd4c23839862495ec46aee11
Instruction ID: 6c9a3f0ab8c5ba2f10ce93fcb55e8a5e506bf58a8a341a4480c331b54ee94138
Opcode Fuzzy Hash: 5083121d53691873a848acf7f63ee88ab4d89f43cd4c23839862495ec46aee11
Instruction Fuzzy Hash: 5C319EB0A00205AFE710DF79D885BAAB7E8FF08700F184079F908E7291EB71D9449B60

Function 00D953FD Relevance: 12.1, APIs: 8, Instructions: 80COMMON

Download Yara Rule

APIs

ber_write_universal_tag.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,00000002,00000000), ref: 00D95415
ber_write_length.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,00000001,?,00000002,00000000), ref: 00D9541D
ber_write_universal_tag.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,00000002,00000000), ref: 00D95440
ber_write_length.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,00000002,?,00000002,00000000), ref: 00D95448

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: ber_write_lengthber_write_universal_tag
String ID:
API String ID: 1889070510-0
Opcode ID: 18ef3f9f5ae11241768caf1c4dc31a824dec3e3bd5586f49f269dacf6024e569
Instruction ID: 13587c9050c0f3715181da9cb44b1e90f095ab4e912c6b82ba3a34b16332433c
Opcode Fuzzy Hash: 18ef3f9f5ae11241768caf1c4dc31a824dec3e3bd5586f49f269dacf6024e569
Instruction Fuzzy Hash: A021F530101F40AFDF536B04ED42BAA77A5EF11B01F018479FA8A1FA97C221BA41CBB1

Function 00D9CB5F Relevance: 12.1, APIs: 8, Instructions: 65COMMON

Download Yara Rule

APIs

glyph_cache_new.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?), ref: 00D9CB79
brush_cache_new.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?), ref: 00D9CB86
pointer_cache_new.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?), ref: 00D9CB94
bitmap_cache_new.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?), ref: 00D9CBA2
offscreen_cache_new.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?), ref: 00D9CBB0
palette_cache_new.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?), ref: 00D9CBBE
nine_grid_cache_new.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?), ref: 00D9CBCC
cache_free.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(00000000), ref: 00D9CBDE

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: bitmap_cache_newbrush_cache_newcache_freeglyph_cache_newnine_grid_cache_newoffscreen_cache_newpalette_cache_newpointer_cache_new
String ID:
API String ID: 2332728789-0
Opcode ID: 42906154869710506a0c67ebba1e6bbb42983877cc0118c6e46d3c0bd67e0258
Instruction ID: 9dc246277ca6ac153fa420f850770bde7ca6b90e63686fdb2eb299e1319dcef7
Opcode Fuzzy Hash: 42906154869710506a0c67ebba1e6bbb42983877cc0118c6e46d3c0bd67e0258
Instruction Fuzzy Hash: D301C476158B075AFB20AE75A852E3B77E8CF42B74718153EE480D6981FF20D40186B1

Function 00DBEFD0 Relevance: 10.7, APIs: 7, Instructions: 160COMMON

Download Yara Rule

APIs

region16_init.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?), ref: 00DBF58A

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: region16_init
String ID:
API String ID: 4140821900-0
Opcode ID: 3e8d829aa97f6b1ed1f2f2cf94f42bc771981313d169c183af5fd76dbc63c424
Instruction ID: 90a7bb4e77a66ab81e78b301876794af59ec3d03129c99faa40ad1df45be780c
Opcode Fuzzy Hash: 3e8d829aa97f6b1ed1f2f2cf94f42bc771981313d169c183af5fd76dbc63c424
Instruction Fuzzy Hash: 4B514BB2D00219DBCB18DFA9CC819EEBBF9EF48304F14452AF55AE7240E7359945CB60

Function 00DBAA9A Relevance: 10.6, APIs: 7, Instructions: 147windowCOMMON

Download Yara Rule

APIs

gdi_CreateCompatibleDC.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,00000000,?,?,?,00DBA9C7,00000000,?,?,?,?,?,?,?,?,00DBA899), ref: 00DBAAE7
gdi_CreateCompatibleBitmap.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,?,?,00000000,?,?,?,00DBA9C7,00000000,?,?,?,?), ref: 00DBAB0E
gdi_CreateBitmapEx.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,?,?,?,?,?,00000000,?,?,?,00DBA9C7,00000000,?,?,?,?), ref: 00DBAB2A
gdi_SelectObject.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,?), ref: 00DBAB60
gdi_CreateRectRgn.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(00000000,00000000,00000000,00000000), ref: 00DBABA5
gdi_DeleteObject.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?), ref: 00DBAC39
gdi_DeleteDC.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?), ref: 00DBAC48

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: gdi_$Create$BitmapCompatibleDeleteObject$RectSelect
String ID:
API String ID: 412453062-0
Opcode ID: 63bcb7db3704573387d602035f9edcf4ce94fd8292c8b1d92a53da2faae9183a
Instruction ID: c90b079c33707dd763dc0692d66964d0ceee833f61e6f3186bd868adca8975de
Opcode Fuzzy Hash: 63bcb7db3704573387d602035f9edcf4ce94fd8292c8b1d92a53da2faae9183a
Instruction Fuzzy Hash: 1751F8792007059FC725DF29D885E96BBE1FF1C310B09456EE98A8B762E771E841CF60

Function 00E0EA62 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(WLOG_FILEAPPENDER_OUTPUT_FILE_PATH,00000000,00000000,00000000,?,?,?,?,?,00E06939,?,?,?,?,00E06A0A,?), ref: 00E0EABD
GetEnvironmentVariableA.KERNEL32(WLOG_FILEAPPENDER_OUTPUT_FILE_PATH,00000000,?,?,?,?,00E06939,?,?,?,?,00E06A0A,?,?,00000000), ref: 00E0EAE7
GetEnvironmentVariableA.KERNEL32(WLOG_FILEAPPENDER_OUTPUT_FILE_NAME,00000000,00000000,?,?,?,00E06939,?,?,?,?,00E06A0A,?,?,00000000), ref: 00E0EB14
GetEnvironmentVariableA.KERNEL32(WLOG_FILEAPPENDER_OUTPUT_FILE_NAME,00000000,?,?,?,?,00E06939,?,?,?,?,00E06A0A,?,?,00000000), ref: 00E0EB37

Strings

WLOG_FILEAPPENDER_OUTPUT_FILE_PATH, xrefs: 00E0EA87, 00E0EAE2
WLOG_FILEAPPENDER_OUTPUT_FILE_NAME, xrefs: 00E0EB0F, 00E0EB32

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: EnvironmentVariable
String ID: WLOG_FILEAPPENDER_OUTPUT_FILE_NAME$WLOG_FILEAPPENDER_OUTPUT_FILE_PATH
API String ID: 1431749950-2760771567
Opcode ID: 34e5cf2b2eb3326e4e532ca61229d8fd752eb597d78f35217c6fe90dd113de02
Instruction ID: 32d4d82e9f790c0c36b72e9d12b3b729901f91e3c7a74a9442c04416497dba1d
Opcode Fuzzy Hash: 34e5cf2b2eb3326e4e532ca61229d8fd752eb597d78f35217c6fe90dd113de02
Instruction Fuzzy Hash: D331F672A00A167FD7205BA5988AD6EBBA8FF403683101839F801B33C0DB719C458AE0

Function 007F8EE0 Relevance: 10.6, APIs: 7, Instructions: 87COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(01031278,Function_00068C90,007F8EC0,00000000), ref: 007F8F0A
GetLastError.KERNEL32 ref: 007F8F38
TlsGetValue.KERNEL32 ref: 007F8F46
SetLastError.KERNEL32(00000000), ref: 007F8F4F
RtlAcquireSRWLockExclusive.NTDLL(01031284), ref: 007F8F61
RtlReleaseSRWLockExclusive.NTDLL(01031284), ref: 007F8F73
TlsSetValue.KERNEL32(00000000,?,?,00000000,007DB080), ref: 007F8FB5

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: ErrorExclusiveLastLockOnceValue$AcquireExecuteInitRelease
String ID:
API String ID: 389898287-0
Opcode ID: f35cc0ae6dc468d8fd4f0e32af62e9c47f7205c2344147407debda508d571a68
Instruction ID: af4d09445272c5149079d8793c56c92d5a226aa05e3ada8173a60dffc47b102d
Opcode Fuzzy Hash: f35cc0ae6dc468d8fd4f0e32af62e9c47f7205c2344147407debda508d571a68
Instruction Fuzzy Hash: F921C5B1600208AFD7509FB5EC49B7E3BA9BB49701F000026FD05E6390DB759919CBA2

Function 00E0F61C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000002,00000011), ref: 00E0F673
GetEnvironmentVariableA.KERNEL32(WLOG_UDP_TARGET,00000000,00000000,?,00E06921,?,?,?,?,00E06A0A,?,?,00000000,?,00DFE976,00000000), ref: 00E0F68A
GetEnvironmentVariableA.KERNEL32(WLOG_UDP_TARGET,00000000,00000000,?,00E06921,?,?,?,?,00E06A0A,?,?,00000000,?,00DFE976,00000000), ref: 00E0F6AB
closesocket.WS2_32(?), ref: 00E0F6E6

Strings

WLOG_UDP_TARGET, xrefs: 00E0F685, 00E0F6A6
127.0.0.1:20000, xrefs: 00E0F6CB

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: EnvironmentVariable$closesocketsocket
String ID: 127.0.0.1:20000$WLOG_UDP_TARGET
API String ID: 65193492-3368084233
Opcode ID: 3c4cee289dc8e76f32d36ce9df8aa1854a66198c1105e733308cd71fe0f1a5ee
Instruction ID: 2a34d0e45c505f02e77a476a7ef92d216e148a0d97ecd4e0c65b49f47b8200d4
Opcode Fuzzy Hash: 3c4cee289dc8e76f32d36ce9df8aa1854a66198c1105e733308cd71fe0f1a5ee
Instruction Fuzzy Hash: 9C21F972504B016FD3345F65AC1AB177BE0EF80719F20152EF582BADE1DBB2E49587A0

Function 00E1001B Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(winsta.dll,?,00E078D9,010B7120), ref: 00E10023
GetProcAddress.KERNEL32(00000000,WinStationVirtualOpen), ref: 00E1003C
GetProcAddress.KERNEL32(WinStationVirtualOpenEx), ref: 00E10052

Strings

winsta.dll, xrefs: 00E1001E
WinStationVirtualOpen, xrefs: 00E10036
WinStationVirtualOpenEx, xrefs: 00E10042

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: WinStationVirtualOpen$WinStationVirtualOpenEx$winsta.dll
API String ID: 2238633743-2382846951
Opcode ID: 6b88bf3d4b5b7e81cb7259c2dde00af0b6c4edf06fb324f5929ef23133ffd48f
Instruction ID: ef28b70e9fc5cde35dd1bc52c3fdf32da561f459ef41a8cb8abca8312c70a065
Opcode Fuzzy Hash: 6b88bf3d4b5b7e81cb7259c2dde00af0b6c4edf06fb324f5929ef23133ffd48f
Instruction Fuzzy Hash: BD011EB06113459FD7009FB1990EFA53BE4AB88359F0554BAE489EB263DBF580C4DF14

Function 00D9CB11 Relevance: 10.5, APIs: 7, Instructions: 26COMMON

Download Yara Rule

APIs

glyph_cache_free.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?), ref: 00D9CB1E
brush_cache_free.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,?), ref: 00D9CB26
pointer_cache_free.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,?,?), ref: 00D9CB2E
bitmap_cache_free.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,?,?,?), ref: 00D9CB36
offscreen_cache_free.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,?,?,?,?), ref: 00D9CB3E
palette_cache_free.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,?,?,?,?,?), ref: 00D9CB46
nine_grid_cache_free.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,?,?,?,?,?,?), ref: 00D9CB4E

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: bitmap_cache_freebrush_cache_freeglyph_cache_freenine_grid_cache_freeoffscreen_cache_freepalette_cache_freepointer_cache_free
String ID:
API String ID: 637575458-0
Opcode ID: 7ad28be861358ee9bde9c91c788d2f392276a4a1cd27f1ec8984fa40b200d7dc
Instruction ID: d37850bb7118e97951563b289278a2d05a2c245e6fe61531a6680fa2fe221b1e
Opcode Fuzzy Hash: 7ad28be861358ee9bde9c91c788d2f392276a4a1cd27f1ec8984fa40b200d7dc
Instruction Fuzzy Hash: A8E06D31011A10ABCF323F61DC03C5ABBAAFF107513015828F886214728B22AC20ABB0

Function 00DDDFDE Relevance: 9.2, APIs: 6, Instructions: 160COMMON

Download Yara Rule

APIs

gdi_CRgnToRect.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(00000000,00000000,00000000,00000000,?,?,?,?,?,?), ref: 00DDE040
gdi_RgnToRect.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,?,?,?,?), ref: 00DDE04F
gdi_CRgnToRect.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00DDE062
gdi_RgnToRect.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,?,?,?,?), ref: 00DDE0A3
gdi_CRgnToRect.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,?,?,?,?,?,?,?,?,?), ref: 00DDE0C8
gdi_RectToCRgn.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00DDE147

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: Rectgdi_
String ID:
API String ID: 2404991910-0
Opcode ID: 469cb6860012e43950ac85b6b31c1b276f2a1fa2ad26881beb634cf1efaafb73
Instruction ID: 82ac532ef29ebace44529ee4109722c0054c4798f49b7d86abff03eb4a7a74cc
Opcode Fuzzy Hash: 469cb6860012e43950ac85b6b31c1b276f2a1fa2ad26881beb634cf1efaafb73
Instruction Fuzzy Hash: 1751C2B5E01619EFCF14DFA9C9818EEBBB9FF48710B14401AE515A7350D771AA41CBA0

Function 00DB1D8F Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

freerdp_settings_set_uint32.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,000007C0,?), ref: 00DB1DA2
freerdp_settings_set_bool.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,000007C8,00000001), ref: 00DB1DCC
freerdp_settings_set_bool.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,000007C8,00000000), ref: 00DB1DE8
freerdp_settings_set_bool.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,000007C9,00000000), ref: 00DB1DFC
freerdp_settings_set_bool.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,000007C8,00000000), ref: 00DB1E19
freerdp_settings_set_bool.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,000007C9,00000000), ref: 00DB1E2D

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: freerdp_settings_set_bool$freerdp_settings_set_uint32
String ID:
API String ID: 4272850885-0
Opcode ID: fad6795779e0600882673a89c48fb156f3d83e8e8ab2019e83a44d2ff3258703
Instruction ID: e052566677020a61edd9331f1bbe8d02c1d7dbe2743c1ab7591699e553f6bb15
Opcode Fuzzy Hash: fad6795779e0600882673a89c48fb156f3d83e8e8ab2019e83a44d2ff3258703
Instruction Fuzzy Hash: 3E11C86AF85202F5FE6110655CA3FFB139C8F61B54F980425FE0AE51C1E995EA0084B6

Function 00DD8AF6 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 154COMMON

Download Yara Rule

APIs

freerdp_image_copy.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,?,?,?,?,?,?,?,08008000,00000000,00000000,00000000,?,00000001,?,?), ref: 00DD8C2B

Strings

freerdp_image_copy_from_icon_data, xrefs: 00DD8DBA
C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\color.c, xrefs: 00DD8DBF
1bpp and 4bpp icons are not supported, xrefs: 00DD8DB5
com.freerdp.color, xrefs: 00DD8D98

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: freerdp_image_copy
String ID: 1bpp and 4bpp icons are not supported$C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\color.c$com.freerdp.color$freerdp_image_copy_from_icon_data
API String ID: 1523062921-332027372
Opcode ID: 4f07c300ff068ff7755469e8b9dd4f006274509c0692e1405dc199bdeebd94a0
Instruction ID: 307efc370804042446f697f3c5d7d3943831dbbaaaa4afd654cc4b0de9e6c72b
Opcode Fuzzy Hash: 4f07c300ff068ff7755469e8b9dd4f006274509c0692e1405dc199bdeebd94a0
Instruction Fuzzy Hash: 2451B5B2A0021DAEDF259F25CC41AFA77B9EB54300F0881AAF915A62C1D7719E81DF74

Function 00DF8423 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 92COMMON

Download Yara Rule

Strings

monitor-list, xrefs: 00DF85E3
kbd-lang-list, xrefs: 00DF84D3
kbd-list, xrefs: 00DF84F5

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID:
String ID: kbd-lang-list$kbd-list$monitor-list
API String ID: 0-1393584692
Opcode ID: 9e3dc6d823800c3b6294b6e5fd45f857cbeae7b1a1aad647392ba259697db6d5
Instruction ID: 53f4024aa060fe13976823c78f48616cf880d6899bda2b72b5d526ac7d91c0c6
Opcode Fuzzy Hash: 9e3dc6d823800c3b6294b6e5fd45f857cbeae7b1a1aad647392ba259697db6d5
Instruction Fuzzy Hash: 3B31C732E0121DAACB20DB68DD46DDAB7E8EB04751F0545A5FE08E31D2DA70DA44AAE1

Function 00DC9962 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 82COMMON

Download Yara Rule

Strings

C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\interleaved.c, xrefs: 00DC9AFA
interleaved_compress, xrefs: 00DC9AF5
interleaved_compress: width (%u) or height (%u) is greater than 64, xrefs: 00DC9AF0
com.freerdp.codec, xrefs: 00DC9AD0

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID:
String ID: C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\interleaved.c$com.freerdp.codec$interleaved_compress$interleaved_compress: width (%u) or height (%u) is greater than 64
API String ID: 0-4054760794
Opcode ID: 50fd7e96157634b74ebe40d81ef02529f45ba464b295dff6b105378c327bc0fe
Instruction ID: c4d2591576e818b0d67891e845fedbadf495ad15037636ca0a3fa04f5ae1fde1
Opcode Fuzzy Hash: 50fd7e96157634b74ebe40d81ef02529f45ba464b295dff6b105378c327bc0fe
Instruction Fuzzy Hash: EB21F27230020ABBEF255E56DC8AFEB7B59EB00750F08411DF904970A0E672EC50DB71

Function 00DFE492 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 80COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010B70C8,00E04AA1,00000000,00000000), ref: 00E03CC8

Strings

sspi_InitializeSecurityContextW, xrefs: 00E03D28, 00E03D60, 00E03D65, 00E03D6B
[%s]: Security module does not provide an implementation, xrefs: 00E03D66
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00E03D2D, 00E03D6C
InitializeSecurityContextW: %s (0x%08X), xrefs: 00E03D23

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$InitializeSecurityContextW: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_InitializeSecurityContextW
API String ID: 689400697-743139187
Opcode ID: 785df52cfc7cd6eec4fc588064dbafc6182aed6f50fd422a44983c707f940d3d
Instruction ID: 7d36800df3c05358ea9e72348ddb2c4aac514a60aa2843b6816670efb665cc9f
Opcode Fuzzy Hash: 785df52cfc7cd6eec4fc588064dbafc6182aed6f50fd422a44983c707f940d3d
Instruction Fuzzy Hash: 0821C672280204BBDF225E65EC02EEB3F6DEB94B55F044155FF00B50E1D662DA60E771

Function 00DFE489 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 80COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010B70C8,00E04AA1,00000000,00000000), ref: 00E03DA3

Strings

InitializeSecurityContextA: %s (0x%08X), xrefs: 00E03DFE
[%s]: Security module does not provide an implementation, xrefs: 00E03E41
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00E03E08, 00E03E47
sspi_InitializeSecurityContextA, xrefs: 00E03E03, 00E03E3B, 00E03E40, 00E03E46

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$InitializeSecurityContextA: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_InitializeSecurityContextA
API String ID: 689400697-1744466472
Opcode ID: abef78815e0f20c67dd390d4b7fbc849a4065edd50e78c003621482003607b49
Instruction ID: 8f940c99f6b6b684b3d1328f2722adbea4ff7f14784ed137d33dff90c238283e
Opcode Fuzzy Hash: abef78815e0f20c67dd390d4b7fbc849a4065edd50e78c003621482003607b49
Instruction Fuzzy Hash: CB21A132240309BBDF221EA6EC02EAB3F6DEB95B51F004155FF04750E1D662CA61AB70

Function 00DFE413 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 77COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010B70C8,00E04AA1,00000000,00000000), ref: 00E03227

Strings

AcquireCredentialsHandleW: %s (0x%08X), xrefs: 00E03279
sspi_AcquireCredentialsHandleW, xrefs: 00E0327E, 00E032B6, 00E032BB, 00E032C1
[%s]: Security module does not provide an implementation, xrefs: 00E032BC
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00E03283, 00E032C2

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: AcquireCredentialsHandleW: %s (0x%08X)$C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$[%s]: Security module does not provide an implementation$sspi_AcquireCredentialsHandleW
API String ID: 689400697-2657764935
Opcode ID: 3eb997f24f72333c70f076e5984f5ca18bea18d8a35e47253eaa0b5716afe08f
Instruction ID: 173827018df4559dcdaef29f48671df2a795842ace217b4382328f3db930e477
Opcode Fuzzy Hash: 3eb997f24f72333c70f076e5984f5ca18bea18d8a35e47253eaa0b5716afe08f
Instruction Fuzzy Hash: 5A11B776244304BBDB225E62EC07EA73BADEB94B15F004055FF04750E1D562CA6097B1

Function 00DFE40A Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 77COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010B70C8,00E04AA1,00000000,00000000), ref: 00E032F9

Strings

sspi_AcquireCredentialsHandleA, xrefs: 00E03350, 00E03388, 00E0338D, 00E03393
AcquireCredentialsHandleA: %s (0x%08X), xrefs: 00E0334B
[%s]: Security module does not provide an implementation, xrefs: 00E0338E
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00E03355, 00E03394

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: AcquireCredentialsHandleA: %s (0x%08X)$C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$[%s]: Security module does not provide an implementation$sspi_AcquireCredentialsHandleA
API String ID: 689400697-1172745827
Opcode ID: 9a6a09ff23a9d76748e1fe5ca2953b76d7c19c3dea515be5120c9b00a13f7005
Instruction ID: 69f1188e31257c5cba8534d640ee658d7d736f87fbdad1bdff1fb258cfe074b5
Opcode Fuzzy Hash: 9a6a09ff23a9d76748e1fe5ca2953b76d7c19c3dea515be5120c9b00a13f7005
Instruction Fuzzy Hash: 2111E732244304BBDB222E62AC47EAB3F6DEB85B20F004055FF10750E1DA66CA60A7B0

Function 00DFE401 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 77COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010B70C8,00E04AA1,00000000,00000000), ref: 00E0384E

Strings

AcceptSecurityContext: %s (0x%08X), xrefs: 00E038A0
sspi_AcceptSecurityContext, xrefs: 00E038A5, 00E038DD, 00E038E2, 00E038E8
[%s]: Security module does not provide an implementation, xrefs: 00E038E3
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00E038AA, 00E038E9

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: AcceptSecurityContext: %s (0x%08X)$C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$[%s]: Security module does not provide an implementation$sspi_AcceptSecurityContext
API String ID: 689400697-2008077614
Opcode ID: 721d38bb76339ea58da7893951fe04bc8565899b770038497f23a10f30832a36
Instruction ID: 4cd46c0856a9c420ece3e1f1ee94f8de92a1b51a8ec2d517fabbfd1d1be101fc
Opcode Fuzzy Hash: 721d38bb76339ea58da7893951fe04bc8565899b770038497f23a10f30832a36
Instruction Fuzzy Hash: B011DA76240308BBDF265E66AC07EA73F6DEB84B51F004055FF00750E1D666CA61D771

Function 00DFE4FE Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010B70C8,00E04AA1,00000000,00000000), ref: 00E04544

Strings

sspi_VerifySignature, xrefs: 00E0458C, 00E045C4, 00E045C9, 00E045CF
[%s]: Security module does not provide an implementation, xrefs: 00E045CA
VerifySignature: %s (0x%08X), xrefs: 00E04587
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00E04591, 00E045D0

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$VerifySignature: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_VerifySignature
API String ID: 689400697-1495805676
Opcode ID: 788b6e8829d9483b934885d33dc0578010206675a62603c38f35035888a4f3c2
Instruction ID: 1854f6f0c11e22153e2f82ff8692c7bf5bbc62cd04a4c41288bc63cff5151376
Opcode Fuzzy Hash: 788b6e8829d9483b934885d33dc0578010206675a62603c38f35035888a4f3c2
Instruction Fuzzy Hash: BB11E7F6384304BBDB216A66AD47FA73FA8DB81B51F004065FF00B61D1D9A2CE5097B5

Function 00DFE4F5 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010B70C8,00E04AA1,00000000,00000000), ref: 00E040BB

Strings

sspi_SetContextAttributesW, xrefs: 00E04103, 00E0413B, 00E04140, 00E04146
[%s]: Security module does not provide an implementation, xrefs: 00E04141
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00E04108, 00E04147
SetContextAttributesW: %s (0x%08X), xrefs: 00E040FE

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$SetContextAttributesW: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_SetContextAttributesW
API String ID: 689400697-247170817
Opcode ID: 398d249cd69bf1bd998121c62fa7bdd2c98571b69894721aae70bbbe593d3559
Instruction ID: 02ad2101e534df98371a69a63abd31425e1f91e971ae3a0db1e4d7293bca8d49
Opcode Fuzzy Hash: 398d249cd69bf1bd998121c62fa7bdd2c98571b69894721aae70bbbe593d3559
Instruction Fuzzy Hash: D7112BB63803057BDA216A62ED43F673B6CD7D1B12F004055FF00B60D2D9A6C9A09771

Function 00DFE4EC Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010B70C8,00E04AA1,00000000,00000000), ref: 00E0417E

Strings

SetContextAttributesA: %s (0x%08X), xrefs: 00E041C1
sspi_SetContextAttributesA, xrefs: 00E041C6, 00E041FE, 00E04203, 00E04209
[%s]: Security module does not provide an implementation, xrefs: 00E04204
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00E041CB, 00E0420A

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$SetContextAttributesA: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_SetContextAttributesA
API String ID: 689400697-1164902870
Opcode ID: fdc7db505d5f01b502ca50533082607e13dbcaa30e819bc86a230968a577bc8a
Instruction ID: 89df9ea8932650c3d82e91edcd432b72e7ccb9035283a99a6bf7fc8510f5db55
Opcode Fuzzy Hash: fdc7db505d5f01b502ca50533082607e13dbcaa30e819bc86a230968a577bc8a
Instruction Fuzzy Hash: 97112BB53843057BD6216A62BD03F673F6CD7D0B51F004055FF00B51E1E992CA9097B1

Function 00DFE49B Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010B70C8,00E04AA1,00000000,00000000), ref: 00E04481

Strings

sspi_MakeSignature, xrefs: 00E044C9, 00E04501, 00E04506, 00E0450C
MakeSignature: %s (0x%08X), xrefs: 00E044C4
[%s]: Security module does not provide an implementation, xrefs: 00E04507
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00E044CE, 00E0450D

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$MakeSignature: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_MakeSignature
API String ID: 689400697-3834539683
Opcode ID: b20dfd83d92de4ed8971d1895b1680752925e32be867fbf18e4e4da000a432e4
Instruction ID: 8c1b39b6715d39c451f5528e43b34d1e1d7ca3481b827965d5f4b31cf24a29b8
Opcode Fuzzy Hash: b20dfd83d92de4ed8971d1895b1680752925e32be867fbf18e4e4da000a432e4
Instruction Fuzzy Hash: 6E11E7F5380304BBDA212A56AD43FA73B68DBC1B61F044055FF00B61D1E992CE90E7B1

Function 00DFE452 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010B70C8,00E04AA1,00000000,00000000), ref: 00E033CB

Strings

sspi_ExportSecurityContext, xrefs: 00E03413, 00E0344B, 00E03450, 00E03456
[%s]: Security module does not provide an implementation, xrefs: 00E03451
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00E03418, 00E03457
ExportSecurityContext: %s (0x%08X), xrefs: 00E0340E

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$ExportSecurityContext: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_ExportSecurityContext
API String ID: 689400697-3640258815
Opcode ID: 7915c698f91c40f0bece1cb9b4d2b00c4969b57e8ba1a9641249edbfd8e7af8b
Instruction ID: c97eb1005b35ab0bf0727450e2b48a0376ae8b787e76583b4612412509c86b63
Opcode Fuzzy Hash: 7915c698f91c40f0bece1cb9b4d2b00c4969b57e8ba1a9641249edbfd8e7af8b
Instruction Fuzzy Hash: 83110A753843047BDA221A66AC47FA73B6CEBC1B51F004055FF10BA0E1D9A2CA549771

Function 00DFE476 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010B70C8,00E04AA1,00000000,00000000), ref: 00E03548

Strings

sspi_ImportSecurityContextW, xrefs: 00E03590, 00E035C8, 00E035CD, 00E035D3
ImportSecurityContextW: %s (0x%08X), xrefs: 00E0358B
[%s]: Security module does not provide an implementation, xrefs: 00E035CE
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00E03595, 00E035D4

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$ImportSecurityContextW: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_ImportSecurityContextW
API String ID: 689400697-3257054040
Opcode ID: 8a47d3a8bc2d7ec2bfb180b0b7265ca1aa23011132c5c2cb8bbd081baedf3872
Instruction ID: b75c77ac3897523015c6dc4921e4c3962b6c5f93ca3a86402d16afca149959b4
Opcode Fuzzy Hash: 8a47d3a8bc2d7ec2bfb180b0b7265ca1aa23011132c5c2cb8bbd081baedf3872
Instruction Fuzzy Hash: 4211E7753843047BDA311A66EC47FA73B6CEB81B51F004055FF00B60E1ED92CA549771

Function 00DFE46D Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010B70C8,00E04AA1,00000000,00000000), ref: 00E0360B

Strings

sspi_ImportSecurityContextA, xrefs: 00E03653, 00E0368B, 00E03690, 00E03696
[%s]: Security module does not provide an implementation, xrefs: 00E03691
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00E03658, 00E03697
ImportSecurityContextA: %s (0x%08X), xrefs: 00E0364E

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$ImportSecurityContextA: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_ImportSecurityContextA
API String ID: 689400697-848437295
Opcode ID: 95c1b5ee101259a7c6217a81149672afdf5776c521f2c3102e14e59083bcfe84
Instruction ID: 17213b2a3d8daf8aee90f35ed11633aca5ba80ee569daaf3f5d39eafc6d67a91
Opcode Fuzzy Hash: 95c1b5ee101259a7c6217a81149672afdf5776c521f2c3102e14e59083bcfe84
Instruction Fuzzy Hash: E911C475380304BBDA215A66BC47FAB3B6CDB81B61F000155FF00B61E1DA92CA91A7B5

Function 00DD1A7D Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 71COMMON

Download Yara Rule

APIs

ncrush_context_reset.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(00000000,00000000), ref: 00DD1B36

Strings

C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\ncrush.c, xrefs: 00DD1B19
ncrush_context_new: failed to initialize tables, xrefs: 00DD1B0F
com.freerdp.codec, xrefs: 00DD1AF1
ncrush_context_new, xrefs: 00DD1B14

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: ncrush_context_reset
String ID: C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\ncrush.c$com.freerdp.codec$ncrush_context_new$ncrush_context_new: failed to initialize tables
API String ID: 2838332675-904927664
Opcode ID: dd4c0d16fe61395582271169b9e8eb7598a63a02f19028b996fec103fdbe90c0
Instruction ID: beba3b4fc3eba48f46abf42c506ab04094fdb73d9c6e0d36d0106e34c6276f4c
Opcode Fuzzy Hash: dd4c0d16fe61395582271169b9e8eb7598a63a02f19028b996fec103fdbe90c0
Instruction Fuzzy Hash: A5110B722407063AE714AB159C82FA6779CEB51754F10411EF604A6781EBB6E9508BF1

Function 00DFE4BF Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 71COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010B70C8,00E04AA1,00000000,00000000), ref: 00E036CE

Strings

sspi_QueryCredentialsAttributesW, xrefs: 00E03713, 00E0374B, 00E03750, 00E03756
QueryCredentialsAttributesW: %s (0x%08X), xrefs: 00E0370E
[%s]: Security module does not provide an implementation, xrefs: 00E03751
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00E03718, 00E03757

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$QueryCredentialsAttributesW: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_QueryCredentialsAttributesW
API String ID: 689400697-3413647607
Opcode ID: ac147f90a03cd7c5ecb50d373f97d2284cf75a84b6259cb36074d330fbb44d3d
Instruction ID: 1f93c1e62aca8b5aa1fab2c5e92a257cd6e8f185edc6c2dd37d45793c667092e
Opcode Fuzzy Hash: ac147f90a03cd7c5ecb50d373f97d2284cf75a84b6259cb36074d330fbb44d3d
Instruction Fuzzy Hash: 8B110AB53803047BD6211666EC47F673BACDBD1B51F04405AFF00BA0E1E9A2CA519771

Function 00DFE4B6 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 71COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010B70C8,00E04AA1,00000000,00000000), ref: 00E0378E

Strings

QueryCredentialsAttributesA: %s (0x%08X), xrefs: 00E037CE
sspi_QueryCredentialsAttributesA, xrefs: 00E037D3, 00E0380B, 00E03810, 00E03816
[%s]: Security module does not provide an implementation, xrefs: 00E03811
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00E037D8, 00E03817

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$QueryCredentialsAttributesA: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_QueryCredentialsAttributesA
API String ID: 689400697-3754301720
Opcode ID: f2d8d9d397df3ecaa2fa56205f0c0f526ae4ad2ea36a5c1a913f65931ec80cd7
Instruction ID: d8451882a8727ccb35f225b6fb8f077afb1de6fba4b1866b77e943b20680e781
Opcode Fuzzy Hash: f2d8d9d397df3ecaa2fa56205f0c0f526ae4ad2ea36a5c1a913f65931ec80cd7
Instruction Fuzzy Hash: 80110AB53803047BE6211666EC47FA73BACE7D1B55F044056FF00B51D1D9A2CA519771

Function 00DFE4AD Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 71COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010B70C8,00E04AA1,00000000,00000000), ref: 00E03E7E

Strings

sspi_QueryContextAttributesW, xrefs: 00E03EC3, 00E03EFB, 00E03F00, 00E03F06
[%s]: Security module does not provide an implementation, xrefs: 00E03F01
QueryContextAttributesW: %s (0x%08X), xrefs: 00E03EBE
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00E03EC8, 00E03F07

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$QueryContextAttributesW: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_QueryContextAttributesW
API String ID: 689400697-2578917824
Opcode ID: 7c29ffc9d3cddbad3df294ef495125a3233d290cac61f34d990654ec7ca25c1f
Instruction ID: b89ae09209c657fc03ae238c0d15c778f85775dc7531ae558fb41858f6cd34d6
Opcode Fuzzy Hash: 7c29ffc9d3cddbad3df294ef495125a3233d290cac61f34d990654ec7ca25c1f
Instruction Fuzzy Hash: AB112776384304BBDA315636EC43FA73B6CE7D0F61F004156FA00BA0D1D992CA519771

Function 00DFE4A4 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 71COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010B70C8,00E04AA1,00000000,00000000), ref: 00E03F3E

Strings

[%s]: Security module does not provide an implementation, xrefs: 00E03FC1
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00E03F88, 00E03FC7
QueryContextAttributesA: %s (0x%08X), xrefs: 00E03F7E
sspi_QueryContextAttributesA, xrefs: 00E03F83, 00E03FBB, 00E03FC0, 00E03FC6

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$QueryContextAttributesA: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_QueryContextAttributesA
API String ID: 689400697-3211427146
Opcode ID: f9aecb23def338c81b86c51d61c5334665e79e8f670f160e252b10d1f503a53c
Instruction ID: 82ce4aa88d5a18f403c1288813402bf7dcef4421a3992b6231e1c0627ad71ed8
Opcode Fuzzy Hash: f9aecb23def338c81b86c51d61c5334665e79e8f670f160e252b10d1f503a53c
Instruction Fuzzy Hash: 8D11E775384305BBD6216676AC03FAB3F6DDBC1B51F044156FF00B61D1D9A2CA509771

Function 00DFE4DA Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010B70C8,00E04AA1,00000000,00000000), ref: 00E030AD

Strings

[%s]: Security module does not provide an implementation, xrefs: 00E0312D
QuerySecurityPackageInfoW: %s (0x%08X), xrefs: 00E030EA
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00E030F4, 00E03133
sspi_QuerySecurityPackageInfoW, xrefs: 00E030EF, 00E03127, 00E0312C, 00E03132

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$QuerySecurityPackageInfoW: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_QuerySecurityPackageInfoW
API String ID: 689400697-2261828479
Opcode ID: 40f86a71e5edc2d9ae1707d2d49f1982ac5847dbb323b959089612198fa72371
Instruction ID: f949225d7c5fd26464ff2888f51fe9747ab48896737d1a51cf2cdbf30f1b1360
Opcode Fuzzy Hash: 40f86a71e5edc2d9ae1707d2d49f1982ac5847dbb323b959089612198fa72371
Instruction Fuzzy Hash: D511E3753843047AE6216666BC07FA73BACD785B25F004095BB00BA0D1E992CA9096B1

Function 00DFE4D1 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010B70C8,00E04AA1,00000000,00000000), ref: 00E0316A

Strings

sspi_QuerySecurityPackageInfoA, xrefs: 00E031AC, 00E031E4, 00E031E9, 00E031EF
[%s]: Security module does not provide an implementation, xrefs: 00E031EA
QuerySecurityPackageInfoA: %s (0x%08X), xrefs: 00E031A7
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00E031B1, 00E031F0

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$QuerySecurityPackageInfoA: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_QuerySecurityPackageInfoA
API String ID: 689400697-3351603741
Opcode ID: eb86fb552f74086d355d4f6ee98bef7853de99a51c3fc32d4b10db63e4c69064
Instruction ID: e3be154f4ee910019155492a4d8eea4949b5e11ccf40fc7865ac3bc2576d5623
Opcode Fuzzy Hash: eb86fb552f74086d355d4f6ee98bef7853de99a51c3fc32d4b10db63e4c69064
Instruction Fuzzy Hash: ED1106753843047AD6212666BC47FA73FACD7D1B11F004065FF00BA1D2DA92CA5097B1

Function 00DFE4C8 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010B70C8,00E04AA1,00000000,00000000), ref: 00E03FFE

Strings

QuerySecurityContextToken: %s (0x%08X), xrefs: 00E0403B
sspi_QuerySecurityContextToken, xrefs: 00E04040, 00E04078, 00E0407D, 00E04083
[%s]: Security module does not provide an implementation, xrefs: 00E0407E
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00E04045, 00E04084

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$QuerySecurityContextToken: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_QuerySecurityContextToken
API String ID: 689400697-2156878011
Opcode ID: 627b41e8174c6f97d1f0acd8c4013dcba8c85a384b5e71c4b6515a4ad980bb89
Instruction ID: 35a885abbb922d20903123f96a9fb6b5854e5cd3f1aa65dfc43777ccaa97b9d0
Opcode Fuzzy Hash: 627b41e8174c6f97d1f0acd8c4013dcba8c85a384b5e71c4b6515a4ad980bb89
Instruction Fuzzy Hash: 9A1106B5384305BBD6316626AC07FA73B6CDBC1B51F004066FF00FA0D1D992CA5096B1

Function 00DFE449 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010B70C8,00E04AA1,00000000,00000000), ref: 00E02F33

Strings

EnumerateSecurityPackagesW: %s (0x%08X), xrefs: 00E02F70
[%s]: Security module does not provide an implementation, xrefs: 00E02FB3
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00E02F7A, 00E02FB9
sspi_EnumerateSecurityPackagesW, xrefs: 00E02F75, 00E02FAD, 00E02FB2, 00E02FB8

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$EnumerateSecurityPackagesW: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_EnumerateSecurityPackagesW
API String ID: 689400697-255015424
Opcode ID: c09ccdf330ea6b879c90ef1e1f42297d3c2f00d1e012119188ba4d8e8ea7dc49
Instruction ID: 7e09c7ef2aea252e62eaeb03ad5dbd7cb47b78a3f2ab02eb10dc1169e0ccc792
Opcode Fuzzy Hash: c09ccdf330ea6b879c90ef1e1f42297d3c2f00d1e012119188ba4d8e8ea7dc49
Instruction Fuzzy Hash: 0111C6753883057BD6212666AC4BFA73BADDBD1B61F00405AFF04BA0E1D992C99097B1

Function 00DFE440 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010B70C8,00E04AA1,00000000,00000000), ref: 00E02FF0

Strings

EnumerateSecurityPackagesA: %s (0x%08X), xrefs: 00E0302D
sspi_EnumerateSecurityPackagesA, xrefs: 00E03032, 00E0306A, 00E0306F, 00E03075
[%s]: Security module does not provide an implementation, xrefs: 00E03070
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00E03037, 00E03076

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$EnumerateSecurityPackagesA: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_EnumerateSecurityPackagesA
API String ID: 689400697-1149382491
Opcode ID: 79b4b4a6dbba7fa1c3f7018f5ea45042e0ef402e26aa1ae6022a8ea6ef0435db
Instruction ID: f03dc6f52b89a4a2587520f9615acd79b9aed2cbf1ef03ff8b2144c6cea9d4bc
Opcode Fuzzy Hash: 79b4b4a6dbba7fa1c3f7018f5ea45042e0ef402e26aa1ae6022a8ea6ef0435db
Instruction Fuzzy Hash: B711A7753843047BD6312666AC47EA73B6DDB81B55F004195FF04B90D1D592CE509671

Function 00DFE41C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010B70C8,00E04AA1,00000000,00000000), ref: 00E03920

Strings

sspi_ApplyControlToken, xrefs: 00E03962, 00E0399A, 00E0399F, 00E039A5
[%s]: Security module does not provide an implementation, xrefs: 00E039A0
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00E03967, 00E039A6
ApplyControlToken: %s (0x%08X), xrefs: 00E0395D

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: ApplyControlToken: %s (0x%08X)$C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$[%s]: Security module does not provide an implementation$sspi_ApplyControlToken
API String ID: 689400697-2845897268
Opcode ID: 0a5b5be24c0c80e3b1cb04046a28c7dd84e954767d32631e6649245c697c9df9
Instruction ID: c9a262f21bc0ee85ef2ef1a1bc29f67144f0bf9d590c7ae60ec5f8eda7167965
Opcode Fuzzy Hash: 0a5b5be24c0c80e3b1cb04046a28c7dd84e954767d32631e6649245c697c9df9
Instruction Fuzzy Hash: F611C675384304BBEA212666AC47FA73FACD7D1B61F004169FA00BA4D1D9D2CA5096B1

Function 00DFE425 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010B70C8,00E04AA1,00000000,00000000), ref: 00E039DD

Strings

sspi_CompleteAuthToken, xrefs: 00E03A1F, 00E03A57, 00E03A5C, 00E03A62
CompleteAuthToken: %s (0x%08X), xrefs: 00E03A1A
[%s]: Security module does not provide an implementation, xrefs: 00E03A5D
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00E03A24, 00E03A63

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$CompleteAuthToken: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_CompleteAuthToken
API String ID: 689400697-1972714555
Opcode ID: a936c5bb09e438b8043da600c46f84eb1c84d9bd623f4ee43fd16030dee1b19d
Instruction ID: 974e13861795aee0ceaa6ecd6eb29493c80680e9f36af351abfd43a3b65f6cef
Opcode Fuzzy Hash: a936c5bb09e438b8043da600c46f84eb1c84d9bd623f4ee43fd16030dee1b19d
Instruction Fuzzy Hash: 9A11C2753843047BEA216667AC47FA73F6CDBC1F61F004169FB44BA0D1E992CB5096B1

Function 00DD954D Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

freerdp_image_copy.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00DD95B5

Strings

SmartScaling requested but compiled without libcairo support!, xrefs: 00DD95E6
C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\color.c, xrefs: 00DD95F0
freerdp_image_scale, xrefs: 00DD95EB
com.freerdp.color, xrefs: 00DD95C8

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: freerdp_image_copy
String ID: C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\color.c$SmartScaling requested but compiled without libcairo support!$com.freerdp.color$freerdp_image_scale
API String ID: 1523062921-212429655
Opcode ID: 6bacb9b6c69f2dc0acbf9d6f6d182a5388dfd8ffedbaa361a2a0b849ae98e456
Instruction ID: da262c508d44f879c1ce855f4935c9c150801359068e75d88048c5ba9ba8c3af
Opcode Fuzzy Hash: 6bacb9b6c69f2dc0acbf9d6f6d182a5388dfd8ffedbaa361a2a0b849ae98e456
Instruction Fuzzy Hash: DA21D67234020DBBDF1A9F14DC52FEE3BA9EB54700F088119FD049A290E276E950DF60

Function 00DFE4E3 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 69COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010B70C8,00E04AA1,00000000,00000000), ref: 00E04241

Strings

RevertSecurityContext: %s (0x%08X), xrefs: 00E0427B
sspi_RevertSecurityContext, xrefs: 00E04280, 00E042B8, 00E042BD, 00E042C3
[%s]: Security module does not provide an implementation, xrefs: 00E042BE
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00E04285, 00E042C4

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$RevertSecurityContext: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_RevertSecurityContext
API String ID: 689400697-954186549
Opcode ID: b83cb336a58a3dc7b0adf39ba78c3e66cd3ae5c8ac41c5088508aa7f211bcc26
Instruction ID: 391190263da31bf30fbd5fa2ee12827cf47567c8c28aaee18c7e6c09ff4292f1
Opcode Fuzzy Hash: b83cb336a58a3dc7b0adf39ba78c3e66cd3ae5c8ac41c5088508aa7f211bcc26
Instruction Fuzzy Hash: 7F11C2F53843047BE6212666BD47FA73BACD7D1B61F040066BF00BA0E1E992CA9096B5

Function 00DFE45B Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 69COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010B70C8,00E04AA1,00000000,00000000), ref: 00E03B54

Strings

[%s]: Security module does not provide an implementation, xrefs: 00E03BD1
sspi_FreeContextBuffer, xrefs: 00E03B93, 00E03BCB, 00E03BD0, 00E03BD6
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00E03B98, 00E03BD7
FreeContextBuffer: %s (0x%08X), xrefs: 00E03B8E

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$FreeContextBuffer: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_FreeContextBuffer
API String ID: 689400697-1791514552
Opcode ID: beb725c28e5f1f5bccf68e1ec0a1d72cce173395264323e014b30137ef4ec629
Instruction ID: 4627cf721af79c85df829a560f0b105dcb3c801e4c8e62544174e04bdf3ab03d
Opcode Fuzzy Hash: beb725c28e5f1f5bccf68e1ec0a1d72cce173395264323e014b30137ef4ec629
Instruction Fuzzy Hash: 881102753843047BE6212666AC43FA73EACD7C1B55F0040A9FB00BA0D1ED92CE409AB1

Function 00DFE464 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 69COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010B70C8,00E04AA1,00000000,00000000), ref: 00E03C0E

Strings

ImpersonateSecurityContext: %s (0x%08X), xrefs: 00E03C48
sspi_ImpersonateSecurityContext, xrefs: 00E03C4D, 00E03C85, 00E03C8A, 00E03C90
[%s]: Security module does not provide an implementation, xrefs: 00E03C8B
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00E03C52, 00E03C91

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$ImpersonateSecurityContext: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_ImpersonateSecurityContext
API String ID: 689400697-4242683877
Opcode ID: 9f8b91eafb333a873a49667ff9389e738cd5d3c49e376275544f1f23128e48d9
Instruction ID: 24646cc1b506cd03bd941ebfae608c7a7b423a3c8d818c4dde75a27216a1cc09
Opcode Fuzzy Hash: 9f8b91eafb333a873a49667ff9389e738cd5d3c49e376275544f1f23128e48d9
Instruction Fuzzy Hash: 2711C275384304BBE6212636AD87FA73FACDBD1F51F005066BE00FA0E1D992CB9196B1

Function 00DFE510 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 69COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010B70C8,00E04AA1,00000000,00000000), ref: 00E0348E

Strings

FreeCredentialsHandle: %s (0x%08X), xrefs: 00E034C8
sspi_FreeCredentialsHandle, xrefs: 00E034CD, 00E03505, 00E0350A, 00E03510
[%s]: Security module does not provide an implementation, xrefs: 00E0350B
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00E034D2, 00E03511

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$FreeCredentialsHandle: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_FreeCredentialsHandle
API String ID: 689400697-3116451197
Opcode ID: af9c714e6d2f2f6b1b88a0cd67a1c854eae1ff9b5543e05f400cf4030aee1bd6
Instruction ID: 11a5d1cf7f04a515c32108f7bb45663780682569bb61f9c60903aac126ef116e
Opcode Fuzzy Hash: af9c714e6d2f2f6b1b88a0cd67a1c854eae1ff9b5543e05f400cf4030aee1bd6
Instruction Fuzzy Hash: B2112575384304BBE6322636BC47F673B6CD7C1B51F008066FB00BA0D1D992CA8096B1

Function 00DFE507 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 69COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(010B70C8,00E04AA1,00000000,00000000), ref: 00E03A9A

Strings

sspi_DeleteSecurityContext, xrefs: 00E03AD9, 00E03B11, 00E03B16, 00E03B1C
[%s]: Security module does not provide an implementation, xrefs: 00E03B17
C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c, xrefs: 00E03ADE, 00E03B1D
DeleteSecurityContext: %s (0x%08X), xrefs: 00E03AD4

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: C:\Project\agent-windows\freerdp\FreeRDP\winpr\libwinpr\sspi\sspi.c$DeleteSecurityContext: %s (0x%08X)$[%s]: Security module does not provide an implementation$sspi_DeleteSecurityContext
API String ID: 689400697-4185332897
Opcode ID: 318fe17660f4d0f9ce62cfc08f44648c6f9dc117876b017969b535a265bdc97b
Instruction ID: 1c6e94b35f6e66cfc76016706c348a4500bf53cf04bb6363b500da283f8abf69
Opcode Fuzzy Hash: 318fe17660f4d0f9ce62cfc08f44648c6f9dc117876b017969b535a265bdc97b
Instruction Fuzzy Hash: 4B1125753803047BE6321666AC43FA73BACD7D1B55F000169FB00BA0E1E992CA8096B1

Function 00E865C5 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 52COMMON

Download Yara Rule

APIs

primitives_get.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE ref: 00E865CB

Strings

error when decoding lines, xrefs: 00E86629
com.freerdp.codec, xrefs: 00E8660B
yuv_process_work_callback, xrefs: 00E8662E
C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\yuv.c, xrefs: 00E86633

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: primitives_get
String ID: C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\yuv.c$com.freerdp.codec$error when decoding lines$yuv_process_work_callback
API String ID: 2017034601-2620645302
Opcode ID: be206209256d5c2a1d83997dc8ade0252070c8f3819e835ec4385b9f70e9bbca
Instruction ID: 07b03ba42d6ef33b4b7ea5f523df993750703fe4e8f11b864222e6087280b314
Opcode Fuzzy Hash: be206209256d5c2a1d83997dc8ade0252070c8f3819e835ec4385b9f70e9bbca
Instruction Fuzzy Hash: 480188B1600209BFDB14EF54DC02F59B7A8FF04718F044159F908DA281EA75E9409FA4

Function 00DD9EF7 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

region16_extents.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?), ref: 00DD9F06
region16_extents.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,?), ref: 00DD9F12
region16_n_rects.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,?,?), ref: 00DD9F1D
region16_n_rects.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?), ref: 00DD9F7D

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: region16_extentsregion16_n_rects
String ID:
API String ID: 2062899502-0
Opcode ID: a777aa3e440b79e1151d2e5a78892d79e860e14bb9abc1479bfd8844a7d2d6d9
Instruction ID: ff3251cd3845f18dcedadbee102a93d9f5365af45d90bc9952ee1b356d2a54f1
Opcode Fuzzy Hash: a777aa3e440b79e1151d2e5a78892d79e860e14bb9abc1479bfd8844a7d2d6d9
Instruction Fuzzy Hash: DC512A75A00229ABCB14DF99C8408AEF7F5FF18710B55816AE859E7350E335EE40CBB0

Function 007F8E40 Relevance: 7.6, APIs: 5, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(01031278,007F8C90,007F8EC0,00000000), ref: 007F8E6A
GetLastError.KERNEL32 ref: 007F8E7F
TlsGetValue.KERNEL32 ref: 007F8E8D
SetLastError.KERNEL32(00000000), ref: 007F8E96
TlsAlloc.KERNEL32 ref: 007F8EC3

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: ErrorLastOnce$AllocExecuteInitValue
String ID:
API String ID: 2822033501-0
Opcode ID: 218737cbd98c92ea9ac25f7389441bf482b784913dfd8dc2d9e5e48b3e742bd8
Instruction ID: aa21d26674f977902d8678e0c2b128f016c72a3e90c229c33f885b4d29b81cf4
Opcode Fuzzy Hash: 218737cbd98c92ea9ac25f7389441bf482b784913dfd8dc2d9e5e48b3e742bd8
Instruction Fuzzy Hash: E001C4B560020C9FCB109FBAEC49A7A77BCFB48B11B400126F915E7390EB3599148B61

Function 00E849E4 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 80COMMON

Download Yara Rule

APIs

audio_format_print.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,?,?), ref: 00E84A72

Strings

AUDIO_FORMATS (%hu) ={, xrefs: 00E84A12
audio_formats_print, xrefs: 00E84A17, 00E84A54, 00E84A95
C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\audio.c, xrefs: 00E84A1C, 00E84A59, 00E84A9A

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: audio_format_print
String ID: AUDIO_FORMATS (%hu) ={$C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\audio.c$audio_formats_print
API String ID: 2744001552-3527835062
Opcode ID: 469cdea7ea94f545fa889bebaced8301b8506f0abd8f0b7f64337f96432234d7
Instruction ID: 85ca4e98aa9667cbc41438f6ec066f143b2cc9c6814acea986d5db735117f37a
Opcode Fuzzy Hash: 469cdea7ea94f545fa889bebaced8301b8506f0abd8f0b7f64337f96432234d7
Instruction Fuzzy Hash: A711A57228031636EA15AE155C42FBB275CDF65B64F054055F91CB51C1F6A1D60093B6

Function 00D811D7 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

getChannelError.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?), ref: 00D81248

Strings

ChannelDetached, xrefs: 00D8127F
freerdp, xrefs: 00D81278
(, xrefs: 00D81295

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: ChannelError
String ID: ($ChannelDetached$freerdp
API String ID: 1163697128-436519898
Opcode ID: a006e5e7a51db26b93f7661fcccfff10dda9af0a014f0123755cedd56f395108
Instruction ID: c3931973b23fcbaa03208bddbd36b11154284898f8180c5aa55eb4a9faa787c9
Opcode Fuzzy Hash: a006e5e7a51db26b93f7661fcccfff10dda9af0a014f0123755cedd56f395108
Instruction Fuzzy Hash: 28213D75A00209AFDB14DF98C885FAEBBF9FF08344F104469E944EB251D770AA559FA0

Function 00D80B41 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

getChannelError.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?), ref: 00D80BB2

Strings

ChannelAttached, xrefs: 00D80BE9
(, xrefs: 00D80BFF
freerdp, xrefs: 00D80BE2

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: ChannelError
String ID: ($ChannelAttached$freerdp
API String ID: 1163697128-2646891115
Opcode ID: 23f8440526368138a212b801aa2f18db117d3513822fd8d38211a1bf625ea9a6
Instruction ID: 03e41d898db8630cf79cc1408b935dbfc0a25378c0ea30e0e3489fe5375abc75
Opcode Fuzzy Hash: 23f8440526368138a212b801aa2f18db117d3513822fd8d38211a1bf625ea9a6
Instruction Fuzzy Hash: D2212C71A00209EFDB04DF98C885FAEBBF4FF08354F144569E948A7252E770AA549BA0

Function 00DF783A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 56COMMON

Download Yara Rule

Strings

audin, xrefs: 00DF78F8
rdpsnd, xrefs: 00DF78CA

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID:
String ID: audin$rdpsnd
API String ID: 0-930729200
Opcode ID: 7c0475cd44f4378e9d802355989a63adfe1fc79135141be04c7e1e40ca039450
Instruction ID: 746a1651418015a59008aa02da6c3b5b8b488c6eb49de794faa7684a37f93d01
Opcode Fuzzy Hash: 7c0475cd44f4378e9d802355989a63adfe1fc79135141be04c7e1e40ca039450
Instruction Fuzzy Hash: 3F113331A09A1AEBD725CF24C8806FAF3B4FB05B51F1A822AE55957140D771A990CBE1

Function 00E84701 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

audio_format_get_tag_string.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,?,?,?,?,?,?,?), ref: 00E84737

Strings

%s: wFormatTag: 0x%04hX nChannels: %hu nSamplesPerSec: %u nAvgBytesPerSec: %u nBlockAlign: %hu wBitsPerSample: %hu cbSize: %hu, xrefs: 00E8473E
C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\audio.c, xrefs: 00E84748
audio_format_print, xrefs: 00E84743

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: audio_format_get_tag_string
String ID: %s: wFormatTag: 0x%04hX nChannels: %hu nSamplesPerSec: %u nAvgBytesPerSec: %u nBlockAlign: %hu wBitsPerSample: %hu cbSize: %hu$C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\codec\audio.c$audio_format_print
API String ID: 2866491501-3564663344
Opcode ID: 2475ba101f63905f6d37d95513fe2099d7c62e20fb913483872a2c8de66ab3fb
Instruction ID: 88fea08070abfbc029ec749b4ec6d41bcb74a77b41745714fe7b44c9deb5004d
Opcode Fuzzy Hash: 2475ba101f63905f6d37d95513fe2099d7c62e20fb913483872a2c8de66ab3fb
Instruction Fuzzy Hash: 5DF030B6140208BAEB411F91CC02E76376DEB48B14B25C049FD5C9C1E1E677D9A2E774

Function 00D72713 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

freerdp_get_last_error.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?), ref: 00D72725
freerdp_set_last_error_ex.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,0002000B,freerdp_abort_connect,C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\freerdp.c,0000013A), ref: 00D72745

Strings

C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\freerdp.c, xrefs: 00D72734
freerdp_abort_connect, xrefs: 00D72739

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: freerdp_get_last_errorfreerdp_set_last_error_ex
String ID: C:\Project\agent-windows\freerdp\FreeRDP\libfreerdp\core\freerdp.c$freerdp_abort_connect
API String ID: 3690923134-629580617
Opcode ID: c89517776bdef020685ac3a0d5a535b7997bf2836c2efd4f17917781079dce91
Instruction ID: 3e483461d959f097493b4fb8f786710372bb84b75f3234a5c8604d94ffbb4019
Opcode Fuzzy Hash: c89517776bdef020685ac3a0d5a535b7997bf2836c2efd4f17917781079dce91
Instruction Fuzzy Hash: 22E0D831240250EBDB252D11ED43B65F794DF00B90F188425B5CC75091FB619E41A6B1

Function 00E8632D Relevance: 6.2, APIs: 4, Instructions: 174COMMON

Download Yara Rule

APIs

primitives_get.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE ref: 00E8633F
primitives_flags.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(00000000), ref: 00E86353
TpWaitForWork.NTDLL(00000000,00000000), ref: 00E864A9
TpReleaseWork.NTDLL(00000000), ref: 00E864B2

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: Work$ReleaseWaitprimitives_flagsprimitives_get
String ID:
API String ID: 704174238-0
Opcode ID: 669a40efe36c93a0e64fbc65839f32cd71568a1e7ebdd754390572d5576e0212
Instruction ID: b14d2b615812f11ab264950629c94043957f40ac8d9c3d494ab69b6eac0631f6
Opcode Fuzzy Hash: 669a40efe36c93a0e64fbc65839f32cd71568a1e7ebdd754390572d5576e0212
Instruction Fuzzy Hash: C36117B5A0060ADFCB14DFA8C981AAEBBF5FF48314B14856AE819E7350D730E955CF90

Function 00DDC297 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

gdi_SetRgn.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,?,?,?,00000000,00000001,?,?), ref: 00DDC324

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: gdi_
String ID:
API String ID: 2273374161-0
Opcode ID: 2ead09a44aba127efa6001147bae376ec00e50ab3ae76740fbfd5d3136eef1b6
Instruction ID: 04db80fd660321166dea62bcb205c9655d5be6cf9fcd2f4ca1d7da2ccbbd93c9
Opcode Fuzzy Hash: 2ead09a44aba127efa6001147bae376ec00e50ab3ae76740fbfd5d3136eef1b6
Instruction Fuzzy Hash: 1C31B7B5910209EFCB10DF98C9859AEB7FAFF48314F14816AE915E7211D335EA45CBA0

Function 00E05C02 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 00E05C16
RtlLeaveCriticalSection.NTDLL(?), ref: 00E05C34
RtlLeaveCriticalSection.NTDLL(?), ref: 00E05C54
RtlLeaveCriticalSection.NTDLL(?), ref: 00E05C9A

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: 02a3e02e549c9dc230044769d37f88d02c296c7eef885652abc5c2dd2e705e06
Instruction ID: fb70281915fda5b3247cb0c5cd8cb539f8114e72d05e89d92bf17b5a93e8dc2d
Opcode Fuzzy Hash: 02a3e02e549c9dc230044769d37f88d02c296c7eef885652abc5c2dd2e705e06
Instruction Fuzzy Hash: ED219D72200B05EFEB24CF14C984A6AB7F4FB45329F11552AE882B7290E770AD86CF50

Function 00DD9BBD Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

region16_rects.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,00000000), ref: 00DD9BDC
region16_extents.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?), ref: 00DD9BEC
rectangles_intersects.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(00000000,?), ref: 00DD9BF7

Part of subcall function 00DD97FD: rectangles_intersection.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,?,?), ref: 00DD980C

rectangles_intersects.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(00000000,?), ref: 00DD9C1A

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: rectangles_intersects$rectangles_intersectionregion16_extentsregion16_rects
String ID:
API String ID: 3854534691-0
Opcode ID: 3ae0e6e2282d69f6a29daa640538588f82f3507cb970e478017c8bd43d05d967
Instruction ID: 118643e7c735e9f7a8acb7e7ece5d0471d9de383e4810cb49a653f509adbf097
Opcode Fuzzy Hash: 3ae0e6e2282d69f6a29daa640538588f82f3507cb970e478017c8bd43d05d967
Instruction Fuzzy Hash: 68018033134219AAAB249B5DD8A1ABBE3DCDB40765F58411BF8589A240EB37EC81C1B4

Function 00DF1F3D Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

freerdp_new.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE ref: 00DF1F56
freerdp_context_new.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(00000000,00000000,?,?), ref: 00DF1FA4
freerdp_register_addin_provider.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?,00000000), ref: 00DF1FC7

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: freerdp_context_newfreerdp_newfreerdp_register_addin_provider
String ID:
API String ID: 3731710698-0
Opcode ID: c9c351afadd7d74fc9050d5e9992440d9ea0ed848e55313c5e1452aff8ffdd57
Instruction ID: 4b6b1205a42ba7b2ef6fb6c882910c86c66989603521f8e5d3bae3c1b9102fba
Opcode Fuzzy Hash: c9c351afadd7d74fc9050d5e9992440d9ea0ed848e55313c5e1452aff8ffdd57
Instruction Fuzzy Hash: 91119136604B0A9BC725AB66D801A66B7A5FF50320F15841DF95887241EB70E850CBB0

Function 00E068CF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00000FA0,?,?,?,00E06A0A,?,?,00000000,?,00DFE976,00000000), ref: 00E0697B

Strings

WLog_Appender_New, xrefs: 00E068FE
%s: unknown handler type %u, xrefs: 00E06903

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: %s: unknown handler type %u$WLog_Appender_New
API String ID: 2593887523-3466059274
Opcode ID: 76426035e1a7b2cf4a28c5a607df65384fdf8ce763bdc768bf1039f052ec8d17
Instruction ID: c4c5118ec095edf90d90dc98aaabbba925091d5d5c7dbdc87c5f7c5a13a0a8db
Opcode Fuzzy Hash: 76426035e1a7b2cf4a28c5a607df65384fdf8ce763bdc768bf1039f052ec8d17
Instruction Fuzzy Hash: 1E115C3210820266C5223A38AC46F7F67ACDBC2B347943429F405B6DD1DE30D8E16162

Function 00D73FD6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

Strings

%s%s-client.%s, xrefs: 00D7415A
DeviceServiceEntry, xrefs: 00D7419C

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID:
String ID: %s%s-client.%s$DeviceServiceEntry
API String ID: 0-2733899524
Opcode ID: 6f30c88609a6ff82e0304ba61945d56edd5f13820ba194facad77c84c68a2a66
Instruction ID: ef927d9480aed30c0c9ff63fa823f77deecf408c66dd7188717b103ddf1ddc62
Opcode Fuzzy Hash: 6f30c88609a6ff82e0304ba61945d56edd5f13820ba194facad77c84c68a2a66
Instruction Fuzzy Hash: A3119472A00319ABEB129F99C881BAF77ACDF40750F48802AFD18D7241E770DE419BB1

Function 00DB4029 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000080,00000000), ref: 00DB4060
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00DB4076

Strings

%s %hu %s %s %s, xrefs: 00DB40FC

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: File$CreatePointer
String ID: %s %hu %s %s %s
API String ID: 2024441833-2916857029
Opcode ID: 3b9a0a9b3ef9926bc8f8bdffb1d72c6c682f96800e48eab48ee8fd573580d038
Instruction ID: 7edf199f1f4165f4e5574a218c4fe54d1a5c3e4a97b2aa114373515cec4936c5
Opcode Fuzzy Hash: 3b9a0a9b3ef9926bc8f8bdffb1d72c6c682f96800e48eab48ee8fd573580d038
Instruction Fuzzy Hash: 8501F231102110BBDB212B62EC4EEAB7F29EF45370F148115FA1C990E2D722C852D6B0

Function 00DFEBD0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(WLOG_FILTER,00000000,00000000,00000000,?,00DFE987), ref: 00DFEBF6
GetEnvironmentVariableA.KERNEL32(WLOG_FILTER,00000000,00000000,?,?,00DFE987), ref: 00DFEC1A

Strings

WLOG_FILTER, xrefs: 00DFEBE5, 00DFEC15

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: EnvironmentVariable
String ID: WLOG_FILTER
API String ID: 1431749950-2006202657
Opcode ID: 25a05392577c38789f63a8a4a6339ec902dc49402a3c0ebff0f0f523e71072bb
Instruction ID: 329e69f283638d4181db90761311c48e3a7454dff31db1320ebdf74e608025d0
Opcode Fuzzy Hash: 25a05392577c38789f63a8a4a6339ec902dc49402a3c0ebff0f0f523e71072bb
Instruction Fuzzy Hash: EDF02B3331421D2F46202765BC89C7B7FEDDA95BAA351042BF509D7151EB2A4C4A87B1

Function 00E04BC1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(WINPR_NATIVE_SSPI,00000000,00000000,?,?,00E04AE3), ref: 00E04BCC
GetEnvironmentVariableA.KERNEL32(WINPR_NATIVE_SSPI,00000000,00000000,?,?,00E04AE3), ref: 00E04BEC

Strings

WINPR_NATIVE_SSPI, xrefs: 00E04BC7, 00E04BE7

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: EnvironmentVariable
String ID: WINPR_NATIVE_SSPI
API String ID: 1431749950-1020623567
Opcode ID: 0fd3dca39d086724d7f931ce89b82d32e0a6c4d76b7e63ac656f96d8396512b8
Instruction ID: 7a83aecbf558675d21b0680645679a140159ee0dcc63e5b417e9d7c9227c683d
Opcode Fuzzy Hash: 0fd3dca39d086724d7f931ce89b82d32e0a6c4d76b7e63ac656f96d8396512b8
Instruction Fuzzy Hash: 8FF02EF729A1321AF53531657D45F7B8E64CB83F25F25111AFA01F31C1DA40888755E1

Function 00DCA2AA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

rfx_context_new.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?), ref: 00DCA2ED

Part of subcall function 00DBE4DD: GetVersionExA.KERNEL32(?), ref: 00DBE5CD
Part of subcall function 00DBE4DD: GetNativeSystemInfo.KERNEL32(?), ref: 00DBE5E7
Part of subcall function 00DBE4DD: RegOpenKeyExA.ADVAPI32(80000002,Software\FreeRDP\FreeRDP\RemoteFX,00000000,00020119,?), ref: 00DBE612

progressive_context_free.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(00000000), ref: 00DCA36D

Strings

com.freerdp.codec.progressive, xrefs: 00DCA2CA

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: InfoNativeOpenSystemVersionprogressive_context_freerfx_context_new
String ID: com.freerdp.codec.progressive
API String ID: 2699998398-3622116780
Opcode ID: 6db6063e9a0fd52d784cafc24265b53c4b0ae5bcf6cd697cf6c5cf64952e2798
Instruction ID: f34c64d2cb7d34d69ffa796a5ecc9f381c9f6e8ff9bb91bf9d66488571f5bc88
Opcode Fuzzy Hash: 6db6063e9a0fd52d784cafc24265b53c4b0ae5bcf6cd697cf6c5cf64952e2798
Instruction Fuzzy Hash: FFF0E03260574715D22077F99C11F8B7BD8DF82774F18402EF505E75C1DA7094018676

Function 00DB1ED8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

freerdp_settings_get_key_for_name.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(?), ref: 00DB1EEF
freerdp_settings_get_type_for_key.NQDZLQPAYJFIOEFVLKMBVGUKRPWCNNA-ELEVATE(00000000), ref: 00DB1F51

Strings

TRUE, xrefs: 00DB1F65

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: freerdp_settings_get_key_for_namefreerdp_settings_get_type_for_key
String ID: TRUE
API String ID: 1888880752-3412697401
Opcode ID: a7a297d361a7e42153811db794e32f06c61addcadfe3892acd04762f33822e4c
Instruction ID: 67134fc20826d89d9cda7b612d8968f7fc784c5892cec9fb9dc307fe3bb0eb2f
Opcode Fuzzy Hash: a7a297d361a7e42153811db794e32f06c61addcadfe3892acd04762f33822e4c
Instruction Fuzzy Hash: 7FE0E537300328EA9A155A9EDC82DEF725CEF49FB1B450125F906A6241AB60E90085B0

Function 00E0717D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(WTSAPI_LIBRARY,00000000,00000000,?,00E07163), ref: 00E07190
GetEnvironmentVariableA.KERNEL32(WTSAPI_LIBRARY,00000000,00000000,?,?,00E07163), ref: 00E071B1

Part of subcall function 00E07310: LoadLibraryA.KERNEL32(?,?,00E071C4,00000000,?,?,00E07163), ref: 00E07316
Part of subcall function 00E07310: GetProcAddress.KERNEL32(00000000,InitWtsApi), ref: 00E0732B

Strings

WTSAPI_LIBRARY, xrefs: 00E0718B, 00E071AC

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: EnvironmentVariable$AddressLibraryLoadProc
String ID: WTSAPI_LIBRARY
API String ID: 3590464466-1122459656
Opcode ID: 1652febe41b89f9abee41103744874d0c672af699142ec73f5e587f881d7d202
Instruction ID: d90091e497f503f2524e6831be95ab05cefa381e7e6fa2f4c5b4b4c959498479
Opcode Fuzzy Hash: 1652febe41b89f9abee41103744874d0c672af699142ec73f5e587f881d7d202
Instruction Fuzzy Hash: 9FE02B3260F53269D1342254BC0AFAF1B95CBC2B2EF20141AF840B61C4DB54788681B2

Function 00E07310 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,00E071C4,00000000,?,?,00E07163), ref: 00E07316
GetProcAddress.KERNEL32(00000000,InitWtsApi), ref: 00E0732B

Strings

InitWtsApi, xrefs: 00E07325

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: InitWtsApi
API String ID: 2574300362-3428673357
Opcode ID: b5c220fd0af8fc5df8c2c1ea97a87a160943378f984d010dcd5548c80963f777
Instruction ID: 28083d909d133f206bf065d3dd4c40529115f1f848e6540f6e2e96d989c5eabf
Opcode Fuzzy Hash: b5c220fd0af8fc5df8c2c1ea97a87a160943378f984d010dcd5548c80963f777
Instruction Fuzzy Hash: AAD02B709083099FDF00EFF6AC058123FDCD7406453001833AC4CF10C0EB75E480A660

Function 00E6F42C Relevance: 5.2, APIs: 4, Instructions: 154COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00E5B650,00FB0388,0000000C), ref: 00E6F430
SetLastError.KERNEL32(00000000), ref: 00E6F4D2
GetLastError.KERNEL32(00000000,?,00E55FDD,00E6F0E3,?,?,00DFF77A,0000000C,?,?,?,?,00D727D2,?,?,?), ref: 00E6F581
SetLastError.KERNEL32(00000000,00000006), ref: 00E6F623

Part of subcall function 00E6F717: RtlAllocateHeap.NTDLL(00000008,?,00000000), ref: 00E6F758

Part of subcall function 00E6F066: HeapFree.KERNEL32(00000000,00000000,?,00E7B935,?,00000000,?,?,00E7BBD6,?,00000007,?,?,00E7BF89,?,?), ref: 00E6F07C
Part of subcall function 00E6F066: GetLastError.KERNEL32(?,?,00E7B935,?,00000000,?,?,00E7BBD6,?,00000007,?,?,00E7BF89,?,?), ref: 00E6F087

Memory Dump Source

Source File: 00000003.00000002.18293662934.0000000000791000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.18293621387.0000000000790000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000F1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FBB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000000FDF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.000000000102C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000010C8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.00000000012B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001CB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001E1A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18293662934.0000000001EBD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.18296339719.0000000001EE3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.jbxd

Similarity

API ID: ErrorLast$Heap$AllocateFree
String ID:
API String ID: 2037364846-0
Opcode ID: c1f47b36f408e41f3bf48223ac98856e5c85ff371ca757c0e13aa61a49dc45ff
Instruction ID: 06b357b6487d9390654760ffb32d5f6e105e9469f5fe9c05ed2cedfda3dae8fe
Opcode Fuzzy Hash: c1f47b36f408e41f3bf48223ac98856e5c85ff371ca757c0e13aa61a49dc45ff
Instruction Fuzzy Hash: B541C63668A3116ED6203B7CBD87D6B368C9F017F4B146271F635BB1E1DF108D065650

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
Tactics:	Collection
Data Sources:	Logon Session: Logon Session Creation, Process: Process Access, Process: Process Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report getscreen-156413884-x86.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Cryptography

Bitcoin Miner

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Getscreen.me\folder\settings.dat

C:\ProgramData\Getscreen.me\logs\20240813.log

C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe

C:\ProgramData\Getscreen.me\nqdzlqpayjfioefvlkmbvgukrpwcnna-elevate.exe:Zone.Identifier

C:\Users\user\AppData\Local\Getscreen.me\folder\settings.dat

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

DNS Queries

Windows Analysis Report
getscreen-156413884-x86.exe

Function 01E929E0 Relevance: 7.7, APIs: 5, Instructions: 212
librarymemoryloaderCOMMON

Function 00832EDC Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 91
threadlibraryloaderCOMMON

Function 00E1F42C Relevance: 5.2, APIs: 4, Instructions: 192
COMMON

Function 00E0B62B Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Function 00E1F066 Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMON

Function 00E023CE Relevance: 1.5, APIs: 1, Instructions: 43
COMMON

Function 00E1F717 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMON

Function 008AB829 Relevance: 1.3, APIs: 1, Instructions: 98
COMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre