Edit tour

Windows Analysis Report
123.sfx.exe

Overview

General Information

Sample name:	123.sfx.exe
Analysis ID:	1513331
MD5:	b38dfb77e2bf795ee75f3e20f493d493
SHA1:	fb1259948701297f235557764b7448cc7f34828b
SHA256:	3bf7cf40c4a493fc826fca2c74adcf4858423089dd94ba5a8352e00aa8987028
Tags:	exe
Infos:

Detection

STRRAT

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected STRRAT

AI detected suspicious sample

Connects to a pastebin service (likely for C&C)

Drops PE files to the user root directory

Drops large PE files

Found API chain indicative of debugger detection

Modifies the windows firewall

Sigma detected: Execution from Suspicious Folder

Uses netsh to modify the Windows network and firewall settings

AV process strings found (often used to terminate AV products)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Drops PE files to the user directory

Drops files with a non-matching file extension (content does not match file extension)

Extensive use of GetProcAddress (often used to hide API calls)

File is packed with WinRar

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

123.sfx.exe (PID: 2316 cmdline: "C:\Users\user\Desktop\123.sfx.exe" MD5: B38DFB77E2BF795EE75F3E20F493D493)

cmd.exe (PID: 6476 cmdline: "C:\Windows\System32\cmd.exe" /c C:\users\public\123.exe MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

123.exe (PID: 652 cmdline: C:\users\public\123.exe MD5: 8A5D3B7370D1B880AD305C1691CDBE77)

javaw.exe (PID: 6508 cmdline: "C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe" -Duser.language=en -Duser.country=US -Dfile.encoding=UTF-8 -classpath "lib\.;lib\..;lib\asm-all.jar;lib\dn-compiled-module.jar;lib\dn-php-sdk.jar;lib\gson.jar;lib\jphp-app-framework.jar;lib\jphp-core.jar;lib\jphp-desktop-ext.jar;lib\jphp-gui-ext.jar;lib\jphp-json-ext.jar;lib\jphp-runtime.jar;lib\jphp-xml-ext.jar;lib\jphp-zend-ext.jar;lib\jphp-zip-ext.jar;lib\slf4j-api.jar;lib\slf4j-simple.jar;lib\zt-zip.jar" org.develnext.jphp.ext.javafx.FXLauncher MD5: 48C96771106DBDD5D42BBA3772E4B414)

netsh.exe (PID: 3116 cmdline: netsh advfirewall set domainprofile state off MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 6448 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: javaw.exe PID: 6508	JoeSecurity_STRRAT	Yara detected STRRAT	Joe Security

Sigma Signatures

System Summary

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: C:\users\public\123.exe, CommandLine: C:\users\public\123.exe, CommandLine|base64offset|contains: , Image: C:\Users\Public\123.exe, NewProcessName: C:\Users\Public\123.exe, OriginalFileName: C:\Users\Public\123.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c C:\users\public\123.exe, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6476, ParentProcessName: cmd.exe, ProcessCommandLine: C:\users\public\123.exe, ProcessId: 652, ProcessName: 123.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.0% probability

Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B331B16 ??3@YAXPAX@Z,??3@YAXPAX@Z,CryptDestroyHash,CryptReleaseContext,	5_2_6B331B16
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B331719 _Java_sun_security_mscapi_RSASignature_signHash@40,__except_handler4,CryptCreateHash,CryptCreateHash,CryptGetProvParam,CryptAcquireContextA,GetLastError,CryptCreateHash,??2@YAPAXI@Z,CryptSetHashParam,CryptGetKeyParam,CryptSignHashA,CryptSignHashA,??2@YAPAXI@Z,CryptSignHashA,	5_2_6B331719
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B331363 ??3@YAXPAX@Z,CryptReleaseContext,	5_2_6B331363
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B331B50 _Java_sun_security_mscapi_RSAKeyPairGenerator_generateRSAKeyPair@16,CryptAcquireContextA,CryptAcquireContextA,CryptAcquireContextA,GetLastError,CryptGenKey,	5_2_6B331B50
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B3313AC _Java_sun_security_mscapi_KeyStore_loadKeysOrCertificateChains@12,CertOpenSystemStoreA,GetLastError,CertEnumCertificatesInStore,CryptAcquireCertificatePrivateKey,CryptGetUserKey,CryptReleaseContext,CryptSetKeyParam,CertGetPublicKeyLength,CertGetNameStringA,??2@YAPAXI@Z,CertGetNameStringA,CryptGetKeyParam,CertFreeCertificateChain,	5_2_6B3313AC
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B332BF6 _Java_sun_security_mscapi_KeyStore_storePrivateKey@20,CryptAcquireContextA,GetLastError,CryptImportKey,	5_2_6B332BF6
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B33120D _Java_sun_security_mscapi_PRNG_generateSeed@16,CryptAcquireContextA,GetLastError,CryptGenRandom,GetLastError,??2@YAPAXI@Z,CryptGenRandom,GetLastError,CryptGenRandom,	5_2_6B33120D
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B332274 _Java_sun_security_mscapi_KeyStore_destroyKeyContainer@12,CryptAcquireContextA,GetLastError,	5_2_6B332274
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B3326A7 _Java_sun_security_mscapi_RSAPublicKey_getPublicKeyBlob@16,CryptExportKey,CryptExportKey,GetLastError,??2@YAPAXI@Z,CryptExportKey,	5_2_6B3326A7
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B3316EE _Java_sun_security_mscapi_Key_cleanUp@24,CryptDestroyKey,CryptReleaseContext,	5_2_6B3316EE
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B332D25 _Java_sun_security_mscapi_RSASignature_importPublicKey@16,CryptAcquireContextA,CryptAcquireContextA,CryptAcquireContextA,GetLastError,CryptImportKey,	5_2_6B332D25
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B33192E ??3@YAXPAX@Z,??3@YAXPAX@Z,CryptDestroyHash,CryptReleaseContext,	5_2_6B33192E
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B332500 _Java_sun_security_mscapi_KeyStore_getKeyLength@16,CryptGetKeyParam,GetLastError,	5_2_6B332500
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B33256A _Java_sun_security_mscapi_RSACipher_encryptDecrypt@28,??2@YAPAXI@Z,CryptEncrypt,GetLastError,CryptDecrypt,	5_2_6B33256A
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B331968 _Java_sun_security_mscapi_RSASignature_verifySignedHash@44,__except_handler4,CryptCreateHash,CryptGetProvParam,CryptAcquireContextA,GetLastError,CryptCreateHash,??2@YAPAXI@Z,??2@YAPAXI@Z,CryptSetHashParam,CryptVerifySignatureA,	5_2_6B331968
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B331D4B _Java_sun_security_mscapi_KeyStore_storeCertificate@40,CertOpenSystemStoreA,??2@YAPAXI@Z,CertCreateCertificateContext,GetLastError,??2@YAPAXI@Z,memcpy,CertSetCertificateContextProperty,CryptGetProvParam,CryptGetProvParam,??2@YAPAXI@Z,CryptGetProvParam,??2@YAPAXI@Z,mbstowcs,CryptGetProvParam,??2@YAPAXI@Z,CryptGetProvParam,??2@YAPAXI@Z,mbstowcs,CryptGetProvParam,CryptGetKeyParam,CertSetCertificateContextProperty,CertAddCertificateContextToStore,GetLastError,	5_2_6B331D4B
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B332423 _Java_sun_security_mscapi_RSACipher_getKeyFromCert@20,CryptAcquireCertificatePrivateKey,GetLastError,CryptGetUserKey,CryptAcquireContextA,CryptAcquireContextA,CryptAcquireContextA,CryptImportPublicKeyInfo,GetLastError,	5_2_6B332423
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B331C59 _Java_sun_security_mscapi_Key_getContainerName@16,CryptGetProvParam,	5_2_6B331C59
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B331CBB _Java_sun_security_mscapi_Key_getKeyType@16,CryptGetKeyParam,sprintf,	5_2_6B331CBB
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B3324F0 CryptReleaseContext,	5_2_6B3324F0

Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\README.txt	Jump to behavior
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt	Jump to behavior
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt	Jump to behavior
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\THIRDPARTYLICENSEREADME.txt	Jump to behavior
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\THIRDPARTYLICENSEREADME.txt	Jump to behavior

Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe

File opened: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 104.20.3.235:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.3.235:443 -> 192.168.2.5:49710 version: TLS 1.2

Source: 123.sfx.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\jdk\objs\libjava\java.pdb source: javaw.exe, 00000005.00000002.2269001419.000000006C603000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\jdk\objs\libnio\nio.pdbic source: javaw.exe, 00000005.00000002.2270463464.000000006FB37000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\jdk\objs\libjava\java.pdb'% source: javaw.exe, 00000005.00000002.2269001419.000000006C603000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\jdk\objs\libawt\awt.pdb source: javaw.exe, 00000005.00000002.2267626294.000000006B969000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\jdk\objs\libawt\awt.pdb8^ source: javaw.exe, 00000005.00000002.2267626294.000000006B969000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\jdk\objs\libnet\net.pdb source: javaw.exe, 00000005.00000002.2268883373.000000006C5DD000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\jdk\objs\libverify\verify.pdb source: javaw.exe, 00000005.00000002.2270578715.0000000073486000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\jdk\objs\libsunmscapi\sunmscapi.pdb source: javaw.exe, 00000005.00000002.2267329282.000000006B334000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\deploy\tmp\jp2iexp\obj\jp2iexp.pdb< source: jp2iexp.dll.4.dr
Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\jdk\objs\java_objs\java.pdb source: java.exe.4.dr
Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\jdk\objs\javaw_objs\javaw.pdb source: javaw.exe, javaw.exe, 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmp, javaw.exe, 00000005.00000000.2198336788.000000000003C000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\hotspot\windows_i486_compiler1\product\jvm.pdb source: javaw.exe, 00000005.00000002.2269300906.000000006C8E1000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\jdk\objs\libwindowsaccessbridge\WindowsAccessBridge.pdb source: WindowsAccessBridge.dll.4.dr
Source:	Binary string: msvcr100.i386.pdb source: javaw.exe, 00000005.00000002.2269872182.000000006C9F1000.00000020.00000001.01000000.0000000B.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\jdk\objs\libnio\nio.pdb source: javaw.exe, 00000005.00000002.2270463464.000000006FB37000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\deploy\tmp\jp2iexp\obj\jp2iexp.pdb source: jp2iexp.dll.4.dr
Source:	Binary string: msvcr120.i386.pdb source: javaw.exe, javaw.exe, 00000005.00000002.2268577887.000000006C4A1000.00000020.00000001.01000000.00000012.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\jdk\objs\libzip\zip.pdb source: javaw.exe, 00000005.00000002.2270326406.000000006E58A000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\deploy\tmp\deployJava1\obj\deployJava1.pdbL source: deployJava1.dll.4.dr
Source:	Binary string: msvcp120.i386.pdb source: javaw.exe, javaw.exe, 00000005.00000002.2268404042.000000006C421000.00000020.00000001.01000000.00000013.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\jdk\objs\unpackexe\unpack200.pdb source: unpack200.exe.4.dr
Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\jdk\objs\libsunec\sunec.pdb$ source: javaw.exe, 00000005.00000002.2267424218.000000006B353000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\jdk\objs\libsunec\sunec.pdb source: javaw.exe, 00000005.00000002.2267424218.000000006B353000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: 123.sfx.exe
Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\deploy\tmp\deployJava1\obj\deployJava1.pdb source: deployJava1.dll.4.dr

Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704AAB190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF704AAB190
Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704A940BC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF704A940BC
Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704ABFCA0 FindFirstFileExA,	0_2_00007FF704ABFCA0
Source: C:\Users\Public\123.exe	Code function: 4_2_00402930 FindFirstFileW,	4_2_00402930
Source: C:\Users\Public\123.exe	Code function: 4_2_004068D4 FindFirstFileW,FindClose,	4_2_004068D4
Source: C:\Users\Public\123.exe	Code function: 4_2_00405C83 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	4_2_00405C83
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_0002A3A5 __getdrive,FindFirstFileExA,__wfullpath_helper,_strlen,_IsRootUNCName,GetDriveTypeA,_free,___loctotime64_t,_free,__wsopen_s,__fstat64i32,__close,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FindClose,___dtoxmode,GetLastError,__dosmaperr,FindClose,	5_2_0002A3A5
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_00025225 FindFirstFileA,FindNextFileA,_strlen,_strlen,_strlen,_memmove,_memmove,FindClose,	5_2_00025225

Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	File opened: C:\Users\user\AppData\Roaming\RDBNT\jre\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	File opened: C:\Users\user\AppData\Roaming\RDBNT\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	File opened: C:\Users\user\AppData\Roaming\RDBNT\jre\lib\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	File opened: C:\Users\user\AppData\Roaming\	Jump to behavior

Networking

Connects to a pastebin service (likely for C&C)

Source: unknown

DNS query: name: pastebin.com

Source: Joe Sandbox View	IP Address: 104.20.3.235 104.20.3.235
Source: Joe Sandbox View	IP Address: 104.20.3.235 104.20.3.235

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: // www.yahoo.com.by, for example), so we list it here for safety's sake. equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: pastebin.com
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: 15.164.165.52.in-addr.arpa

Source: javaw.exe, 00000005.00000002.2249415666.0000000004D96000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: HTTP://WWW.CHAMBERSIGN.ORG
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://about.museum/naming/
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/allow-java-encodings
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/allow-java-encodings:
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/continue-after-fatal-error
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/create-cdata-nodes
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/disallow-doctype-decl
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/dom/create-entity-ref-nodes
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/dom/defer-node-expansion
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/dom/defer-node-expansionG
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/dom/include-ignorable-whitespace
Source: javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/dom/include-ignorable-whitespace:
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/generate-synthetic-annotations
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/generate-synthetic-annotations3
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/honour-all-schemaLocations
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/honour-all-schemaLocations/
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/include-comments
Source: javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/include-comments1
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/internal/parser-settings
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/internal/tolerate-duplicates
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/internal/tolerate-duplicatesO
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/internal/validation/schema/use-grammar-pool-only
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/namespace-growth
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/namespace-growth;
Source: javaw.exe, 00000005.00000002.2260108258.00000000159B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/namespaces
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/nonvalidating/load-external-dtd
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/nonvalidating/load-external-dtdA
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/scanner/notify-builtin-refs
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/scanner/notify-char-refs
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/scanner/notify-char-refs:
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/standard-uri-conformant
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/validate-annotations
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/validate-annotations9
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/validation/balance-syntax-trees
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/validation/dynamic
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/validation/schema
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/validation/schema-full-checking
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/validation/schema-full-checking5
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/validation/schema/augment-psvi
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/validation/schema/augment-psvi=
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/validation/schema/element-default
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/validation/schema/element-default=
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/validation/schema/normalized-value
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/validation/schema/normalized-valueg/Strin
Source: javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/validation/schema:
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/validation/warn-on-duplicate-attdef
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/validation/warn-on-duplicate-attdef:
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/validation/warn-on-undeclared-elemdef
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/warn-on-duplicate-entitydef
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/xinclude
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/xinclude/fixup-base-uris
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/xinclude/fixup-base-uris6
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/xinclude/fixup-language
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/xinclude/fixup-language:
Source: javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/xincludeC
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/dom/current-element-node
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/dom/current-element-node7
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/dom/document-class-name
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/dom/document-class-name3
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/input-buffer-size
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/datatype-validator-factory
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/document-scanner
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/dtd-processor
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/dtd-scanner
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/dtd-scanner7
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/entity-manager
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/entity-manager:
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/entity-resolver
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/entity-resolver?
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/error-handler
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/error-handler=
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/error-reporter
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/error-reporter8
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/grammar-pool
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/namespace-binder
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/namespace-binderA
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/namespace-context
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/stax-entity-resolver
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/symbol-table
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/symbol-table6
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/validation-manager
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/validation-managerP
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/validation/schema/dv-factory
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/validation/schema/dv-factory8
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/validator/dtd
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/validator/dtdD
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/validator/schema
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/validator/schema$
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/xinclude-handler
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/xinclude-handler$
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/locale
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/localeF
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/schema/external-noNamespaceSchemaLocation
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/schema/external-schemaLocation
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/schema/external-schemaLocationJ
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.0000000015086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/security-manager
Source: javaw.exe, 00000005.00000002.2258519141.0000000015086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/security-manager&
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/xmlschema/1.0/anonymousTypes
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/xmlschema/1.0/anonymousTypesD
Source: javaw.exe, 00000005.00000002.2253255940.000000000A491000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://asm.objectweb.org
Source: javaw.exe, javaw.exe, 00000005.00000002.2269001419.000000006C603000.00000002.00000001.01000000.0000000E.sdmp, javaw.exe, 00000005.00000002.2253255940.000000000A237000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://bugreport.sun.com/bugreport/
Source: javaw.exe, 00000005.00000002.2269001419.000000006C603000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://bugreport.sun.com/bugreport/java.vendor.url.bughttp://java.oracle.com/java.vendor.urljava.ven
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cenpac.net.nr/dns/index.html
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cnnic.cn/html/Dir/2005/10/11/3218.htm
Source: javaw.exe, 00000005.00000002.2253255940.000000000AA98000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2253255940.000000000A9E5000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A347E7000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2253255940.000000000AA98000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2249415666.000000000513A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html0
Source: javaw.exe, 00000005.00000002.2253255940.000000000AA98000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersroot.crl
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A347E7000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2253255940.000000000AA98000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2253255940.000000000A9E5000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2249415666.000000000513A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersroot.crl0
Source: javaw.exe, 00000005.00000002.2253255940.000000000AA98000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A347E7000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2253255940.000000000AA98000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2253255940.000000000A9E5000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: javaw.exe, 00000005.00000002.2253255940.000000000AA98000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A347E7000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2253255940.000000000A9E5000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: javaw.exe, 00000005.00000002.2253255940.000000000AA98000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A347E7000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2253255940.000000000AA98000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2253255940.000000000AC6A000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2249415666.000000000513A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: jp2iexp.dll.4.dr, unpack200.exe.4.dr, WindowsAccessBridge.dll.4.dr, java.exe.4.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: javaw.exe, 00000005.00000002.2253255940.000000000AA98000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A347E7000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2253255940.000000000AA98000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2253255940.000000000AC6A000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2249415666.000000000513A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dns.marnet.net.mk/postapka.php
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://domain.nida.or.kr/eng/registration.jsp
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gadao.gov.gu/registration.txt
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hoster.by/
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://icmregistry.com
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://index.museum/
Source: javaw.exe, javaw.exe, 00000005.00000002.2253255940.000000000A23F000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2269001419.000000006C603000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://java.oracle.com/
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com/jaxp/xpath/dom
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com/xml/dom/properties/
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com/xml/dom/properties/ancestor-check
Source: javaw.exe, 00000005.00000002.2258519141.0000000015086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com/xml/dom/properties/ancestor-checkFil
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com/xml/jaxp/properties/
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com/xml/jaxp/properties/schemaLanguage
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com/xml/jaxp/properties/schemaSource
Source: javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com/xml/jaxp/properties/schemaSource;
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com/xml/schema/features/
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com/xml/schema/features/)
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com/xml/schema/features/report-ignored-element-content-whitespace
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com/xml/schema/features/report-ignored-element-content-whitespace3
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com/xml/stream/properties/
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com/xml/stream/properties/$
Source: javaw.exe, 00000005.00000002.2253255940.000000000A8AA000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com/xml/stream/properties/ignore-external-dtd
Source: javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com/xml/stream/properties/ignore-external-dtd9
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com/xml/stream/properties/reader-in-defined-state
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2253255940.000000000A8AA000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com/xml/stream/properties/report-cdata-event
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com/xml/stream/properties/report-cdata-event/
Source: javaw.exe, 00000005.00000002.2253255940.000000000A6B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://javafx.com/fxml/1
Source: javaw.exe, 00000005.00000002.2253255940.000000000A6B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://javafx.com/javafx/8
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.0000000015086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://javax.xml.XMLConstants/feature/secure-processing
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://javax.xml.XMLConstants/property/
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://javax.xml.XMLConstants/property/accessExternalDTD
Source: javaw.exe, 00000005.00000002.2258519141.0000000015086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://javax.xml.XMLConstants/property/accessExternalDTDR
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://javax.xml.XMLConstants/property/accessExternalSchema
Source: javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://javax.xml.XMLConstants/property/accessExternalSchemaD
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.0000000015086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://javax.xml.XMLConstants/property/accessExternalStylesheet
Source: javaw.exe, 00000005.00000002.2258519141.0000000015086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://javax.xml.XMLConstants/property/accessExternalStylesheet8
Source: javaw.exe, 00000005.00000002.2258519141.0000000015086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://javax.xml.transform.dom.DOMResult/feature
Source: javaw.exe, 00000005.00000002.2253255940.000000000A6B0000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.0000000015086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://javax.xml.transform.dom.DOMSource/feature
Source: javaw.exe, 00000005.00000002.2258519141.0000000015086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://javax.xml.transform.sax.SAXResult/feature#
Source: javaw.exe, 00000005.00000002.2258519141.0000000015086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://javax.xml.transform.sax.SAXSource/feature
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.0000000015086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://javax.xml.transform.sax.SAXTransformerFactory/feature
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.0000000015086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://javax.xml.transform.sax.SAXTransformerFactory/feature/xmlfilter
Source: javaw.exe, 00000005.00000002.2258519141.0000000015086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://javax.xml.transform.sax.SAXTransformerFactory/featureF
Source: javaw.exe, 00000005.00000002.2258519141.0000000015086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://javax.xml.transform.stax.StAXResult/feature
Source: javaw.exe, 00000005.00000002.2258519141.0000000015086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://javax.xml.transform.stax.StAXSource/feature
Source: javaw.exe, 00000005.00000002.2258519141.0000000015086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://javax.xml.transform.stream.StreamResult/feature
Source: javaw.exe, 00000005.00000002.2258519141.0000000015086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://javax.xml.transform.stream.StreamResult/feature-
Source: javaw.exe, 00000005.00000002.2258519141.0000000015086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://javax.xml.transform.stream.StreamSource/feature
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jprs.co.jp/en/jpdomain.html
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jprs.jp/doc/rule/saisoku-1.html
Source: THIRDPARTYLICENSEREADME.txt.4.dr	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://nic.ae/english/arabicdomain/rules.jsp
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://nic.com.ai/
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://nic.gl
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://nic.lk
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://nic.tn
Source: 123.exe, 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmp, 123.exe, 00000004.00000000.2129955410.000000000040A000.00000008.00000001.01000000.00000009.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: javaw.exe, 00000005.00000002.2253255940.000000000ABB8000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2265096063.0000000016858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://null.sun.com/
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A347E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.example.net:80
Source: jp2iexp.dll.4.dr, unpack200.exe.4.dr, WindowsAccessBridge.dll.4.dr, java.exe.4.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://online.dns.pt/dns/start_dns
Source: javaw.exe, 00000005.00000002.2269300906.000000006C8E1000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://openjdk.java.net/jeps/220).
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pk5.pknic.net.pk/pk5/msgNamepk.PK
Source: javaw.exe, 00000005.00000002.2253255940.000000000AA98000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2253255940.000000000AC6A000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2253255940.000000000A9E5000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2249415666.000000000513A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://policy.camerfirma.com
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A347E7000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2253255940.000000000AA98000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://policy.camerfirma.com0
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://psg.com/dns/gn/gn.txt
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://psg.com/dns/lr/lr.txt
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://psg.com/dns/ng/
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://registro.br/dominio/dpn.html
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://registro.nic.ve/nicve/registro/index.html
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://registry.gc.ca/en/SubdomainFAQ
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://registry.gy/
Source: THIRDPARTYLICENSEREADME.txt.4.dr	String found in binary or memory: http://relaxngcc.sf.net/).
Source: javaw.exe, 00000005.00000002.2253255940.000000000AC6A000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2249415666.000000000513A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A347E7000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2253255940.000000000AA98000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/0
Source: javaw.exe, 00000005.00000002.2253255940.000000000AC6A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/cH
Source: javaw.exe, 00000005.00000002.2253255940.000000000AC6A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/s
Source: jp2iexp.dll.4.dr, unpack200.exe.4.dr, WindowsAccessBridge.dll.4.dr, java.exe.4.dr	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: jp2iexp.dll.4.dr, unpack200.exe.4.dr, WindowsAccessBridge.dll.4.dr, java.exe.4.dr	String found in binary or memory: http://s2.symcb.com0
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://samoanic.ws/index.dhtml
Source: javaw.exe, 00000005.00000002.2249415666.0000000004F50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://site.com/
Source: jp2iexp.dll.4.dr, unpack200.exe.4.dr, WindowsAccessBridge.dll.4.dr, java.exe.4.dr	String found in binary or memory: http://sv.symcb.com/sv.crl0f
Source: jp2iexp.dll.4.dr, unpack200.exe.4.dr, WindowsAccessBridge.dll.4.dr, java.exe.4.dr	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: jp2iexp.dll.4.dr, unpack200.exe.4.dr, WindowsAccessBridge.dll.4.dr, java.exe.4.dr	String found in binary or memory: http://sv.symcd.com0&
Source: THIRDPARTYLICENSEREADME.txt.4.dr	String found in binary or memory: http://tartarus.org/~martin/PorterStemmer
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tld.by/rules_2006_en.html
Source: javaw.exe, 00000005.00000002.2253255940.000000000AA98000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A347E7000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2253255940.000000000AA98000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2253255940.000000000A9E5000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl0
Source: jp2iexp.dll.4.dr, unpack200.exe.4.dr, WindowsAccessBridge.dll.4.dr, java.exe.4.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: jp2iexp.dll.4.dr, unpack200.exe.4.dr, WindowsAccessBridge.dll.4.dr, java.exe.4.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: jp2iexp.dll.4.dr, unpack200.exe.4.dr, WindowsAccessBridge.dll.4.dr, java.exe.4.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: THIRDPARTYLICENSEREADME.txt.4.dr	String found in binary or memory: http://upx.sourceforge.net/upx-license.html.
Source: THIRDPARTYLICENSEREADME.txt.4.dr	String found in binary or memory: http://upx.tsx.org
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://whois.ati.tn/
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://whois.nic.bi/
Source: THIRDPARTYLICENSEREADME.txt.4.dr	String found in binary or memory: http://wildsau.idv.uni-linz.ac.at/mfx/upx.html
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.aeda.ae/eng/aepolicy.php
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.afnic.fr/
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.afnic.fr/obtenir/chartes/nommage-fr/annexe-descriptifs
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.afnic.fr/obtenir/chartes/nommage-fr/annexe-sectoriels
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.afnic.re/obtenir/chartes/nommage-re/annexe-descriptifs
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.anrt.ma/fr/admin/download/upload/file_fr782.pdf
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.antel.com.uy/
Source: THIRDPARTYLICENSEREADME.txt.4.dr	String found in binary or memory: http://www.apache.org/licenses/
Source: THIRDPARTYLICENSEREADME.txt.4.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.aucd.org.au/
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.belizenic.bz/
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bermudanic.bm/dnr-text.txt
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.c.la/
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cctld.nc/
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cctld.ru/en/docs/rulesrf.php
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cctld.ru/ru/docs/aktiv_8.php
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.centralnic.com/names/domains
Source: javaw.exe, 00000005.00000002.2253255940.000000000AA98000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2253255940.000000000AC6A000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2249415666.000000000513A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class2.crl
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A347E7000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2253255940.000000000AA98000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class2.crl0
Source: javaw.exe, 00000005.00000002.2253255940.000000000AC6A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class2.crl;
Source: javaw.exe, 00000005.00000002.2249415666.000000000513A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class2.crlk
Source: javaw.exe, 00000005.00000002.2253255940.000000000AA98000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2253255940.000000000A9E5000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class3P.crl
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A347E7000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2253255940.000000000AA98000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class3P.crl0
Source: javaw.exe, 00000005.00000002.2249415666.0000000004D96000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.chambersign.org
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A347E7000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2253255940.000000000AA98000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2253255940.000000000A9E5000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2249415666.000000000513A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.chambersign.org1
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.channelisles.net/applic/avextn.shtml
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cmc.iq/english/iq/iqregister1.htm
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.co.pl
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.com.jm/register.html
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.dns.ao/REGISTR.DOC
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.dns.hr/documents/pdf/HRTLD-regulations.pdf
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.dns.jo/Registration_policy.aspx
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.dns.lu/en/
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.dns.pl/english/
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.dns.pl/english/dns-funk.html
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.dns.pl/english/dns-regiony.html
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.domain-registry.nl/ace.php/c
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.domain.hu/domain/English/sld.html
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.domain.kg/dmn_n.html
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.domaine.km/documents/charte.doc
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.domains.ph/FAQ2.asp
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.dot.kn/domainRules.html
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.dot.mp/
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.dotmasr.eg/
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.dyndns.com/services/dns/dyndns/
Source: THIRDPARTYLICENSEREADME.txt.4.dr	String found in binary or memory: http://www.ecma-international.org
Source: THIRDPARTYLICENSEREADME.txt.4.dr	String found in binary or memory: http://www.ecma-international.org/memento/codeofconduct.htm
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.eenet.ee/EENet/dom_reeglid.html#lisa_B
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ert.gov.al/ert_alb/faq_det.html?Id=31
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.gobin.info/domainname/bw.doc
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.gobin.info/domainname/formulaire-pf.pdf
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.gobin.info/domainname/ml-template.doc
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.gobin.info/domainname/mz-template.doc
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.gobin.info/domainname/sy.doc
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.gov.lt/index_en.php
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.government.pn/PnRegistry/policies.htm
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.gt/politicas.html
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ict.gov.qa/
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.icta.ky/da_ky_reg_dom.php
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A347E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ietf.org/rfc/rfc2373.txt)
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.info.at/
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.info.na/domain/
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.information.aero/index.php?id=66
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.inregistry.in/policies/
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.isnic.is/domain/rules.php
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.isoc.sd/sudanic.isoc.sd/billing_pricing.htm
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.kcce.kp/en_index.php
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.kenic.or.ke/index.php?option=com_content&task=view&id=117&Itemid=145
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ki/dns/index.html
Source: THIRDPARTYLICENSEREADME.txt.4.dr	String found in binary or memory: http://www.linuxnet.com
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.monic.net.mo/
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mos.com.np/register.html
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A34ED0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2004/em-rdf#
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/MPL/
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A34ED0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mptc.gov.kh/dns_registration.htm
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mynic.net.my/
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.na-nic.com.na/
Source: THIRDPARTYLICENSEREADME.txt.4.dr	String found in binary or memory: http://www.nexus.hu/upx
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.af/help.jsp
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.ag/prices.htm
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.bo/
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.bs/rules.html
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.ci/index.php?page=charte
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.cr/niccr_publico/showRegistroDominiosScreen.do
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.ec/reg/paso1.asp
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.gh/reg_now.php
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.gi/rules.html
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.gm/htmlpages%5Cgm-policy.htm
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.gp/index.php?lang=en
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.hn/politicas/ps02
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.ht/info/charte.cfm
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.io/rules.html
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.ir/Internationalized_Domain_Names
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.ir/Terms_and_Conditions_ir
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.it/documenti/appendice-c.pdf
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.it/documenti/regolamenti-e-linee-guida/regolamento-assegnazione-versione-6.0.pdf
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.kz/rules/index.jsp
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.lc/rules.htm
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.lk/seclevpr.html
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.lv/DNS/En/generic.php
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.ly/regulations.php
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.mc/
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.mg/tarif.htm
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.mx/
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.net.ge/policy_en.pdf
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.net.sa/
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.net.sg/sub_policies_agreement/2ld.html
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.net.ua/
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.ni/dominios.htm
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.pa/
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.pr/index.asp?f=1
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.priv.at/
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.pro/support_faq.htm
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.ps/registration/policy.html#reg
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.py/faq_a.html#faq_b
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.rw/cgi-bin/policy.pl
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.sc/
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.sh/rules.html
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.sl
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.st/html/policyrules/
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.tg/nictg/index.php
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.tj/policy.htm
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.tm/rules.html
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.tt/
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.vi/Domain_Rules/body_domain_rules.html
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.vi/newdomainform.htm
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nic.yu/pravilnik-e.html
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.norid.no/regelverk/index.en.html
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.norid.no/regelverk/vedlegg-b.en.html
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.norid.no/regelverk/vedlegg-c.en.html
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.norid.no/regelverk/vedlegg-d.en.html
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.0000000015086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/feature/use-service-mechanism
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A347E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/hotspot/jdk/
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A347E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/hotspot/jfr-info/
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A347E7000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2269300906.000000006C8E1000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://www.oracle.com/hotspot/jvm/
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A347E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/hotspot/jvm/enable-errors
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A347E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/hotspot/jvm/enable-exceptions
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A347E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/hotspot/jvm/file-io-threshold
Source: javaw.exe, 00000005.00000002.2269300906.000000006C8E1000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://www.oracle.com/hotspot/jvm/java/monitor/address
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A347E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/hotspot/jvm/socket-io-threshold
Source: javaw.exe, 00000005.00000002.2269300906.000000006C8E1000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://www.oracle.com/hotspot/jvm/vm/code_sweeper/id
Source: javaw.exe, 00000005.00000002.2269300906.000000006C8E1000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://www.oracle.com/hotspot/jvm/vm/compiler/id
Source: javaw.exe, 00000005.00000002.2269300906.000000006C8E1000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://www.oracle.com/hotspot/jvm/vm/gc/id
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/javafx/pulse/id
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2264967676.00000000167AE000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2253255940.000000000A9E5000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/technetwork/java/javafx/index.html
Source: javaw.exe, 00000005.00000002.2269300906.000000006C8E1000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://www.oracle.com/technetwork/java/javaseproducts/
Source: javaw.exe, 00000005.00000002.2269300906.000000006C8E1000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://www.oracle.com/technetwork/java/javaseproducts/C:
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/xml/is-standalone
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/elementAttributeLimit
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/enableExtensionFunctions
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/entityExpansionLimit
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/entityReplacementLimit
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/getEntityCountInfo
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/maxElementDepth
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/maxGeneralEntitySizeLimit
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/maxOccurLimit
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/maxParameterEntitySizeLimit
Source: javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/maxParameterEntitySizeLimit#
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/maxXMLNameLimit
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/totalEntitySizeLimit
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/xmlSecurityPropertyManager
Source: javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/xmlSecurityPropertyManager;
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.pnina.ps
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.qatar.net.qa/services/virtual.htm
Source: javaw.exe, 00000005.00000002.2253255940.000000000AA98000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A347E7000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2253255940.000000000AA98000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2253255940.000000000A9E5000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: javaw.exe, 00000005.00000002.2253255940.000000000AA98000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A347E7000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2253255940.000000000AA98000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2253255940.000000000A9E5000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.reg.uz/registerr.html
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.registrar.mw/
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.registry.co.ug/
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.rotld.ro/
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sbnic.net.sb/
Source: THIRDPARTYLICENSEREADME.txt.4.dr	String found in binary or memory: http://www.sgi.com/software/opensource/cid/license.html
Source: THIRDPARTYLICENSEREADME.txt.4.dr	String found in binary or memory: http://www.sgi.com/software/opensource/glx/license.html.
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sispa.org.sz/
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.soregistry.com/
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.svnet.org.sv/svpolicy.html
Source: jp2iexp.dll.4.dr, unpack200.exe.4.dr, WindowsAccessBridge.dll.4.dr, java.exe.4.dr	String found in binary or memory: http://www.symauth.com/cps0(
Source: jp2iexp.dll.4.dr, unpack200.exe.4.dr, WindowsAccessBridge.dll.4.dr, java.exe.4.dr	String found in binary or memory: http://www.symauth.com/rpa00
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.telnic.org/
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.thnic.co.th
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.twnic.net/english/dn/dn_07a.htm
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.tznic.or.tz/index.php/domains.html
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.una.an/an_domreg/default.asp
Source: THIRDPARTYLICENSEREADME.txt.4.dr	String found in binary or memory: http://www.unicode.org/Public/
Source: THIRDPARTYLICENSEREADME.txt.4.dr	String found in binary or memory: http://www.unicode.org/Public/.
Source: THIRDPARTYLICENSEREADME.txt.4.dr	String found in binary or memory: http://www.unicode.org/cldr/data/.
Source: THIRDPARTYLICENSEREADME.txt.4.dr	String found in binary or memory: http://www.unicode.org/copyright.html.
Source: THIRDPARTYLICENSEREADME.txt.4.dr	String found in binary or memory: http://www.unicode.org/reports/
Source: THIRDPARTYLICENSEREADME.txt.4.dr	String found in binary or memory: http://www.xfree86.org/)
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.y.net.ye/services/domain_name.htm
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.za.net/
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.zadna.org.za/slds.html
Source: javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xml.apache.org/xalan
Source: javaw.exe, 00000005.00000002.2253255940.000000000A6B0000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xml.apache.org/xpath/features/whitespace-pre-stripping
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xml.apache.org/xpath/features/whitespace-pre-stripping3
Source: javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xml.apache.org/xslt
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/allow-dtd-events-after-endDTD
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/external-general-entities
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/external-general-entities7
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/external-parameter-entities
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/external-parameter-entities8
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/namespace-prefixes
Source: javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/namespace-prefixesru
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/namespaces
Source: javaw.exe, 00000005.00000002.2260108258.00000000159B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/string-interning
Source: javaw.exe, 00000005.00000002.2260108258.00000000159B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/string-interningfeature
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/use-entity-resolver2
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/validation
Source: javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/validation?
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/properties/
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/properties/lexical-handler
Source: javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/properties/lexical-handler.
Source: javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/properties/xml-string
Source: javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/properties/xml-string?
Source: deployJava1.dll.4.dr	String found in binary or memory: https://HTTP/1.1GETRange:
Source: jp2iexp.dll.4.dr, unpack200.exe.4.dr, WindowsAccessBridge.dll.4.dr, java.exe.4.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: jp2iexp.dll.4.dr, unpack200.exe.4.dr, WindowsAccessBridge.dll.4.dr, java.exe.4.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: javaw.exe, 00000005.00000002.2264967676.00000000167AE000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2249415666.0000000004F50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/TsSaltan/DevelNext-jURL/releases/latest
Source: javaw.exe, 00000005.00000002.2253255940.000000000A2E8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/gson
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grweb.ics.forth.gr/english/1617-B-2005.html
Source: deployJava1.dll.4.dr	String found in binary or memory: https://javadl.oracle.com/webapps/download/AutoDL%s?BundleId=%s%s
Source: deployJava1.dll.4.dr	String found in binary or memory: https://javadl.oracle.com/webapps/download/AutoDL%s?BundleId=%surl%s%stmp1.8%s.0%s
Source: javaw.exe, 00000005.00000002.2253255940.000000000AA98000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A347E7000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2253255940.000000000AA98000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2253255940.000000000A9E5000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: javaw.exe, 00000005.00000002.2249415666.0000000004D96000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/21LMhQPq
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://postlister.uninett.no/sympa/info/norid-diskusjon
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://register.pandi.or.id/
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.dot.vn/vnnic/vnnic/domainregistration.jsp
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.hkdnr.hk
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.nic.cd/domain/insertDomain_2.jsp?act=1
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.nic.es/site_ingles/ingles/dominios/index.html
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.nic.im/pdfs/imfaqs.pdf
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.nic.org.mt/dotmt/
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.nic.pe/InformeFinalComision.pdf
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.register.bg/user/static/rules/en/index.html
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www2.hkirc.hk/register/rules.jsp

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708

Source: unknown	HTTPS traffic detected: 104.20.3.235:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.3.235:443 -> 192.168.2.5:49710 version: TLS 1.2

Source: C:\Users\Public\123.exe

Code function: 4_2_0040573B GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

4_2_0040573B

Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe

Code function: 5_2_6B956800 GetKeyboardState,

5_2_6B956800

Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B332BF6 _Java_sun_security_mscapi_KeyStore_storePrivateKey@20,CryptAcquireContextA,GetLastError,CryptImportKey,		5_2_6B332BF6
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B332D25 _Java_sun_security_mscapi_RSASignature_importPublicKey@16,CryptAcquireContextA,CryptAcquireContextA,CryptAcquireContextA,GetLastError,CryptImportKey,		5_2_6B332D25

System Summary

Drops large PE files

Source: C:\Users\user\Desktop\123.sfx.exe

File dump: 123.exe.0.dr 161739843

Jump to dropped file

Source: C:\Users\user\Desktop\123.sfx.exe

Code function: 0_2_00007FF704A8C2F0: CreateFileW,CloseHandle,wcscpy,wcscpy,wcscpy,wcscpy,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF704A8C2F0

Source: C:\Users\Public\123.exe

Code function: 4_2_00403552 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,ExitProcess,CoUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

4_2_00403552

Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704AB0754	0_2_00007FF704AB0754
Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704AAB190	0_2_00007FF704AAB190
Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704A9A4AC	0_2_00007FF704A9A4AC
Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704AA3484	0_2_00007FF704AA3484
Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704A85E24	0_2_00007FF704A85E24
Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704AACE88	0_2_00007FF704AACE88
Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704AA1F20	0_2_00007FF704AA1F20
Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704A8F930	0_2_00007FF704A8F930
Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704A94928	0_2_00007FF704A94928
Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704AC2550	0_2_00007FF704AC2550
Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704A9B534	0_2_00007FF704A9B534
Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704A876C0	0_2_00007FF704A876C0
Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704ABC838	0_2_00007FF704ABC838
Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704A84840	0_2_00007FF704A84840
Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704AA21D0	0_2_00007FF704AA21D0
Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704A9F180	0_2_00007FF704A9F180
Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704A8A310	0_2_00007FF704A8A310
Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704A8C2F0	0_2_00007FF704A8C2F0
Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704A87288	0_2_00007FF704A87288
Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704A9126C	0_2_00007FF704A9126C
Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704AA53F0	0_2_00007FF704AA53F0
Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704AB0754	0_2_00007FF704AB0754
Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704AA8DF4	0_2_00007FF704AA8DF4
Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704AA2D58	0_2_00007FF704AA2D58
Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704A9AF18	0_2_00007FF704A9AF18
Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704AC2080	0_2_00007FF704AC2080
Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704AB89A0	0_2_00007FF704AB89A0
Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704A9C96C	0_2_00007FF704A9C96C
Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704AA3964	0_2_00007FF704AA3964
Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704AA2AB0	0_2_00007FF704AA2AB0
Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704A81AA4	0_2_00007FF704A81AA4
Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704AC5AF8	0_2_00007FF704AC5AF8
Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704A91A48	0_2_00007FF704A91A48
Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704ABFA94	0_2_00007FF704ABFA94
Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704AA4B98	0_2_00007FF704AA4B98
Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704A9BB90	0_2_00007FF704A9BB90
Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704A95B60	0_2_00007FF704A95B60
Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704AB8C1C	0_2_00007FF704AB8C1C
Source: C:\Users\Public\123.exe	Code function: 4_2_00406DE6	4_2_00406DE6
Source: C:\Users\Public\123.exe	Code function: 4_2_004075BD	4_2_004075BD
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_00027016	5_2_00027016
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_00026829	5_2_00026829
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_0003B4A1	5_2_0003B4A1
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_000284FF	5_2_000284FF
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_00039925	5_2_00039925
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_0003A552	5_2_0003A552
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_0002C156	5_2_0002C156
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_0002B169	5_2_0002B169
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_0002BD6E	5_2_0002BD6E
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_0002B99C	5_2_0002B99C
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_0002B5FE	5_2_0002B5FE
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_00039E76	5_2_00039E76
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_00027F2B	5_2_00027F2B
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_00027B2F	5_2_00027B2F
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_000393D4	5_2_000393D4
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B34D75B	5_2_6B34D75B
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B3433D5	5_2_6B3433D5
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B347FDA	5_2_6B347FDA
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B343E7A	5_2_6B343E7A
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B34D257	5_2_6B34D257
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B34D6B5	5_2_6B34D6B5
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B34DEBA	5_2_6B34DEBA
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B343286	5_2_6B343286
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B349AE7	5_2_6B349AE7
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B342ACB	5_2_6B342ACB
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B34E52D	5_2_6B34E52D
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B342911	5_2_6B342911
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B349564	5_2_6B349564
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B346966	5_2_6B346966
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B347168	5_2_6B347168
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B3491DA	5_2_6B3491DA
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B34D87C	5_2_6B34D87C
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B34DCAE	5_2_6B34DCAE
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B343CF0	5_2_6B343CF0
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B346CEE	5_2_6B346CEE
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B8E6A78	5_2_6B8E6A78
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B8E6A76	5_2_6B8E6A76
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B8E69F0	5_2_6B8E69F0
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B93E940	5_2_6B93E940
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B8C082C	5_2_6B8C082C
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B8B2820	5_2_6B8B2820
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B8CAD60	5_2_6B8CAD60
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B93ED60	5_2_6B93ED60
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B918CC0	5_2_6B918CC0
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B8B23A0	5_2_6B8B23A0
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B8B2280	5_2_6B8B2280
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B8DE2C0	5_2_6B8DE2C0
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B92A006	5_2_6B92A006
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B9187B0	5_2_6B9187B0
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B8C07A0	5_2_6B8C07A0
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B93E530	5_2_6B93E530
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B8B2530	5_2_6B8B2530
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B93DB90	5_2_6B93DB90
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B91BA80	5_2_6B91BA80
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B941A10	5_2_6B941A10
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B8B1A40	5_2_6B8B1A40
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B91D960	5_2_6B91D960
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B93D860	5_2_6B93D860
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B941F00	5_2_6B941F00
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B8D5DE0	5_2_6B8D5DE0
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B8FDD2C	5_2_6B8FDD2C
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B8D1CB0	5_2_6B8D1CB0
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B8BF330	5_2_6B8BF330
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B9192D0	5_2_6B9192D0

Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: String function: 6B963F81 appears 302 times
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: String function: 0002DB40 appears 40 times
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: String function: 00028A72 appears 35 times
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: String function: 6B963D9C appears 142 times
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: String function: 6B964026 appears 252 times
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: String function: 6B90EA57 appears 188 times
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: String function: 6B95F4BC appears 297 times
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: String function: 6B963DA2 appears 32 times
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: String function: 6B963F4E appears 48 times
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: String function: 6B96405E appears 39 times
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: String function: 6B963DC6 appears 46 times
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: String function: 00023BA3 appears 49 times

Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A33DE7000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: VALUE "OriginalFilename", XSTR(JFX_FNAME) "\0" vs 123.sfx.exe

Source: classification engine

Classification label: mal80.troj.evad.winEXE@11/218@4/2

Source: C:\Users\user\Desktop\123.sfx.exe

Code function: 0_2_00007FF704A8B6D8 GetLastError,FormatMessageW,LocalFree,

0_2_00007FF704A8B6D8

Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B3313AC _Java_sun_security_mscapi_KeyStore_loadKeysOrCertificateChains@12,CertOpenSystemStoreA,GetLastError,CertEnumCertificatesInStore,CryptAcquireCertificatePrivateKey,CryptGetUserKey,CryptReleaseContext,CryptSetKeyParam,CertGetPublicKeyLength,CertGetNameStringA,??2@YAPAXI@Z,CertGetNameStringA,CryptGetKeyParam,CertFreeCertificateChain,	5_2_6B3313AC
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B3322F9 _Java_sun_security_mscapi_RSACipher_findCertificateUsingAlias@16,CertOpenSystemStoreA,GetLastError,CertGetNameStringA,CertEnumCertificatesInStore,CertGetNameStringA,??2@YAPAXI@Z,CertGetNameStringA,strcmp,??3@YAXPAX@Z,??3@YAXPAX@Z,	5_2_6B3322F9
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B331D4B _Java_sun_security_mscapi_KeyStore_storeCertificate@40,CertOpenSystemStoreA,??2@YAPAXI@Z,CertCreateCertificateContext,GetLastError,??2@YAPAXI@Z,memcpy,CertSetCertificateContextProperty,CryptGetProvParam,CryptGetProvParam,??2@YAPAXI@Z,CryptGetProvParam,??2@YAPAXI@Z,mbstowcs,CryptGetProvParam,??2@YAPAXI@Z,CryptGetProvParam,??2@YAPAXI@Z,mbstowcs,CryptGetProvParam,CryptGetKeyParam,CertSetCertificateContextProperty,CertAddCertificateContextToStore,GetLastError,	5_2_6B331D4B
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B3320B5 _Java_sun_security_mscapi_KeyStore_removeCertificate@24,CertOpenSystemStoreA,??2@YAPAXI@Z,CertCreateCertificateContext,GetLastError,CertFindCertificateInStore,CertGetNameStringA,CertGetNameStringA,??2@YAPAXI@Z,CertGetNameStringA,strcmp,CertDeleteCertificateFromStore,GetLastError,	5_2_6B3320B5

Source: C:\Users\Public\123.exe

4_2_00403552

Source: C:\Users\Public\123.exe

Code function: 4_2_004049E7 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

4_2_004049E7

Source: C:\Users\Public\123.exe

Code function: 4_2_004021CF CoCreateInstance,

4_2_004021CF

Source: C:\Users\user\Desktop\123.sfx.exe

Code function: 0_2_00007FF704AA8624 FindResourceExW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipAlloc,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

0_2_00007FF704AA8624

Source: C:\Users\user\Desktop\123.sfx.exe

File created: C:\Users\Public\__tmp_rar_sfx_access_check_5856031

Jump to behavior

Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5568:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6448:120:WilError_03

Source: C:\Users\Public\123.exe

File created: C:\Users\user\AppData\Local\Temp\nsj74C1.tmp

Jump to behavior

Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Command line argument: 1.8		5_2_00021000
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Command line argument: 1.8.0_101-b13		5_2_00021000

Source: 123.sfx.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\123.sfx.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\123.sfx.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: javaw.exe	String found in binary or memory: sun/launcher/LauncherHelper
Source: javaw.exe	String found in binary or memory: -help

Source: C:\Users\user\Desktop\123.sfx.exe

File read: C:\Users\user\Desktop\123.sfx.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\123.sfx.exe "C:\Users\user\Desktop\123.sfx.exe"
Source: C:\Users\user\Desktop\123.sfx.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c C:\users\public\123.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\123.exe C:\users\public\123.exe
Source: C:\Users\Public\123.exe	Process created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe "C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe" -Duser.language=en -Duser.country=US -Dfile.encoding=UTF-8 -classpath "lib\.;lib\..;lib\asm-all.jar;lib\dn-compiled-module.jar;lib\dn-php-sdk.jar;lib\gson.jar;lib\jphp-app-framework.jar;lib\jphp-core.jar;lib\jphp-desktop-ext.jar;lib\jphp-gui-ext.jar;lib\jphp-json-ext.jar;lib\jphp-runtime.jar;lib\jphp-xml-ext.jar;lib\jphp-zend-ext.jar;lib\jphp-zip-ext.jar;lib\slf4j-api.jar;lib\slf4j-simple.jar;lib\zt-zip.jar" org.develnext.jphp.ext.javafx.FXLauncher
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall set domainprofile state off
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\123.sfx.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c C:\users\public\123.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\123.exe C:\users\public\123.exe	Jump to behavior
Source: C:\Users\Public\123.exe	Process created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe "C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe" -Duser.language=en -Duser.country=US -Dfile.encoding=UTF-8 -classpath "lib\.;lib\..;lib\asm-all.jar;lib\dn-compiled-module.jar;lib\dn-php-sdk.jar;lib\gson.jar;lib\jphp-app-framework.jar;lib\jphp-core.jar;lib\jphp-desktop-ext.jar;lib\jphp-gui-ext.jar;lib\jphp-json-ext.jar;lib\jphp-runtime.jar;lib\jphp-xml-ext.jar;lib\jphp-zend-ext.jar;lib\jphp-zip-ext.jar;lib\slf4j-api.jar;lib\slf4j-simple.jar;lib\zt-zip.jar" org.develnext.jphp.ext.javafx.FXLauncher	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall set domainprofile state off	Jump to behavior

Source: C:\Users\user\Desktop\123.sfx.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\123.sfx.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\Desktop\123.sfx.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\123.sfx.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\123.sfx.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\123.sfx.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\123.sfx.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\123.sfx.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\123.sfx.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\123.sfx.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\123.sfx.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\123.sfx.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\123.sfx.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\123.sfx.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\123.sfx.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\123.sfx.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\123.sfx.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\123.sfx.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\123.sfx.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\123.sfx.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\123.sfx.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\123.sfx.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\123.sfx.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\123.sfx.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\123.sfx.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\123.sfx.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\123.sfx.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\123.sfx.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\123.sfx.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\123.sfx.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\123.sfx.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\123.sfx.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\123.sfx.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\123.sfx.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\123.sfx.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\123.sfx.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\123.sfx.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\123.sfx.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\123.sfx.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\123.sfx.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\Public\123.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\123.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\Public\123.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\Public\123.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\Public\123.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\Public\123.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\Public\123.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\Public\123.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\Public\123.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Public\123.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\Public\123.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\Public\123.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\Public\123.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\Public\123.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\123.sfx.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 123.sfx.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 123.sfx.exe

Static file information: File size 50480444 > 1048576

Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe

File opened: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\msvcr100.dll

Jump to behavior

Source: 123.sfx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 123.sfx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 123.sfx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 123.sfx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 123.sfx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 123.sfx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 123.sfx.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: 123.sfx.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\jdk\objs\libjava\java.pdb source: javaw.exe, 00000005.00000002.2269001419.000000006C603000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\jdk\objs\libnio\nio.pdbic source: javaw.exe, 00000005.00000002.2270463464.000000006FB37000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\jdk\objs\libjava\java.pdb'% source: javaw.exe, 00000005.00000002.2269001419.000000006C603000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\jdk\objs\libawt\awt.pdb source: javaw.exe, 00000005.00000002.2267626294.000000006B969000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\jdk\objs\libawt\awt.pdb8^ source: javaw.exe, 00000005.00000002.2267626294.000000006B969000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\jdk\objs\libnet\net.pdb source: javaw.exe, 00000005.00000002.2268883373.000000006C5DD000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\jdk\objs\libverify\verify.pdb source: javaw.exe, 00000005.00000002.2270578715.0000000073486000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\jdk\objs\libsunmscapi\sunmscapi.pdb source: javaw.exe, 00000005.00000002.2267329282.000000006B334000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\deploy\tmp\jp2iexp\obj\jp2iexp.pdb< source: jp2iexp.dll.4.dr
Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\jdk\objs\java_objs\java.pdb source: java.exe.4.dr
Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\jdk\objs\javaw_objs\javaw.pdb source: javaw.exe, javaw.exe, 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmp, javaw.exe, 00000005.00000000.2198336788.000000000003C000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\hotspot\windows_i486_compiler1\product\jvm.pdb source: javaw.exe, 00000005.00000002.2269300906.000000006C8E1000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\jdk\objs\libwindowsaccessbridge\WindowsAccessBridge.pdb source: WindowsAccessBridge.dll.4.dr
Source:	Binary string: msvcr100.i386.pdb source: javaw.exe, 00000005.00000002.2269872182.000000006C9F1000.00000020.00000001.01000000.0000000B.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\jdk\objs\libnio\nio.pdb source: javaw.exe, 00000005.00000002.2270463464.000000006FB37000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\deploy\tmp\jp2iexp\obj\jp2iexp.pdb source: jp2iexp.dll.4.dr
Source:	Binary string: msvcr120.i386.pdb source: javaw.exe, javaw.exe, 00000005.00000002.2268577887.000000006C4A1000.00000020.00000001.01000000.00000012.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\jdk\objs\libzip\zip.pdb source: javaw.exe, 00000005.00000002.2270326406.000000006E58A000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\deploy\tmp\deployJava1\obj\deployJava1.pdbL source: deployJava1.dll.4.dr
Source:	Binary string: msvcp120.i386.pdb source: javaw.exe, javaw.exe, 00000005.00000002.2268404042.000000006C421000.00000020.00000001.01000000.00000013.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\jdk\objs\unpackexe\unpack200.pdb source: unpack200.exe.4.dr
Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\jdk\objs\libsunec\sunec.pdb$ source: javaw.exe, 00000005.00000002.2267424218.000000006B353000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\jdk\objs\libsunec\sunec.pdb source: javaw.exe, 00000005.00000002.2267424218.000000006B353000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: 123.sfx.exe
Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\deploy\tmp\deployJava1\obj\deployJava1.pdb source: deployJava1.dll.4.dr

Source: 123.sfx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 123.sfx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 123.sfx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 123.sfx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 123.sfx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe

Code function: 5_2_00024DC6 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,

5_2_00024DC6

Source: C:\Users\user\Desktop\123.sfx.exe

File created: C:\Users\Public\__tmp_rar_sfx_access_check_5856031

Jump to behavior

Source: 123.sfx.exe	Static PE information: section name: .didat
Source: 123.sfx.exe	Static PE information: section name: _RDATA
Source: jfxwebkit.dll.4.dr	Static PE information: section name: .unwante
Source: prism_sw.dll.4.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704AC5156 push rsi; retf	0_2_00007FF704AC5157
Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704AC5166 push rsi; retf	0_2_00007FF704AC5167
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_0003F8EC push cs; iretd	5_2_0003F9C2
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_0003F9EE push cs; iretd	5_2_0003F9C2
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_0002DB85 push ecx; ret	5_2_0002DB98
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_0003FB9E push ebx; ret	5_2_0003FB9F
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_000307ED push edi; ret	5_2_000307EE
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B332EB5 push ecx; ret	5_2_6B332EC8
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B3523F5 push ecx; ret	5_2_6B352408
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B9648B5 push ecx; ret	5_2_6B9648C8
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B964026 push ecx; ret	5_2_6B964039

Source: msvcr100.dll.4.dr	Static PE information: section name: .text entropy: 6.90903234258047
Source: msvcr120.dll.4.dr	Static PE information: section name: .text entropy: 6.95576372950548
Source: msvcr100.dll0.4.dr	Static PE information: section name: .text entropy: 6.90903234258047

Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\JavaAccessBridge.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jjs.exe	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\klist.exe	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\pack200.exe	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\java.exe	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\sunec.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\ktab.exe	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\resource.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\splashscreen.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javafx_font.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javafx_font_t2k.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\dtplugin\npdeployJava1.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\ssvagent.exe	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\plugin2\msvcr100.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\msvcr100.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jsound.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\nio.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\prism_d3d.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\prism_sw.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\glass.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\java-rmi.exe	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jfxmedia.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\mlib_image.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\fontmanager.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jabswitch.exe	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\kcms.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\prism_common.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\net.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\fxplugins.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\bci.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\keytool.exe	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\ssv.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\w2k_lsa_auth.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\tnameserv.exe	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\policytool.exe	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\j2pcsc.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\servertool.exe	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\orbd.exe	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\awt.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\WindowsAccessBridge.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jdwp.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\rmiregistry.exe	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\zip.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jp2iexp.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jsdt.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\plugin2\npjp2.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\j2pkcs11.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\glib-lite.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\decora_sse.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jfr.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\dt_socket.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jp2native.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaws.exe	Jump to dropped file
Source: C:\Users\user\Desktop\123.sfx.exe	File created: C:\Users\Public\123.exe	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javacpl.exe	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\JAWTAccessBridge-32.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javacpl.cpl	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javafx_iio.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\hprof.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\sunmscapi.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\management.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\eula.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jaas_nt.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jp2ssv.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\unpack200.exe	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\dcpr.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jfxwebkit.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jpeg.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\wsdetect.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jli.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\JavaAccessBridge-32.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\lcms.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\kinit.exe	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\JAWTAccessBridge.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jp2launcher.exe	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\instrument.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\java.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\gstreamer-lite.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\deploy.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\npt.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\client\jvm.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\WindowsAccessBridge-32.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jsoundds.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\t2k.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\java_crw_demo.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jawt.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\dtplugin\deployJava1.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\msvcp120.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\msvcr120.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\dt_shmem.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\rmid.exe	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\unpack.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\verify.dll	Jump to dropped file

Source: C:\Users\user\Desktop\123.sfx.exe

File created: C:\Users\Public\123.exe

Jump to dropped file

Source: C:\Users\Public\123.exe

File created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javacpl.cpl

Jump to dropped file

Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\README.txt	Jump to behavior
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt	Jump to behavior
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt	Jump to behavior
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\THIRDPARTYLICENSEREADME.txt	Jump to behavior
Source: C:\Users\Public\123.exe	File created: C:\Users\user\AppData\Roaming\RDBNT\jre\THIRDPARTYLICENSEREADME.txt	Jump to behavior

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\123.sfx.exe

File created: C:\Users\Public\123.exe

Jump to dropped file

Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe

Code function: 5_2_6B9098E3 JDK_LoadSystemLibrary,JDK_LoadSystemLibrary,JDK_LoadSystemLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

5_2_6B9098E3

Source: C:\Users\user\Desktop\123.sfx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\123.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe

Code function: 5_2_6B8CAD60 rdtsc

5_2_6B8CAD60

Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\JavaAccessBridge.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jjs.exe	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\klist.exe	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\pack200.exe	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\java.exe	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\sunec.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\ktab.exe	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\resource.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\splashscreen.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javafx_font.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\dtplugin\npdeployJava1.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javafx_font_t2k.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\ssvagent.exe	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\plugin2\msvcr100.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\msvcr100.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\prism_d3d.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\prism_sw.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\nio.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jsound.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\glass.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\java-rmi.exe	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jfxmedia.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\mlib_image.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jabswitch.exe	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\fontmanager.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\kcms.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\prism_common.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\net.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\fxplugins.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\bci.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\ssv.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\keytool.exe	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\w2k_lsa_auth.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\tnameserv.exe	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\policytool.exe	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\j2pcsc.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\servertool.exe	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\orbd.exe	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\awt.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\WindowsAccessBridge.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jdwp.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\rmiregistry.exe	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\zip.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jp2iexp.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jsdt.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\plugin2\npjp2.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\j2pkcs11.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\glib-lite.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jfr.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\decora_sse.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\dt_socket.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jp2native.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaws.exe	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javacpl.exe	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\JAWTAccessBridge-32.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javacpl.cpl	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javafx_iio.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\hprof.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\sunmscapi.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\management.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jaas_nt.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\eula.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jp2ssv.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\unpack200.exe	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\dcpr.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jfxwebkit.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jpeg.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\wsdetect.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jli.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\JavaAccessBridge-32.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\lcms.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\kinit.exe	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\JAWTAccessBridge.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jp2launcher.exe	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\instrument.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\java.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\gstreamer-lite.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\deploy.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\npt.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\client\jvm.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\WindowsAccessBridge-32.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\t2k.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jsoundds.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\java_crw_demo.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jawt.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\dtplugin\deployJava1.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\msvcp120.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\msvcr120.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\dt_shmem.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\verify.dll	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\rmid.exe	Jump to dropped file
Source: C:\Users\Public\123.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\unpack.dll	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe

API coverage: 1.0 %

Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B924604 GetKeyboardLayout followed by cmp: cmp ax, cx and CTI: jne 6B924627h		5_2_6B924604
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B9572CE GetKeyboardLayout followed by cmp: cmp esi, eax and CTI: je 6B956C9Eh		5_2_6B9572CE

Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704AAB190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF704AAB190
Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704A940BC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF704A940BC
Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704ABFCA0 FindFirstFileExA,	0_2_00007FF704ABFCA0
Source: C:\Users\Public\123.exe	Code function: 4_2_00402930 FindFirstFileW,	4_2_00402930
Source: C:\Users\Public\123.exe	Code function: 4_2_004068D4 FindFirstFileW,FindClose,	4_2_004068D4
Source: C:\Users\Public\123.exe	Code function: 4_2_00405C83 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	4_2_00405C83
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_0002A3A5 __getdrive,FindFirstFileExA,__wfullpath_helper,_strlen,_IsRootUNCName,GetDriveTypeA,_free,___loctotime64_t,_free,__wsopen_s,__fstat64i32,__close,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FindClose,___dtoxmode,GetLastError,__dosmaperr,FindClose,	5_2_0002A3A5
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_00025225 FindFirstFileA,FindNextFileA,_strlen,_strlen,_strlen,_memmove,_memmove,FindClose,	5_2_00025225

Source: C:\Users\user\Desktop\123.sfx.exe

Code function: 0_2_00007FF704AB16A4 VirtualQuery,GetSystemInfo,

0_2_00007FF704AB16A4

Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	File opened: C:\Users\user\AppData\Roaming\RDBNT\jre\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	File opened: C:\Users\user\AppData\Roaming\RDBNT\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	File opened: C:\Users\user\AppData\Roaming\RDBNT\jre\lib\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	File opened: C:\Users\user\AppData\Roaming\	Jump to behavior

Source: javaw.exe, 00000005.00000003.2199351401.0000000015066000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: javaw.exe, 00000005.00000002.2269300906.000000006C8E1000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: java/lang/VirtualMachineError
Source: javaw.exe, 00000005.00000002.2269300906.000000006C8E1000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: Unable to link/verify VirtualMachineError class
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A33DE7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d/gQemu
Source: javaw.exe, 00000005.00000002.2269300906.000000006C8E1000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: ll{constant pool}code cache C-heap hand metaspace chunks dict zone strs syms heap threads [Verifying Genesis-2147483648Unable to link/verify Finalizer.register methodUnable to link/verify ClassLoader.addClass methodProtectionDomain.impliesCreateAccessControlContext() has the wrong linkageUnable to link/verify Unsafe.throwIllegalAccessError methodJava heap space: failed reallocation of scalar replaced objectsGC overhead limit exceededRequested array size exceeds VM limitCompressed class spaceJava heap spaceUnable to link/verify VirtualMachineError classC:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\hotspot\src\share\vm\oops\arrayKlass.cpp[]guarantee(component_mirror()->klass() != NULL) failedshould have a classC:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\hotspot\src\share\vm\gc_interface/collectedHeap.inline.hpp - length: %dguarantee(a->length() >= 0) failedarray with negative length?guarantee(obj->is_array()) failedmust be arrayshould be klassguarantee(is_constantPool()) failedvtable restored by this call<pseudo-string> cache=0x%08x (extra) for /operands[%d]/preresolutionconstant pool [%d]A constant pool lockC:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\hotspot\src\share\vm\oops\constantPool.cppguarantee(!ConstantPool::is_invokedynamic_index(which)) failedan invokedynamic instruction does not have a klassRESOLVE %s %s
Source: javaw.exe, 00000005.00000003.2199351401.0000000015066000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: org/omg/CORBA/OMGVMCID.classPK
Source: javaw.exe, 00000005.00000002.2248220979.0000000002980000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: cjava/lang/VirtualMachineError
Source: javaw.exe, 00000005.00000002.2248220979.0000000002980000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t[Ljava/lang/VirtualMachineError;
Source: javaw.exe, 00000005.00000003.2199351401.0000000015066000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: )Q+com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: javaw.exe, 00000005.00000002.2269300906.000000006C8E1000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: _well_known_klasses[SystemDictionary::VirtualMachineError_klass_knum]
Source: 123.sfx.exe, 00000000.00000003.2111743157.0000015A347E7000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000005.00000003.2199351401.0000000015066000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: java/lang/VirtualMachineError.classPK
Source: javaw.exe, 00000005.00000002.2248220979.0000000002980000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lVirtualMachineError.java
Source: javaw.exe, 00000005.00000002.2247567961.0000000000DB0000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000007.00000003.2239494878.00000000034F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\Public\123.exe	API call chain: ExitProcess graph end node			graph_4-3231
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	API call chain: ExitProcess graph end node			graph_5-77864

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_5-79140

Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe

Code function: 5_2_6B8CAD60 rdtsc

5_2_6B8CAD60

Source: C:\Users\user\Desktop\123.sfx.exe

Code function: 0_2_00007FF704AB76D8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF704AB76D8

Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe

Code function: 5_2_00024DC6 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,

5_2_00024DC6

Source: C:\Users\user\Desktop\123.sfx.exe

Code function: 0_2_00007FF704AC0D20 GetProcessHeap,

0_2_00007FF704AC0D20

Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704AB76D8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF704AB76D8
Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704AB3170 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF704AB3170
Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704AB3354 SetUnhandledExceptionFilter,	0_2_00007FF704AB3354
Source: C:\Users\user\Desktop\123.sfx.exe	Code function: 0_2_00007FF704AB2510 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF704AB2510
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_0002D15B _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_0002D15B
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_000296E8 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_000296E8
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_0002EF37 SetUnhandledExceptionFilter,	5_2_0002EF37
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B332E44 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	5_2_6B332E44
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B351A72 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	5_2_6B351A72
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B963E32 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	5_2_6B963E32

Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe

Memory protected: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\123.sfx.exe

Code function: 0_2_00007FF704AAB190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF704AAB190

Source: C:\Users\user\Desktop\123.sfx.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c C:\users\public\123.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\123.exe C:\users\public\123.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall set domainprofile state off	Jump to behavior

Source: C:\Users\Public\123.exe	Process created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe "c:\users\user\appdata\roaming\rdbnt\jre\bin\javaw.exe" -duser.language=en -duser.country=us -dfile.encoding=utf-8 -classpath "lib\.;lib\..;lib\asm-all.jar;lib\dn-compiled-module.jar;lib\dn-php-sdk.jar;lib\gson.jar;lib\jphp-app-framework.jar;lib\jphp-core.jar;lib\jphp-desktop-ext.jar;lib\jphp-gui-ext.jar;lib\jphp-json-ext.jar;lib\jphp-runtime.jar;lib\jphp-xml-ext.jar;lib\jphp-zend-ext.jar;lib\jphp-zip-ext.jar;lib\slf4j-api.jar;lib\slf4j-simple.jar;lib\zt-zip.jar" org.develnext.jphp.ext.javafx.fxlauncher
Source: C:\Users\Public\123.exe	Process created: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe "c:\users\user\appdata\roaming\rdbnt\jre\bin\javaw.exe" -duser.language=en -duser.country=us -dfile.encoding=utf-8 -classpath "lib\.;lib\..;lib\asm-all.jar;lib\dn-compiled-module.jar;lib\dn-php-sdk.jar;lib\gson.jar;lib\jphp-app-framework.jar;lib\jphp-core.jar;lib\jphp-desktop-ext.jar;lib\jphp-gui-ext.jar;lib\jphp-json-ext.jar;lib\jphp-runtime.jar;lib\jphp-xml-ext.jar;lib\jphp-zend-ext.jar;lib\jphp-zip-ext.jar;lib\slf4j-api.jar;lib\slf4j-simple.jar;lib\zt-zip.jar" org.develnext.jphp.ext.javafx.fxlauncher			Jump to behavior

Source: C:\Users\user\Desktop\123.sfx.exe

Code function: 0_2_00007FF704AC58E0 cpuid

0_2_00007FF704AC58E0

Source: C:\Users\user\Desktop\123.sfx.exe	Code function: GetLocaleInfoW,GetNumberFormatW,	0_2_00007FF704AAA2CC
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: GetLocaleInfoW,_wtoi,GetACP,	5_2_6B9469B7
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: _Java_sun_awt_windows_WPageDialogPeer__1show@8,__EH_prolog3_catch,memset,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,wcscmp,free,GlobalLock,_control87,_control87,_control87,_control87,GlobalUnlock,_CxxThrowException,GlobalLock,GlobalUnlock,	5_2_6B94EC97
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: _Java_sun_awt_windows_WPrinterJob_getDefaultPage@12,__EH_prolog3_catch,GlobalLock,_wcsdup,GlobalUnlock,free,GlobalFree,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,wcscmp,free,GlobalFree,free,GlobalUnlock,_CxxThrowException,	5_2_6B94F11E

Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\123.sfx.exe

Code function: 0_2_00007FF704AB0754 GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,MapViewOfFile,UnmapViewOfFile,CloseHandle,SetEnvironmentVariableW,GetLocalTime,swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,OleUninitialize,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF704AB0754

Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe

Code function: 5_2_0003819A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,SetOaNoCache,

5_2_0003819A

Source: C:\Users\user\Desktop\123.sfx.exe

Code function: 0_2_00007FF704A951A4 GetVersionExW,

0_2_00007FF704A951A4

Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the windows firewall

Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall set domainprofile state off

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall set domainprofile state off

Source: 123.sfx.exe, 00000000.00000003.2119187312.0000015A2F4F3000.00000004.00000020.00020000.00000000.sdmp, 123.sfx.exe, 00000000.00000003.2066101127.0000015A333E4000.00000004.00000020.00020000.00000000.sdmp, 123.sfx.exe, 00000000.00000002.2121985700.0000015A2F4FD000.00000004.00000020.00020000.00000000.sdmp, 123.sfx.exe, 00000000.00000003.2115611275.0000015A2F4F6000.00000004.00000020.00020000.00000000.sdmp, 123.sfx.exe, 00000000.00000003.2117321371.0000015A2F4F9000.00000004.00000020.00020000.00000000.sdmp, 123.sfx.exe, 00000000.00000003.2117043387.0000015A2F4F9000.00000004.00000020.00020000.00000000.sdmp, 123.sfx.exe, 00000000.00000003.2066321869.0000015A2F4FD000.00000004.00000020.00020000.00000000.sdmp, 123.sfx.exe, 00000000.00000003.2065221967.0000015A32AE5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Setup=cmd.exe /c C:\users\public\123.exe
Source: 123.sfx.exe, 00000000.00000003.2120112332.0000015A2F4C7000.00000004.00000020.00020000.00000000.sdmp, 123.sfx.exe, 00000000.00000002.2121493332.0000015A2F4C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "C:\Windows\System32\cmd.exe" /c C:\users\public\123.exe
Source: 123.sfx.exe, 00000000.00000002.2121493332.0000015A2F4AC000.00000004.00000020.00020000.00000000.sdmp, 123.sfx.exe, 00000000.00000003.2120112332.0000015A2F4AC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: cmd.exe /c C:\users\public\123.exe
Source: 123.sfx.exe, 00000000.00000002.2121493332.0000015A2F4AC000.00000004.00000020.00020000.00000000.sdmp, 123.sfx.exe, 00000000.00000003.2120112332.0000015A2F4AC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: cmd.exe/c C:\users\public\123.exe
Source: 123.exe, 00000004.00000002.2199868006.0000000000700000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\users\public\123.exe
Source: 123.sfx.exe, 00000000.00000002.2121493332.0000015A2F4AC000.00000004.00000020.00020000.00000000.sdmp, 123.sfx.exe, 00000000.00000002.2122913601.0000015A354C2000.00000004.00000020.00020000.00000000.sdmp, 123.sfx.exe, 00000000.00000003.2120112332.0000015A2F4AC000.00000004.00000020.00020000.00000000.sdmp, 123.sfx.exe, 00000000.00000003.2119267219.0000015A354C2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /c C:\users\public\123.exe
Source: 123.exe, 00000004.00000002.2199868006.0000000000708000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Drh3rsers\public\123.exe

Stealing of Sensitive Information

Yara detected STRRAT

Source: Yara match

File source: Process Memory Space: javaw.exe PID: 6508, type: MEMORYSTR

Remote Access Functionality

Yara detected STRRAT

Source: Yara match

File source: Process Memory Space: javaw.exe PID: 6508, type: MEMORYSTR

Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B8C8450 ?NotifyAdapterEventListeners@D3DPipelineManager@@SAXIJ@Z,_JNU_GetEnv@8,JNU_CallStaticMethodByName,		5_2_6B8C8450
Source: C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	Code function: 5_2_6B909F36 _Java_sun_awt_shell_Win32ShellFolder2_bindToObject@24,		5_2_6B909F36

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	21 Disable or Modify Tools	11 Input Capture	2 System Time Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	13 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	11 Input Capture	22 Encrypted Channel	Exfiltration Over Bluetooth	1 System Shutdown/Reboot
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Access Token Manipulation	3 Obfuscated Files or Information	Security Account Manager	46 System Information Discovery	SMB/Windows Admin Shares	1 Clipboard Data	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	11 Process Injection	1 Install Root Certificate	NTDS	141 Security Software Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Software Packing	LSA Secrets	1 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	11 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner
C:\Users\Public\123.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\JAWTAccessBridge-32.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\JAWTAccessBridge.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\JavaAccessBridge-32.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\JavaAccessBridge.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\WindowsAccessBridge-32.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\WindowsAccessBridge.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\awt.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\bci.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\client\jvm.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\dcpr.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\decora_sse.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\deploy.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\dt_shmem.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\dt_socket.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\dtplugin\deployJava1.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\dtplugin\npdeployJava1.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\eula.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\fontmanager.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\fxplugins.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\glass.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\glib-lite.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\gstreamer-lite.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\hprof.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\instrument.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\j2pcsc.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\j2pkcs11.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jaas_nt.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jabswitch.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\java-rmi.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\java.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\java.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\java_crw_demo.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javacpl.cpl	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javacpl.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javafx_font.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javafx_font_t2k.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javafx_iio.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaws.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jawt.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jdwp.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jfr.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jfxmedia.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jfxwebkit.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jjs.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jli.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jp2iexp.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jp2launcher.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jp2native.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jp2ssv.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jpeg.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jsdt.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jsound.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jsoundds.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\kcms.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\keytool.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\kinit.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\klist.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\ktab.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\lcms.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\management.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\mlib_image.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\msvcp120.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\msvcr100.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\msvcr120.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://apache.org/xml/properties/schema/external-schemaLocationJ	0%	Avira URL Cloud	safe
http://apache.org/xml/features/scanner/notify-char-refs	0%	Avira URL Cloud	safe
http://apache.org/xml/properties/internal/entity-manager	0%	Avira URL Cloud	safe
http://apache.org/xml/features/validation/schema:	0%	Avira URL Cloud	safe
https://www.nic.cd/domain/insertDomain_2.jsp?act=1	0%	Avira URL Cloud	safe
http://apache.org/xml/features/xinclude/fixup-base-uris	0%	Avira URL Cloud	safe
HTTP://WWW.CHAMBERSIGN.ORG	0%	Avira URL Cloud	safe
http://apache.org/xml/features/internal/parser-settings	0%	Avira URL Cloud	safe
http://www.domains.ph/FAQ2.asp	0%	Avira URL Cloud	safe
http://www.chambersign.org1	0%	Avira URL Cloud	safe
http://www.dot.kn/domainRules.html	0%	Avira URL Cloud	safe
http://psg.com/dns/ng/	0%	Avira URL Cloud	safe
http://apache.org/xml/properties/internal/symbol-table6	0%	Avira URL Cloud	safe
http://policy.camerfirma.com0	0%	Avira URL Cloud	safe
http://java.sun.com/xml/schema/features/report-ignored-element-content-whitespace3	0%	Avira URL Cloud	safe
http://tld.by/rules_2006_en.html	0%	Avira URL Cloud	safe
http://apache.org/xml/properties/dom/current-element-node7	0%	Avira URL Cloud	safe
http://apache.org/xml/features/continue-after-fatal-error	0%	Avira URL Cloud	safe
http://www.nic.ps/registration/policy.html#reg	0%	Avira URL Cloud	safe
http://www.gobin.info/domainname/ml-template.doc	0%	Avira URL Cloud	safe
http://apache.org/xml/features/standard-uri-conformant	0%	Avira URL Cloud	safe
http://apache.org/xml/properties/internal/document-scanner	0%	Avira URL Cloud	safe
http://www.oracle.com/hotspot/jdk/	0%	Avira URL Cloud	safe
http://www.nic.sl	0%	Avira URL Cloud	safe
http://psg.com/dns/lr/lr.txt	0%	Avira URL Cloud	safe
http://bugreport.sun.com/bugreport/	0%	Avira URL Cloud	safe
http://www.certplus.com/CRL/class2.crl	0%	Avira URL Cloud	safe
http://whois.ati.tn/	0%	Avira URL Cloud	safe
http://www.gobin.info/domainname/bw.doc	0%	Avira URL Cloud	safe
http://java.oracle.com/	0%	Avira URL Cloud	safe
http://www.nic.pa/	0%	Avira URL Cloud	safe
http://www.oracle.com/technetwork/java/javaseproducts/C:	0%	Avira URL Cloud	safe
http://www.symauth.com/cps0(	0%	Avira URL Cloud	safe
http://apache.org/xml/features/	0%	Avira URL Cloud	safe
http://www.cctld.ru/ru/docs/aktiv_8.php	0%	Avira URL Cloud	safe
http://www.certplus.com/CRL/class3P.crl	0%	Avira URL Cloud	safe
http://www.oracle.com/hotspot/jvm/file-io-threshold	0%	Avira URL Cloud	safe
http://nic.gl	0%	Avira URL Cloud	safe
http://www.unicode.org/cldr/data/.	0%	Avira URL Cloud	safe
http://apache.org/xml/features/internal/validation/schema/use-grammar-pool-only	0%	Avira URL Cloud	safe
http://javax.xml.transform.sax.SAXTransformerFactory/feature	0%	Avira URL Cloud	safe
http://java.sun.com/xml/stream/properties/$	0%	Avira URL Cloud	safe
http://xml.org/sax/features/string-interningfeature	0%	Avira URL Cloud	safe
http://apache.org/xml/features/namespace-growth;	0%	Avira URL Cloud	safe
http://www.cctld.nc/	0%	Avira URL Cloud	safe
http://www.symauth.com/rpa00	0%	Avira URL Cloud	safe
http://www.nic.hn/politicas/ps02	0%	Avira URL Cloud	safe
http://javax.xml.XMLConstants/property/accessExternalStylesheet	0%	Avira URL Cloud	safe
https://grweb.ics.forth.gr/english/1617-B-2005.html	0%	Avira URL Cloud	safe
https://javadl.oracle.com/webapps/download/AutoDL%s?BundleId=%s%s	0%	Avira URL Cloud	safe
http://apache.org/xml/properties/security-manager	0%	Avira URL Cloud	safe
http://xml.org/sax/features/validation?	0%	Avira URL Cloud	safe
http://www.oracle.com/hotspot/jvm/	0%	Avira URL Cloud	safe
http://xml.apache.org/xslt	0%	Avira URL Cloud	safe
http://apache.org/xml/features/validation/warn-on-duplicate-attdef:	0%	Avira URL Cloud	safe
http://www.norid.no/regelverk/vedlegg-d.en.html	0%	Avira URL Cloud	safe
http://www.gobin.info/domainname/mz-template.doc	0%	Avira URL Cloud	safe
http://www.ict.gov.qa/	0%	Avira URL Cloud	safe
http://javax.xml.transform.stax.StAXResult/feature	0%	Avira URL Cloud	safe
http://www.linuxnet.com	0%	Avira URL Cloud	safe
http://apache.org/xml/features/namespaces	0%	Avira URL Cloud	safe
http://www.centralnic.com/names/domains	0%	Avira URL Cloud	safe
http://apache.org/xml/features/xinclude	0%	Avira URL Cloud	safe
http://javax.xml.XMLConstants/property/	0%	Avira URL Cloud	safe
http://www.sbnic.net.sb/	0%	Avira URL Cloud	safe
https://javadl.oracle.com/webapps/download/AutoDL%s?BundleId=%surl%s%stmp1.8%s.0%s	0%	Avira URL Cloud	safe
http://www.isoc.sd/sudanic.isoc.sd/billing_pricing.htm	0%	Avira URL Cloud	safe
http://www.nic.gp/index.php?lang=en	0%	Avira URL Cloud	safe
http://apache.org/xml/properties/locale	0%	Avira URL Cloud	safe
http://nic.ae/english/arabicdomain/rules.jsp	0%	Avira URL Cloud	safe
http://openjdk.java.net/jeps/220).	0%	Avira URL Cloud	safe
http://java.sun.com/xml/stream/properties/reader-in-defined-state	0%	Avira URL Cloud	safe
http://www.nic.net.sg/sub_policies_agreement/2ld.html	0%	Avira URL Cloud	safe
http://www.quovadisglobal.com/cps0	0%	Avira URL Cloud	safe
http://www.isnic.is/domain/rules.php	0%	Avira URL Cloud	safe
http://www.afnic.fr/obtenir/chartes/nommage-fr/annexe-descriptifs	0%	Avira URL Cloud	safe
http://www.nic.priv.at/	0%	Avira URL Cloud	safe
http://hoster.by/	0%	Avira URL Cloud	safe
http://apache.org/xml/properties/internal/validator/dtdD	0%	Avira URL Cloud	safe
http://www.oracle.com/feature/use-service-mechanism	0%	Avira URL Cloud	safe
http://online.dns.pt/dns/start_dns	0%	Avira URL Cloud	safe
http://javax.xml.transform.stream.StreamSource/feature	0%	Avira URL Cloud	safe
http://dns.marnet.net.mk/postapka.php	0%	Avira URL Cloud	safe
http://www.nic.sc/	0%	Avira URL Cloud	safe
http://samoanic.ws/index.dhtml	0%	Avira URL Cloud	safe
http://www.nic.mx/	0%	Avira URL Cloud	safe
http://www.nic.tj/policy.htm	0%	Avira URL Cloud	safe
http://www.unicode.org/reports/	0%	Avira URL Cloud	safe
http://javax.xml.transform.dom.DOMSource/feature	0%	Avira URL Cloud	safe
http://www.quovadisglobal.com/cps	0%	Avira URL Cloud	safe
http://java.sun.com/xml/schema/features/report-ignored-element-content-whitespace	0%	Avira URL Cloud	safe
http://apache.org/xml/properties/dom/document-class-name	0%	Avira URL Cloud	safe
http://www.registrar.mw/	0%	Avira URL Cloud	safe
http://www.dot.mp/	0%	Avira URL Cloud	safe
http://www.dns.lu/en/	0%	Avira URL Cloud	safe
http://www.nic.cr/niccr_publico/showRegistroDominiosScreen.do	0%	Avira URL Cloud	safe
http://apache.org/xml/properties/internal/symbol-table	0%	Avira URL Cloud	safe
http://about.museum/naming/	0%	Avira URL Cloud	safe
http://apache.org/xml/features/xincludeC	0%	Avira URL Cloud	safe
http://www.y.net.ye/services/domain_name.htm	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
google.com	142.250.185.238	true	false	unknown
pastebin.com	104.20.3.235	true	true	unknown
15.164.165.52.in-addr.arpa	unknown	unknown	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.domains.ph/FAQ2.asp	123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.chambersign.org1	123.sfx.exe, 00000000.00000003.2111743157.0000015A347E7000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2253255940.000000000AA98000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2253255940.000000000A9E5000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2249415666.000000000513A000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
HTTP://WWW.CHAMBERSIGN.ORG	javaw.exe, 00000005.00000002.2249415666.0000000004D96000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://apache.org/xml/properties/internal/entity-manager	javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://apache.org/xml/features/internal/parser-settings	javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://apache.org/xml/features/xinclude/fixup-base-uris	javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://apache.org/xml/features/validation/schema:	javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.nic.cd/domain/insertDomain_2.jsp?act=1	123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://apache.org/xml/properties/schema/external-schemaLocationJ	javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://apache.org/xml/features/scanner/notify-char-refs	javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://psg.com/dns/ng/	123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.dot.kn/domainRules.html	123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://apache.org/xml/properties/internal/symbol-table6	javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://java.sun.com/xml/schema/features/report-ignored-element-content-whitespace3	javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://policy.camerfirma.com0	123.sfx.exe, 00000000.00000003.2111743157.0000015A347E7000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2253255940.000000000AA98000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://apache.org/xml/properties/dom/current-element-node7	javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tld.by/rules_2006_en.html	123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.gobin.info/domainname/ml-template.doc	123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.nic.ps/registration/policy.html#reg	123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://apache.org/xml/features/continue-after-fatal-error	javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://apache.org/xml/features/standard-uri-conformant	javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://apache.org/xml/properties/internal/document-scanner	javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://psg.com/dns/lr/lr.txt	123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.nic.sl	123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.oracle.com/hotspot/jdk/	123.sfx.exe, 00000000.00000003.2111743157.0000015A347E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.certplus.com/CRL/class2.crl	javaw.exe, 00000005.00000002.2253255940.000000000AA98000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2253255940.000000000AC6A000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2249415666.000000000513A000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://bugreport.sun.com/bugreport/	javaw.exe, javaw.exe, 00000005.00000002.2269001419.000000006C603000.00000002.00000001.01000000.0000000E.sdmp, javaw.exe, 00000005.00000002.2253255940.000000000A237000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://whois.ati.tn/	123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.gobin.info/domainname/bw.doc	123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://java.oracle.com/	javaw.exe, javaw.exe, 00000005.00000002.2253255940.000000000A23F000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2269001419.000000006C603000.00000002.00000001.01000000.0000000E.sdmp	false	Avira URL Cloud: safe	unknown
http://www.nic.pa/	123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://apache.org/xml/features/	javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.cctld.ru/ru/docs/aktiv_8.php	123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.oracle.com/technetwork/java/javaseproducts/C:	javaw.exe, 00000005.00000002.2269300906.000000006C8E1000.00000002.00000001.01000000.0000000C.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/cps0(	jp2iexp.dll.4.dr, unpack200.exe.4.dr, WindowsAccessBridge.dll.4.dr, java.exe.4.dr	false	Avira URL Cloud: safe	unknown
http://www.oracle.com/hotspot/jvm/file-io-threshold	123.sfx.exe, 00000000.00000003.2111743157.0000015A347E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nic.gl	123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.certplus.com/CRL/class3P.crl	javaw.exe, 00000005.00000002.2253255940.000000000AA98000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2253255940.000000000A9E5000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.unicode.org/cldr/data/.	THIRDPARTYLICENSEREADME.txt.4.dr	false	Avira URL Cloud: safe	unknown
http://apache.org/xml/features/internal/validation/schema/use-grammar-pool-only	javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xml.org/sax/features/string-interningfeature	javaw.exe, 00000005.00000002.2260108258.00000000159B1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.cctld.nc/	123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://apache.org/xml/features/namespace-growth;	javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.nic.hn/politicas/ps02	123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/rpa00	jp2iexp.dll.4.dr, unpack200.exe.4.dr, WindowsAccessBridge.dll.4.dr, java.exe.4.dr	false	Avira URL Cloud: safe	unknown
http://java.sun.com/xml/stream/properties/$	javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://javax.xml.transform.sax.SAXTransformerFactory/feature	javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.0000000015086000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://javax.xml.XMLConstants/property/accessExternalStylesheet	javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.0000000015086000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://grweb.ics.forth.gr/english/1617-B-2005.html	123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://javadl.oracle.com/webapps/download/AutoDL%s?BundleId=%s%s	deployJava1.dll.4.dr	false	Avira URL Cloud: safe	unknown
http://xml.org/sax/features/validation?	javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://apache.org/xml/properties/security-manager	javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.0000000015086000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.gobin.info/domainname/mz-template.doc	123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xml.apache.org/xslt	javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.oracle.com/hotspot/jvm/	123.sfx.exe, 00000000.00000003.2111743157.0000015A347E7000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2269300906.000000006C8E1000.00000002.00000001.01000000.0000000C.sdmp	false	Avira URL Cloud: safe	unknown
http://www.norid.no/regelverk/vedlegg-d.en.html	123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://javax.xml.transform.stax.StAXResult/feature	javaw.exe, 00000005.00000002.2258519141.0000000015086000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://apache.org/xml/features/validation/warn-on-duplicate-attdef:	javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ict.gov.qa/	123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.linuxnet.com	THIRDPARTYLICENSEREADME.txt.4.dr	false	Avira URL Cloud: safe	unknown
http://apache.org/xml/features/namespaces	javaw.exe, 00000005.00000002.2260108258.00000000159B1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.centralnic.com/names/domains	123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://apache.org/xml/features/xinclude	javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://javax.xml.XMLConstants/property/	javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.isoc.sd/sudanic.isoc.sd/billing_pricing.htm	123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.nic.gp/index.php?lang=en	123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sbnic.net.sb/	123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://javadl.oracle.com/webapps/download/AutoDL%s?BundleId=%surl%s%stmp1.8%s.0%s	deployJava1.dll.4.dr	false	Avira URL Cloud: safe	unknown
http://openjdk.java.net/jeps/220).	javaw.exe, 00000005.00000002.2269300906.000000006C8E1000.00000002.00000001.01000000.0000000C.sdmp	false	Avira URL Cloud: safe	unknown
http://nic.ae/english/arabicdomain/rules.jsp	123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://apache.org/xml/properties/locale	javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://java.sun.com/xml/stream/properties/reader-in-defined-state	javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.nic.net.sg/sub_policies_agreement/2ld.html	123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.quovadisglobal.com/cps0	123.sfx.exe, 00000000.00000003.2111743157.0000015A347E7000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2253255940.000000000AA98000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2253255940.000000000A9E5000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.isnic.is/domain/rules.php	123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.afnic.fr/obtenir/chartes/nommage-fr/annexe-descriptifs	123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.nic.priv.at/	123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://apache.org/xml/properties/internal/validator/dtdD	javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://hoster.by/	123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.oracle.com/feature/use-service-mechanism	javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.0000000015086000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://dns.marnet.net.mk/postapka.php	123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://online.dns.pt/dns/start_dns	123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://javax.xml.transform.stream.StreamSource/feature	javaw.exe, 00000005.00000002.2258519141.0000000015086000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.nic.sc/	123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://samoanic.ws/index.dhtml	123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.nic.mx/	123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://javax.xml.transform.dom.DOMSource/feature	javaw.exe, 00000005.00000002.2253255940.000000000A6B0000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.0000000015086000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.nic.tj/policy.htm	123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.unicode.org/reports/	THIRDPARTYLICENSEREADME.txt.4.dr	false	Avira URL Cloud: safe	unknown
http://www.dot.mp/	123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.quovadisglobal.com/cps	javaw.exe, 00000005.00000002.2253255940.000000000AA98000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.registrar.mw/	123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://apache.org/xml/properties/dom/document-class-name	javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://java.sun.com/xml/schema/features/report-ignored-element-content-whitespace	javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.dns.lu/en/	123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.nic.cr/niccr_publico/showRegistroDominiosScreen.do	123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://apache.org/xml/properties/internal/symbol-table	javaw.exe, 00000005.00000002.2253255940.000000000A5DE000.00000004.00001000.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.2258519141.00000000151A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://about.museum/naming/	123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.y.net.ye/services/domain_name.htm	123.sfx.exe, 00000000.00000003.2111743157.0000015A333E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://apache.org/xml/features/xincludeC	javaw.exe, 00000005.00000002.2260108258.00000000157EC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.20.3.235	pastebin.com	United States		13335	CLOUDFLARENETUS	true
142.250.185.238	google.com	United States		15169	GOOGLEUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1513331
Start date and time:	2024-09-18 18:26:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	123.sfx.exe
Detection:	MAL
Classification:	mal80.troj.evad.winEXE@11/218@4/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 112 Number of non-executed functions: 204
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: 123.sfx.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.20.3.235	SX8OLQP63C.exe	Get hash	malicious	VjW0rm, AsyncRAT, RATDispenser	Browse	pastebin.com/raw/V9y5Q5vv
	sostener.vbs	Get hash	malicious	Remcos	Browse	pastebin.com/raw/V9y5Q5vv
	New Voicemail Invoice 64746w .js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
	Invoice-883973938.js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
	2024 12_59_31 a.m..js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
	PendingInvoiceBankDetails.JS.js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pastebin.com	SKMBT88122024816310TD01202817311 .vbs	Get hash	malicious	Remcos	Browse	104.20.3.235
	Payment Advice.pdf.js	Get hash	malicious	Remcos	Browse	172.67.19.24
	SKMBT_77122024816310TD01_20220128_17311 .vbs	Get hash	malicious	Remcos	Browse	172.67.19.24
	file.exe	Get hash	malicious	XWorm	Browse	104.20.3.235
	stub.exe	Get hash	malicious	AsyncRAT	Browse	104.20.3.235
	SecuriteInfo.com.Trojan.DownLoaderNET.786.13278.22147.exe	Get hash	malicious	Unknown	Browse	104.20.4.235
	SecuriteInfo.com.Trojan.GenericKD.74126573.27896.28845.dll	Get hash	malicious	Metasploit	Browse	104.20.4.235
	SecuriteInfo.com.Trojan.GenericKD.74126573.27896.28845.dll	Get hash	malicious	Metasploit	Browse	104.20.3.235
	SecuriteInfo.com.Trojan.Siggen21.26995.26259.1562.exe	Get hash	malicious	Unknown	Browse	104.20.4.235
	OTPAuthenticator.wsf	Get hash	malicious	AsyncRAT	Browse	104.20.3.235

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://25625895-1256460.renderforestsites.com/	Get hash	malicious	Unknown	Browse	104.26.4.228
	https://jimdo-storage.global.ssl.fastly.net/file/b654e430-210e-4d3f-8028-5dba8182e65e/saxugulafovelogov.pdf	Get hash	malicious	Unknown	Browse	104.26.2.174
	https://sporadictrain.com/0/0/0/04ebf7f9c501921752b6ba11e7fa51e8/9b-3042209-11487937-198113-14100-/527524137	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp/d%C2%ADo%C2%ADm%C2%ADin%C2%ADi%C2%ADo%C2%ADn%C2%ADw%C2%ADh%C2%ADe%C2%ADe%C2%ADl%C2%ADs%C2%ADg%C2%ADr%C2%ADo%C2%ADu%C2%ADp%C2%AD.%C2%ADc%C2%ADom/cx	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://lookerstudio.google.com/s/kUeEbpcqsIg	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp/m%C2%ADi%C2%ADt%C2%ADr%C2%ADak%C2%ADar%C2%ADya%C2%ADja%C2%ADpi%C2%ADn%C2%ADd%C2%ADo%C2%AD.%C2%ADc%C2%ADom/rc	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFmLpE8ts6lIhlcp51U7e2yf5B7vy3w1nK73JNWvmz6hjypwv_OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZN-2ByJ1Sr8faXo4uvobQEBcsjHY7wdwonNuOIBa-2B-2FBrFw-2BCZCtMlAhS4SXAp73B5pNq-2Bgh7BWfayUcQGDVvSNiUaaQcT1rWptsP9EAFj-2F-2Fo1hp4YiQWgbr3qzFuLY0VFlimwxByUHGZTypjmSN-2BJxzBcSxuyDN7KCpiRToussGLp-2F8Bv-2BnRQRWB2LMljOPGUDPoR-2BZ5TErAqqZIj7v5CU9ZXcq0uM1AYadswQu6P6QVmADKlcX6DM9Q2LldlXvmCQvY-3D#cHBvc29sdXRpb25zQHVuaXRhc2RlbnRhbC5jb20=	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://www.google.md/url?url=https://demeropkdfzdbi&uxzs=zemleptc&icmeyuc=zn0&ywprgz=icmeyuc&uxzs=zemleptc&ywprgz=icmeyuc&fzdbi=demeropkd&znzn=ywprgzuxzs&q=amp%2F%73%75%67%61%72%72%65%73%2E%6C%6B%2F%6C%6F%6A%2F2288679500%2FYnlyb24uYmxvdGNreUBjb21tZXJjZWJhbmsuY29t	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Payment_Release-Now cnesst.gouv.qc.ca.html	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp/p%C2%ADep%C2%ADe%C2%ADm%C2%ADu%C2%ADj%C2%ADi%C2%ADc%C2%ADa%C2%AD.%C2%ADc%C2%ADom/hj	Get hash	malicious	Unknown	Browse	104.21.7.172

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\RDBNT\jre\bin\JAWTAccessBridge-32.dll	EYOFFTITMDLXZJFFCCGFDTBIY.msi	Get hash	malicious	Unknown	Browse
	SSCBOLGZFXVJMEICRNQMJOCDIF.msi	Get hash	malicious	Unknown	Browse
	BOCTGZXINFFCD20242108.msi	Get hash	malicious	Unknown	Browse
	PGCTGZXFCD20242008.msi	Get hash	malicious	Unknown	Browse
	CloudInstaller.zip	Get hash	malicious	Unknown	Browse
	uChcvn3L6R.exe	Get hash	malicious	DCRat	Browse
	uChcvn3L6R.exe	Get hash	malicious	DCRat	Browse
	Advanced_IP_Scanner_2.5.4594.1 (1).exe	Get hash	malicious	Unknown	Browse
	New Soft Update.exe	Get hash	malicious	Unknown	Browse
	https://uceg-klom.us21.list-manage.com/track/click?u=9b882a29c7ab3b3f6381abd18&id=56bb8add24&e=4fba4902f9x	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\Public\123.exe

Download File

Process:	C:\Users\user\Desktop\123.sfx.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	161739843
Entropy (8bit):	6.708675118449867
Encrypted:	false
SSDEEP:	1572864:HQAcje4a6u24/Zcv/GhiQs0GZTjjY1UWB4Lcnpw:HQNJa61b5Tjj/5Lc+
MD5:	8A5D3B7370D1B880AD305C1691CDBE77
SHA1:	0BEBCCC689A56E6D8840303C0F91113AA227CD64
SHA-256:	409B326646FBA9133794167D385A91518A40B4A4DCE375A0006FAA113F9C6770
SHA-512:	9E49774A8A8BE53D3A9F43F9BB7365924A70599C005980350EC978A55E9D38CDD383AEE985486EC6DDF01DF5457FD985ED8B445FAFF5364D7674C6B6A8A49512
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1 ..PN..PN..PN._...PN..PO.JPN._...PN.s~..PN..VH..PN.Rich.PN.........................PE..L....C.f.................j..........R5............@.......................................@..........................................................................................................................................................text....h.......j.................. ..`.rdata..d............n..............@..@.data...............................@....ndata.......P...........................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\.oracle_jre_usage\f85846f105877459.timestamp

Download File

Process:	C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.805919788081816
Encrypted:	false
SSDEEP:	3:oNUkh4EaKC5Rrx5YyvMjSRy:oN9aZ5dwy0
MD5:	72896D073A78346ACEEF037552D9921E
SHA1:	804E146C09DACBC3B97D341998D8DA20CE6E6713
SHA-256:	D4661835EE33B680C2E092C9862846C85475808292A689F8600437668C206730
SHA-512:	1EE8070D286DBCEF1F2F40F2A33DA63D3EA440A7A264B5CAF2D09947D4E86684528BFCE92B07FEAF22A1893B1060DDD24A0B2F86E3CB2ED8FE708758DF83D3FB
Malicious:	false
Reputation:	low
Preview:	C:\Users\user\AppData\Roaming\RDBNT\jre..1726676837274..

C:\Users\user\AppData\Local\Temp\hsperfdata_user\6508

Download File

Process:	C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.3477203361539847
Encrypted:	false
SSDEEP:	192:14v8G6O1CcF5A0nmhIrPyPrvn0qPePLPwPWPdPsPpGb:K8PO1CcF59CE6jDmTIuFkx4
MD5:	2C90E46F528E2EF29DDECCE3F06A9AE5
SHA1:	4535069F8BA38FF4ABDDD98793EA80B7598ADB6E
SHA-256:	E9EE5CBAD8B45BDA7F481E861100855B234AABA2965FBF9E5B35D30BECDF1760
SHA-512:	6F31C4907D37C7C53031837FB60B708E67047F3CC50B00C904BC9125DB38A2C706D94824C3A8E94D797F8920D9B5DCB4B7634B4FF3432E7DC44A76EA9D4F768D
Malicious:	false
Reputation:	low
Preview:	.........:.......c...... .......8...........J...0...sun.rt._sync_Inflations...../.......8...........J...0...sun.rt._sync_Deflations.....+.......@...........J...8...sun.rt._sync_ContendedLockAttempts..........8...........J...0...sun.rt._sync_FutileWakeups..........0...........J...(...sun.rt._sync_Parks..1.......@...........J...8...sun.rt._sync_EmptyNotifications.............8...........J...0...sun.rt._sync_Notifications..,.......8...........J...0...sun.rt._sync_SlowEnter..............8...........J...0...sun.rt._sync_SlowExit...............8...........J...0...sun.rt._sync_SlowNotify.............8...........J...0...sun.rt._sync_SlowNotifyAll..........8...........J...0...sun.rt._sync_FailedSpins............@...........J...8...sun.rt._sync_SuccessfulSpins................8...........J...0...sun.rt._sync_PrivateA...............8...........J...0...sun.rt._sync_PrivateB...............@...........J...8...sun.rt._sync_MonInCirculation...............8...........J...0...sun.rt._sync_MonScavenged...

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\83aa4cc77f591dfc2374580bbd95f6ba_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe
File Type:	data
Category:	dropped
Size (bytes):	45
Entropy (8bit):	0.9111711733157262
Encrypted:	false
SSDEEP:	3:/lwlt7n:WNn
MD5:	C8366AE350E7019AEFC9D1E6E6A498C6
SHA1:	5731D8A3E6568A5F2DFBBC87E3DB9637DF280B61
SHA-256:	11E6ACA8E682C046C83B721EEB5C72C5EF03CB5936C60DF6F4993511DDC61238
SHA-512:	33C980D5A638BFC791DE291EBF4B6D263B384247AB27F261A54025108F2F85374B579A026E545F81395736DD40FA4696F2163CA17640DD47F1C42BC9971B18CD
Malicious:	false
Reputation:	high, very likely benign file
Preview:	........................................J2SE.

C:\Users\user\AppData\Roaming\RDBNT\jre\COPYRIGHT

Download File

Process:	C:\Users\Public\123.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3313
Entropy (8bit):	4.557128068430301
Encrypted:	false
SSDEEP:	96:a58tiSm9iicC7CRRS9i7cq11iUDcsMLks0h9n:WOi59rcF/Cigq11iUD5MLks0z
MD5:	FC605D978E7825595D752DF2EF03F8AF
SHA1:	C493C9541CAAEE4BFE3B3E48913FD9DF7809299F
SHA-256:	7D697EAA9ACF50FE0B57639B3C62FF02916DA184F191944F49ECA93D0BB3374F
SHA-512:	FB811DE6A2B36B28CA904224EA3525124BD4628CA9618C70EB9234AB231A09C1B1F28D9B6301581A4FA2E20F1036D5E1C3D6F1BF316C7FE78EF6EDEAE50EA40E
Malicious:	false
Preview:	Copyright . 1993, 2016, Oracle and/or its affiliates...All rights reserved.....This software and related documentation are provided under a..license agreement containing restrictions on use and..disclosure and are protected by intellectual property laws...Except as expressly permitted in your license agreement or..allowed by law, you may not use, copy, reproduce, translate,..broadcast, modify, license, transmit, distribute, exhibit,..perform, publish, or display any part, in any form, or by..any means. Reverse engineering, disassembly, or..decompilation of this software, unless required by law for..interoperability, is prohibited.....The information contained herein is subject to change..without notice and is not warranted to be error-free. If you..find any errors, please report them to us in writing.....If this is software or related documentation that is..delivered to the U.S. Government or anyone licensing it on..behalf of the U.S. Government, the following notice is..applicable:...

C:\Users\user\AppData\Roaming\RDBNT\jre\LICENSE

Download File

Process:	C:\Users\Public\123.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.271470906740504
Encrypted:	false
SSDEEP:	3:c3AXFshzhRSkv:c9hzhgkv
MD5:	67CB88F6234B6A1F2320A23B197FA3F6
SHA1:	877ACEBA17B28CFFF3F5DF664E03B319F23767A1
SHA-256:	263E21F4B43C118A8B4C07F1A8ACB11CAFC232886834433E34187F5663242360
SHA-512:	4D43E5EDECAB92CEBD853204C941327DCCBFD071A71F066C12F7FB2F1B2DEF59C37A15CE05C4FE06EC2EA296B8630C4E938254A8A92E149E4A0A82C4307D648F
Malicious:	false
Preview:	Please refer to http://java.com/license..

C:\Users\user\AppData\Roaming\RDBNT\jre\README.txt

Download File

Process:	C:\Users\Public\123.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.2563005536211715
Encrypted:	false
SSDEEP:	3:c3AXFshzhRSkjn:c9hzhgkjn
MD5:	4BDA1F1B04053DCFE66E87A77B307BB1
SHA1:	B8B35584BE24BE3A8E1160F97B97B2226B38FA7D
SHA-256:	FD475B1619675B9FB3F5CD11D448B97EDDEE8D1F6DDCCA13DED8BC6E0CAA9CF3
SHA-512:	997CEE676018076E9E4E94D61EC94D5B69B148B3152A0148E70D0BE959533A13AD0BC1E8B43268F91DB08B881BF5050A6D5C157D456597260A2B332A48068980
Malicious:	false
Preview:	Please refer to http://java.com/licensereadme..

C:\Users\user\AppData\Roaming\RDBNT\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt

Download File

Process:	C:\Users\Public\123.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	111645
Entropy (8bit):	4.8590909329531025
Encrypted:	false
SSDEEP:	1536:iiVRF8bLuepEvc5O5YwT3JJ4WOHHA/AFjrlHyEepdfZ9JIH4gDq:dRMiCOjJJ4pg/0Hx9MlZ9KH47
MD5:	0E05BD8B9BFCF17F142445D1F8C6561C
SHA1:	CF0A9F4040603008891AA0731ABF89CE2403F2FB
SHA-256:	C3EA3996241B8E9AE7DB3780E470174076FD2003D8AEFAA77BF0BAB5E04DE050
SHA-512:	07C7865D31D22BA0C68E384AFEDC22261F7B3A82BEBC9324145FF7F631623ECA2DC31C71CDBBFC9FEBC1733451A095302DE2A0877821A5B68038E350969BF460
Malicious:	false
Preview:	.DO NOT TRANSLATE OR LOCALIZE....**************************************************************************....%%The following software may be included in this product:..Microsoft DirectShow - Base Classes....Use of any of this software is governed by the terms of the license below:....MSDN - Information on Terms of Use....Updated: February 13, 2008....ON THIS PAGE.... ACCEPTANCE OF TERMS.. * PRIVACY AND PROTECTION OF PERSONAL INFORMATION.. * NOTICE SPECIFIC TO APIs AVAILABLE ON THIS WEB SITE.. * NOTICE SPECIFIC TO SOFTWARE AVAILABLE ON THIS WEB SITE.. * NOTICE SPECIFIC TO DOCUMENTATION AVAILABLE ON THIS WEB SITE.. * NOTICES REGARDING SOFTWARE, DOCUMENTATION, APIS AND SERVICES AVAILABLE ON..THIS WEB SITE.. * RESERVATION OF RIGHTS.. * MEMBER ACCOUNT, PASSWORD, AND SECURITY.. * NO UNLAWFUL OR PROHIBITED USE.. * USE OF SERVICES.. * MATERIALS PROVIDED TO MICROSOFT OR POSTED AT ANY MICROSOFT WEB SITE.. * NOTICES AND PROCEDURE FOR MAKING CLAIMS OF COP

C:\Users\user\AppData\Roaming\RDBNT\jre\THIRDPARTYLICENSEREADME.txt

Download File

Process:	C:\Users\Public\123.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	180668
Entropy (8bit):	5.064180003233063
Encrypted:	false
SSDEEP:	3072:54ct+BcF1N7m8arf1kHRSusX2NyJ9KH4PF4j52eTjLAzE7GzmCK+XNhalQxkM8QB:N7mtrf1GhMF4j5RMGQoyzaXmR
MD5:	0E87879F452892B85C81071A1DDD5A2A
SHA1:	2CF97C1A84374A6FBBD5D97FE1B432FA799C3B19
SHA-256:	9C18836FD0B5E4B0C57CFFDB74574FA5549085C3B327703DC8EFE4208F4E3321
SHA-512:	10BA68FFD9DEAB10A0B200707C3AF9E95E27AED004F66F049D41310CB041B7618EE017219C848912D5951599208D385BCB928DD33175652101C7E5BC2E3EBA5B
Malicious:	false
Preview:	DO NOT TRANSLATE OR LOCALIZE...-----------------------------....%% This notice is provided with respect to ASM Bytecode Manipulation ..Framework v5.0.3, which may be included with JRE 8, and JDK 8, and ..OpenJDK 8.....--- begin of LICENSE ---....Copyright (c) 2000-2011 France T.l.com..All rights reserved.....Redistribution and use in source and binary forms, with or without..modification, are permitted provided that the following conditions..are met:....1. Redistributions of source code must retain the above copyright.. notice, this list of conditions and the following disclaimer.....2. Redistributions in binary form must reproduce the above copyright.. notice, this list of conditions and the following disclaimer in the.. documentation and/or other materials provided with the distribution.....3. Neither the name of the copyright holders nor the names of its.. contributors may be used to endorse or promote products derived from.. this software without specific prior written

C:\Users\user\AppData\Roaming\RDBNT\jre\Welcome.html

Download File

Process:	C:\Users\Public\123.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	983
Entropy (8bit):	5.135635144562017
Encrypted:	false
SSDEEP:	24:+STATDcxWpAVjXQ5cjaJ2gjQo4OSED6R8R/TtDpM:+STATD7pqjXBeJdso4OnxRc
MD5:	3CB773CB396842A7A43AD4868A23ABE5
SHA1:	ACE737F039535C817D867281190CA12F8B4D4B75
SHA-256:	F450AEE7E8FE14512D5A4B445AA5973E202F9ED1E122A8843E4DC2D4421015F0
SHA-512:	6058103B7446B61613071C639581F51718C12A9E7B6ABD3CF3047A3093C2E54B2D9674FAF9443570A3BB141F839E03067301FF35422EB9097BD08020E0DD08A4
Malicious:	false
Preview:	<html>..<head>..<title>..Welcome to the Java(TM) Platform..</title>..</head>..<body>....<h2>Welcome to the Java<SUP><FONT SIZE=-2>TM</FONT></SUP> Platform</h2>..<p> Welcome to the Java<SUP><FONT SIZE=-2>TM</FONT></SUP> Standard Edition Runtime .. Environment. This provides complete runtime support for Java applications. ..<p> The runtime environment includes the Java<SUP><FONT SIZE=-2>TM</FONT></SUP> .. Plug-in product which supports the Java environment inside web browsers. ..<h3>References</h3>..<p>..See the <a href="http://download.oracle.com/javase/7/docs/technotes/guides/plugin/">Java Plug-in</a> product..documentation for more information on using the Java Plug-in product...<p> See the <a href=.."http://www.oracle.com/technetwork/java/javase/overview/"..>Java Platform</a> web site for .. more information on the Java Platform. ..<hr>..<font size="-2">..Copyright (c) 2006, 2016, Oracle and/or its affiliates. All rights reserved...</font>..<p>..</body>..</html>..

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\JAWTAccessBridge-32.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14912
Entropy (8bit):	6.141852308272967
Encrypted:	false
SSDEEP:	192:7pQMhM63XLPVT6MsMPapRuBUEp7nYe+PjPriT0fwtK:7muL7PV4aapRuBTp7nYPLr7J
MD5:	D63933F4E279A140CC2A941CCFF38348
SHA1:	75169BE2E9BCFE20674D72D43CA6E2BC4A5A9382
SHA-256:	532D049E0D7A265754902C23B0F150D665A78A3D6FE09AD51C9BE8C29D574A3D
SHA-512:	D7A5023A5EB9B0C3B2AD6F55696A166F07FA60F9D1A12D186B23AAAACC92EF948CB5DFFA013AFC90C4BBE3DE077D591185902384F677D0BAE2FF7CFD5DB5E06C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: EYOFFTITMDLXZJFFCCGFDTBIY.msi, Detection: malicious, Browse Filename: SSCBOLGZFXVJMEICRNQMJOCDIF.msi, Detection: malicious, Browse Filename: BOCTGZXINFFCD20242108.msi, Detection: malicious, Browse Filename: PGCTGZXFCD20242008.msi, Detection: malicious, Browse Filename: CloudInstaller.zip, Detection: malicious, Browse Filename: uChcvn3L6R.exe, Detection: malicious, Browse Filename: uChcvn3L6R.exe, Detection: malicious, Browse Filename: Advanced_IP_Scanner_2.5.4594.1 (1).exe, Detection: malicious, Browse Filename: New Soft Update.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........5.Z.[.Z.[.Z.[.A<..[.[.A<..Q.[.A<.._.[.S...X.[.Z.Z.D.[.A<..Y.[.A<..[.[.A<..[.[.A<..[.[.RichZ.[.................PE..L...yPjW...........!......................... .....m.........................`......em....@.........................`%......,"..P....@..x............"..@....P.. .... ............................... ..@............ ...............................text............................... ..`.rdata..d.... ......................@..@.data...`....0......................@....rsrc...x....@......................@..@.reloc..^....P....... ..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\JAWTAccessBridge.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14912
Entropy (8bit):	6.1347115439165085
Encrypted:	false
SSDEEP:	192:0Usw4DPU3XLPVT6GsKOhWIutUinYe+PjPriT0fwyI8:ew7PVIKyWIutDnYPLr728
MD5:	B4EB9B43C293074406ADCA93681BF663
SHA1:	16580FB7139D06A740F30D34770598391B70AC96
SHA-256:	8CD69AF7171F24D57CF1E6D0D7ACD2B35B4EA5FDF55105771141876A67917C52
SHA-512:	A4E999E162B5083B6C6C3EAFEE4D84D1EC1C61DCA6425F849F352FFDCCC2E44DFEE0625C210A8026F9FF141409EEBF9EF15A779B26F59B88E74B6A2CE2E82EF9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........5.Z.[.Z.[.Z.[.A<..[.[.A<..Q.[.A<.._.[.S...X.[.Z.Z.D.[.A<..Y.[.A<..[.[.A<..[.[.A<..[.[.RichZ.[.................PE..L...zPjW...........!......................... .....m.........................`.......2....@.........................`%......,"..P....@..p............"..@....P.. .... ............................... ..@............ ...............................text............................... ..`.rdata..a.... ......................@..@.data...`....0......................@....rsrc...p....@......................@..@.reloc..^....P....... ..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\JavaAccessBridge-32.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	128064
Entropy (8bit):	6.428684952829155
Encrypted:	false
SSDEEP:	3072:uN77TJSG78+5Orcj5K/e2Hrgc6kZAn1yEkBKMKy1Zf22QYHJiuzTl8ShzzM+64mn:uNXd178+5fJZnQLo
MD5:	2F808ED0642BD5CF8D4111E0AF098BBB
SHA1:	006163A07052F3D227C2E541691691B4567F5550
SHA-256:	61DFB6126EBA8D5429F156EAAB24FF30312580B0ABE4009670F1DD0BC64F87BB
SHA-512:	27DBDA3A922747A031FF7434DE5A596725FF5AE2BC6DD83D6D5565EB2BA180B0516896323294459997B545C60C9E06DA6C2D8DD462A348A6759A404DB0F023A7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........[d.@:.N@:.N@:.N[..NB:.N[..NB:.N[..NK:.NIB.NE:.N@:.N{:.N[..NG:.N[..NA:.N[..NA:.N[..NA:.NRich@:.N........PE..L...rPjW...........!................#..............m................................p.....@.........................p...........P.......x...............@...........................................p...@............................................text............................... ..`.rdata..............................@..@.data...............................@....rsrc...x...........................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\JavaAccessBridge.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	127552
Entropy (8bit):	6.413283221897154
Encrypted:	false
SSDEEP:	3072:SdQ4jWJt4XChlFavveKSQ4gHK/e2Hrgc6kZAn1y1koKMKy1Zf22QYHJiuzTl8ShM:Sy4SJ1TFavvehc7ZnwEr
MD5:	C3DED5F41E28FAF89338FB46382E4C3E
SHA1:	6F77920776D39550355B146D672C199A3941F908
SHA-256:	4691603DFABE6D7B7BEAC887DADC0E96243C2FF4F9A88CE3793E93356C53AA08
SHA-512:	23621F2856899F40CFA9858DC277372BFE39F0205377543EB23E94422D479A53FDF664F4A9A4515C2285811F01D91AB64A834A03A4D3AB0CB7D78F8AF11135FF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........[d.@:.N@:.N@:.N[..NB:.N[..NB:.N[..NK:.NIB.NE:.N@:.N{:.N[..NG:.N[..NA:.N[..NA:.N[..NA:.NRich@:.N........PE..L...sPjW...........!...............................m......................................@.........................@...........P.......p...............@...........................................H...@............................................text...n........................... ..`.rdata..............................@..@.data...............................@....rsrc...p...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\WindowsAccessBridge-32.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	97856
Entropy (8bit):	6.467907542894502
Encrypted:	false
SSDEEP:	1536:/fHGbDtpt+WfGegcX30EJ4YHiYmRkgAPe+GP8uWg1kQOPt:/w2WfGe/30EWbY4Z+GpWuHOPt
MD5:	F78D2BF2C551BE9DF6A2F3210A2964C1
SHA1:	B6A4160ECA4C0D0552234FF69BCFDF45F0A2A352
SHA-256:	9D18E5421A8606985FA54D7CEA921D1B8930358A2E4CDF5FDF2A8B3E4D857288
SHA-512:	AAC8622683BE57518F8B03198A03BF1F760E082692C1FB6252E96CDBA19D3CEB0A6786CCBD7B98830E865297308FA99DBBEA464E41041ABDDA18AEB862BA993F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./zR/k.<\|k.<\|k.<\|p..\|{.<\|p..\|2.<\|bc.\|n.<\|k.=\|7.<\|p..\|O.<\|p..\|j.<\|p..\|j.<\|p..\|j.<\|Richk.<\|........................PE..L...pPjW...........!................At.............p................................7P....@..........................9..A....1..<....................f..@............................................,..@...............@............................text...\........................... ..`.rdata..Qg.......h..................@..@.data...`,...P.......8..............@....rsrc................F..............@..@.reloc..J............N..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\WindowsAccessBridge.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	95808
Entropy (8bit):	6.48897048228647
Encrypted:	false
SSDEEP:	1536:EHSB4i2hJwZaDEoDVzkhbyJCAqn9nV+1vkJnHBoY8BK5Hj:EJJwZWEoDVYby81yiBovkHj
MD5:	E5A6231FE1E6FEC5F547DFD845D209BC
SHA1:	3F21F90ECC377B6099637D5B59593D2415450D45
SHA-256:	51355EA8A7DC238483C8069361776103779CE9FE3CD0267770E321E6E4368366
SHA-512:	D5D20DF0089F3217B627D39ABD57C61E026D0DC537022FB698F85FA6893C7FA348C40295DEEC78506F0EF608827D39E2F6F3538818BA25E2A0EE1145FCC95940
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./zR/k.<\|k.<\|k.<\|p..\|{.<\|p..\|2.<\|bc.\|n.<\|k.=\|7.<\|p..\|O.<\|p..\|j.<\|p..\|j.<\|p..\|j.<\|Richk.<\|........................PE..L...qPjW...........!................!o.............p......................................@.........................p7..>...<0..<.......x............^..@...........................................(+..@...............@............................text...<........................... ..`.rdata...e.......f..................@..@.data...`,...P.......0..............@....rsrc...x............>..............@..@.reloc..J............F..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\awt.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1182272
Entropy (8bit):	6.63089480914076
Encrypted:	false
SSDEEP:	24576:68M4H6ioDs5FELnSbY6Ck2IlAnVCXQlFg3:9eaGnkXQlFQ
MD5:	159CCF1200C422CED5407FED35F7E37D
SHA1:	177A216B71C9902E254C0A9908FCB46E8D5801A9
SHA-256:	30EB581C99C8BCBC54012AA5E6084B6EF4FCEE5D9968E9CC51F5734449E1FF49
SHA-512:	AB3F4E3851313391B5B8055E4D526963C38C4403FA74FB70750CC6A2D5108E63A0E600978FA14A7201C48E1AFD718A1C6823D091C90D77B17562B7A4C8C40365
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.Q...?...?...?......?.......?.......?.z...?.......?.......?...>.;.?.....s.?.....w.?.......?.......?.......?.Rich..?.........................PE..L...nPjW...........!................,G.............m.........................P......Y.....@.................................,{...........N..............@....P......................................v..@............... ....V..`....................text...<........................... ..`.rdata.............................@..@.data...8....@...~...2..............@....rsrc....N.......P..................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\bci.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15424
Entropy (8bit):	6.380726588633652
Encrypted:	false
SSDEEP:	384:1Td3hw/L3kKLnYgIOGOOssnPV5Lnf6onYPLr7EbH:1zw/bkKLt7KnddnfPC7S
MD5:	A46289384F76C2A41BA7251459849288
SHA1:	4D8EF96EDBE07C8722FA24E4A5B96EBFA18BE2C4
SHA-256:	728D64BC1FBF48D4968B1B93893F1B5DB88B052AB82202C6840BF7886A64017D
SHA-512:	34D62BEB1FA7D8630F5562C1E48839CE9429FAEA980561E58076DF5F19755761454EEB882790EC1035C64C654FC1A8CD5EB46ECA12E2BC81449ACBB73296C9E8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6...W..W..W../x.W...w.W..W..W....s.W...u.W...@.W...A.W...p.W...q.W...v.W..Rich.W..........................PE..L...nPjW...........!......................... .....m.........................`.......9....@..........................'......\|$..<....@...............$..@....P....... ..............................8#..@............ ...............................text............................... ..`.rdata..v.... ......................@..@.data...p....0......................@....rsrc........@......................@..@.reloc.......P......."..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\client\Xusage.txt

Download File

Process:	C:\Users\Public\123.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1447
Entropy (8bit):	4.228834598358894
Encrypted:	false
SSDEEP:	24:+3AKdmzfuv6pBSyGJkR/4o6kn2SRGehD+GrspGC/hLRra:BzMUBLGJkBA+RGeV+GrspGC/TO
MD5:	F4188DEB5103B6D7015B2106938BFA23
SHA1:	8E3781A080CD72FDE8702EB6E02A05A23B4160F8
SHA-256:	BD54E6150AD98B444D5D24CEA9DDAFE347ED11A1AAE749F8E4D59C963E67E763
SHA-512:	0BE9A00A48CF8C7D210126591E61531899502E694A3C3BA7C3235295E80B1733B6F399CAE58FB4F7BFF2C934DA7782D256BDF46793F814A5F25B7A811D0CB2E3
Malicious:	false
Preview:	-Xmixed mixed mode execution (default).. -Xint interpreted mode execution only.. -Xbootclasspath:<directories and zip/jar files separated by ;>.. set search path for bootstrap classes and resources.. -Xbootclasspath/a:<directories and zip/jar files separated by ;>.. append to end of bootstrap class path.. -Xbootclasspath/p:<directories and zip/jar files separated by ;>.. prepend in front of bootstrap class path.. -Xnoclassgc disable class garbage collection.. -Xincgc enable incremental garbage collection.. -Xloggc:<file> log GC status to a file with time stamps.. -Xbatch disable background compilation.. -Xms<size> set initial Java heap size.. -Xmx<size> set maximum Java heap size.. -Xss<size> set java thread stack size.. -Xprof output cpu profiling data.. -Xfuture enable strictest checks, an

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\client\jvm.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3857984
Entropy (8bit):	6.850425436805504
Encrypted:	false
SSDEEP:	98304:GyXul1SNceWfkD000V3wnIACM7g6cv/GZ:Q1SgfEP0ZwnIA97dcv/GZ
MD5:	39C302FE0781E5AF6D007E55F509606A
SHA1:	23690A52E8C6578DE6A7980BB78AAE69D0F31780
SHA-256:	B1FBDBB1E4C692B34D3B9F28F8188FC6105B05D311C266D59AA5E5EC531966BC
SHA-512:	67F91A75E16C02CA245233B820DF985BD8290A2A50480DFF4B2FD2695E3CF0B4534EB1BF0D357D0B14F15CE8BD13C82D2748B5EDD9CC38DC9E713F5DC383ED77
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$=.$`\.w`\.w`\.w{.Twb\.w..Pwf\.w{.Vwl\.w{.bwl\.wi$[wo\.w`\.w}].w{.cw-^.w{.Swa\.w{.Rwa\.w{.Uwa\.wRich`\.w........PE..L...nPjW...........!......,...........+.......,....m..........................<......q;...@...........................4.......4.......9.(.............:.@.... 9..G....,..............................t2.@.............,.P............................text.....+.......,................. ..`.rdata..Y.....,.......,.............@..@.data...d.....5..*....4.............@....rsrc...(.....9......"7.............@..@.reloc..\.... 9......(7.............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\dcpr.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	142912
Entropy (8bit):	7.350682736920136
Encrypted:	false
SSDEEP:	3072:aoGzTjLkRPQ9U9NuLqcNicj5ojGylYCE2Iu2jGLF5A9bE8LUekfCz:LGz/oRPGLJN1IGgYCE2L1F5A9bEGUeR
MD5:	4BDC32EF5DA731393ACC1B8C052F1989
SHA1:	A677C04ECD13F074DE68CC41F13948D3B86B6C19
SHA-256:	A3B35CC8C2E6D22B5832AF74AAF4D1BB35069EDD73073DFFEC2595230CA81772
SHA-512:	E71EA78D45E6C6BD08B2C5CD31F003F911FD4C82316363D26945D17977C2939F65E3B9748447006F95C3C6653CE30D2CDA67322D246D43C9EB892A8E83DEB31A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k..K.c.K.c.K.c.Br..I.c.P...H.c.P...I.c.P...N.c.K.b.m.c.P...m.c.P...J.c.P...J.c.P...J.c.RichK.c.........................PE..L...nPjW...........!.........Z......V.............Sm.........................@.......!....@.................................<...P.... ..................@....0..........................................@............................................text...n........................... ..`.rdata........... ..................@..@.data....+.......(..................@....rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\decora_sse.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	64064
Entropy (8bit):	6.338192715882019
Encrypted:	false
SSDEEP:	1536:Skh2CQuUlng7qkKi5iO8pm8cN9qOU33oit:Skkhu0nTli5jN8cNAOUHnt
MD5:	B04ABE76C4147DE1D726962F86473CF2
SHA1:	3104BADA746678B0A88E5E4A77904D78A71D1AB8
SHA-256:	07FF22E96DCFD89226E5B85CC07C34318DD32CDA23B7EA0474E09338654BFEB3
SHA-512:	2E4E2FEB63B6D7388770D8132A880422ABF6A01941BFF12CAD74DB4A641BDA2DCC8BF58F6DAE90E41CC250B79E7956DDF126943E0F6200272F3376A9A19505F1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?...{.\|.{.\|.{.\|..N..y.\|.{.}.g.\|.v.x.\|.v.y.\|.v.w.\|.v.y.\|....Z.\|....z.\|.v.z.\|....z.\|.Rich{.\|.........................PE..L...nPjW...........!......... ......_.............Vm......................... .......*....@.....................................<.......................@...........................................(...@...............t............................text............................... ..`.rdata..............................@..@.data...\...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\deploy.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	453184
Entropy (8bit):	6.516599034237354
Encrypted:	false
SSDEEP:	6144:3J/sbugq7rm5zX2JDYfiA9+wvpsEWcIGnFm8iTFOBITfnvxIW1x8:3JUbzq+5zX25qvdfnFm88nvq+x8
MD5:	5EDAEFFC60B5F1147068E4A296F6D7FB
SHA1:	7D36698C62386449A5FA2607886F4ADF7FB3DEEF
SHA-256:	87847204933551F69F1CBA7A73B63A252D12EF106C22ED9C561EF188DFFCBAE8
SHA-512:	A691EF121D3AC17569E27BB6DE4688D3506895B1A1A8740E1F16E80EEFCE70BA18B9C1EFD6FD6794FAFC59BA2CAF137B4007FCDC65DDB8BCBFCF42C97B13535B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........T...:...:...:.......:.e....:......:......:.....:....:....:...;.`.:......:.......:.......:.......:.Rich..:.................PE..L...oPjW...........!.........:......n.............Xm................................-.....@.........................@...\6..............................@.......\|8..................................Xh..@...............X...8........................text............................... ..`.rdata...;.......<..................@..@.data...............................@....rsrc...............................@..@.reloc..ZE.......F..................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\dt_shmem.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	25152
Entropy (8bit):	6.627329311560644
Encrypted:	false
SSDEEP:	384:0mgNWEfK0RiC4qxJL8VI6ZEPG5Vv/11nYPLr7N:H6WmK0RiSxJ4VI6W+zbC7N
MD5:	72B7054811A72D9D48C95845F93FCD2C
SHA1:	D25F68566E11B91C2A0989BCC64C6EF17395D775
SHA-256:	D4B63243D1787809020BA6E91564D17FFEA4762AF99201E241F4ECD20108D2E8
SHA-512:	C6A16DAAF856939615DFDE8E9DBE9D5BFC415507011E85E44C6BF88B17B705C35CD7CED8EDA8F358745063F41096938D128DEE17E14FE93252E5B046BDFCDDC0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%..cK.cK.cK....cK....cK.cJ.cK....cK....cK....cK....cK....cK....cK.Rich.cK.........PE..L...nPjW...........!................4.......@....\|m................................:6....@.........................0M.......H..<....p...............J..@............A...............................F..@............@...............................text....)......................... ..`.rdata.......@......................@..@.data........`.......@..............@....rsrc........p.......B..............@..@.reloc..z............F..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\dt_socket.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	21568
Entropy (8bit):	6.601333059222365
Encrypted:	false
SSDEEP:	384:QwiAYZIxsQbbRLEs5Ltd7rpPVJfq0nYPLr7Ko+:BiPZj+bVEmtd7rpdJfnC7J+
MD5:	73603BF0DC85CAA2F4C4A38B9806EC82
SHA1:	74EBC4F158936842840973F54AF50CDF46BC9096
SHA-256:	39EF85AB21F653993C8AAAB2A487E8909D6401A21F27CBA09283B46556FB16AF
SHA-512:	5C238D677D458D5B7D43FA3FF424E13B62ABFCEDE66D55E3112DC09BF2F7B640EB8F82D00E41A2C7A7E7B36E3FCE3C2DCB060037314418D329466CC462D0BF71
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x..<...<...<...'<8.>...'<:.>...'<..>...<...v...5.7.9...'<..1...'<?.=...'<>.=...'<9.=...Rich<...........................PE..L...nPjW...........!.................&.......0....}m................................F.....@..........................A..U....<..P....`...............<..@....p......@1..............................x;..@............0..(............................text............................... ..`.rdata.......0....... ..............@..@.data........P.......2..............@....rsrc........`.......4..............@..@.reloc.......p.......8..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\dtplugin\deployJava1.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	827456
Entropy (8bit):	6.022966185458799
Encrypted:	false
SSDEEP:	24576:E0NweWDjb28WNjE/lBy/pUbS3lYMpQIRrAOh3:7Wb5By/pUbouAQIRHh3
MD5:	E741028613B1FC49EC5A899BE6E3FC34
SHA1:	9EAE3D3CA22E92A925395A660B55CECB2EB62D54
SHA-256:	9163A546696E581D443B3A6250F61E5368BE984C69ADFB54EE2B0E51D0FA008E
SHA-512:	05C6CE707F4F0F415E74D32F1AACEC7E2C7746C3D04C75502EAECAFAF9E0108CE6206A8A3939C92EDCE449FFC0A68FB4389EDAA93D61920D1EC85327D1B3A55A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Vu.'...t...t...t..Tt...t.lIt...t.lYt...t...t...t}bat...t..`t...t..at{..t..Qt...t..Pt...t..Wt...tRich...t................PE..L...pPjW...........!................T.............`m.....................................@.........................................P..................@....p..\^.....................................@...............X...........................text...,........................... ..`.rdata..8...........................@..@.data....t.......R..................@....rsrc........P......................@..@.reloc..zr...p...t..................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\dtplugin\npdeployJava1.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	907328
Entropy (8bit):	6.160830535423145
Encrypted:	false
SSDEEP:	24576:ZyWOeRjqm9ZRI+Ga+fme7CV93+x6FQ3ge:VRAeMme7kA6F6ge
MD5:	4FD3548990CAF9771B688532DEF5DE48
SHA1:	567C27A4EA16775085D8E87A38FE58BEC4463F7D
SHA-256:	BDE5DF7BCFC35270B57A8982949BF5F25592A2E560A04E9868B84BEF83A0EA4B
SHA-512:	FD2CF2072A786293E30CD495BA06F4734F0CEA63CBC49B6D7A24F6891612375E48D1B5758D9408625E769E8A81C7C34F04278E011BCF47EDEB8C2AFC13AEC20C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............x...x...x....k..x...._..x....v..x....f..x...x...y....^..x....^..x....n..x....o..x....h..x..Rich.x..........................PE..L...nPjW...........!.................D.......0....mm................................t.....@..........................>......."..........................@........c...5..............................p...@............0..4............................text............................... ..`.rdata..T....0......................@..@.data...$Y...@...6...,..............@....rsrc................b..............@..@.reloc...g.......h...X..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\eula.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	109120
Entropy (8bit):	5.986571003903383
Encrypted:	false
SSDEEP:	1536:LE9WcstxlDgZ9EYDKg0nc6N3MR+EpOB+o+5PVT/B:ghspgZPDanhs+EpOBF+5PFB
MD5:	A5455B9BEB5672D89B1F0FCFAA4C79CA
SHA1:	9C7DBB5AD1CB3EBE7347A9CDDD80389902DA81EC
SHA-256:	89A429889DCD0F6A3FE56217A0FEB5912132AAB2817643021EAE3716DA533D4A
SHA-512:	131866A4754F4AF78A94F0776815E7EA4375736A4B11A723B87A4436FA101D271FFE14E4B49D3AB1AE2FA61CDBDED0C3D174C75327BE3C24E0E4CC39AFFA9469
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ot....Z...Z...Z..Z...ZC@.Z...Z..Z...Z..Z...Z.v.Z...Z.v.Z...Z...Z...Z.x.Z...Z..Z...Z..Z...Z..Z...Z..Z...ZRich...Z........................PE..L...oPjW...........!..............................~m......................................@.........................P...J............0...t..............@...........P...............................0...@............... ...d...`....................text............................... ..`.rdata...D.......F..................@..@.data...0...........................@....rsrc....t...0...v..................@..@.reloc...............\|..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\fontmanager.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	223296
Entropy (8bit):	6.501845596055873
Encrypted:	false
SSDEEP:	6144:8P8OC0xbNXLJAEh4hijzud6kAgZkFGMReiDfbgOBI1:8P8OC0xbNXLJAEh4hijzud6kAgYGSA
MD5:	9D5EDECF7E33DDD0E2A6A0D34FC12CA1
SHA1:	FC228A80FF85D78AA5BFBA2515EFED3257B9B009
SHA-256:	6D817519C2E2EFDD3986EB655C1F687D4774730AB20768DF1C0AAEF03B110965
SHA-512:	B4D58D3415D0255DCD87EF413762BC0F2934AAA6C8151344266949D3DD549ABDCA1366FA751A988CDDC1430EBF5D17668ADF02096DD4D5EAFE75604C0DA0B4C9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......wG.s3&. 3&. 3&. .h. 0&. (.. 6&. :^. ;&. (.. 4&. 3&. n&. (.4 n&. (.5 "&. (.. 2&. (.. 2&. (.. 2&. Rich3&. ........PE..L...oPjW...........!.........~.....................m.................................e....@......................... ;.......1.......`...............P..@....p......................................@...@............................................text............................... ..`.rdata...O.......P..................@..@.data........@.......,..............@....rsrc........`.......8..............@..@.reloc..L....p.......<..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\fxplugins.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	151104
Entropy (8bit):	6.548096027649263
Encrypted:	false
SSDEEP:	3072:PPuiQNBInyjJ2y53/5d8n9e/ry7zOAHpyWWJd1u2TeKSNlGFGZQfVN2:iBInu2y5P5dkeDy7zOUpLJ2mHZQf2
MD5:	7A710F90A74981C2F060FA361D094822
SHA1:	FBDCA4E3F19AD5201572974E3C772A3C2694FBB3
SHA-256:	9BC52058C02E0C87A6A9470C62D1AA4F998942CC00F99A82E7805E87D958BC16
SHA-512:	928708DFF6A372BA997C072238823469CBFD28CCBB17A723AD35F851D35C6EFF82748AA41A9215955B9536A14AA57D47ABE0F1BA00D11F8D920A57F91B7A35E5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................5......7.....................&.......8.......#.....5.........................4......3.....6.....Rich....................PE..L...oPjW...........!................g..............m.........................p............@.........................0...P............@...............6..@....P..........................................@...............4............................text............................... ..`.rdata...g.......h..................@..@.data........0......................@....rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\glass.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	200768
Entropy (8bit):	6.431501859060678
Encrypted:	false
SSDEEP:	3072:lC0MaRHVsSduCCkNlKpR1FHNnuNcCwJPT54l2B3Fzkmldrz5ZD9hYJOj9T3iRK:s0XR1sYtxgGl2B3uWjhYJOj9TSY
MD5:	434CBB561D7F326BBEFFA2271ECC1446
SHA1:	3D9639F6DA2BC8AC5A536C150474B659D0177207
SHA-256:	1EDD9022C10C27BBBA2AD843310458EDAEAD37A9767C6FC8FDDAAF1ADFCBC143
SHA-512:	9E37B985ECF0B2FEF262F183C1CD26D437C8C7BE97AA4EC4CD8C75C044336CC69A56A4614EA6D33DC252FE0DA8E1BBADC193FF61B87BE5DCE6610525F321B6DC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............g_..g_..g_..._..g_..._..g_..._..g_..._..g_aT._..g_aT._..g_aT._..g_..f_..g_..._..g_.._..g_.._..g_..._..g_.._..g_Rich..g_........................PE..L...oPjW...........!...............................m.........................0............@..........................l..................X&..............@........(......................................@...............<....^.......................text...\........................... ..`.rdata..............................@..@.data...\"..........................@....rsrc...X&.......(..................@..@.reloc...(.......*..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\glib-lite.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	400960
Entropy (8bit):	6.165546757090391
Encrypted:	false
SSDEEP:	6144:vxDvEpBGH7t7PB7Es7va/QdqOBYswIprNWhk+URpxfu4w7J:tvEpBGH7pN57vwQd6swIp5WhkRlfu4CJ
MD5:	767BBA46789597B120D01E48A685811E
SHA1:	D2052953DDE6002D590D0D89C2A052195364410A
SHA-256:	218D349986E2A0CD4A76F665434F455A8D452F1B27EAF9D01A120CB35DA13694
SHA-512:	86F7F7E87514DBC62C284083D66D5F250A24FC5CD7540AF573C3FB9D47B802BE5FFBBC709B638F8E066AB6E4BB396320F6E65A8016415366799C74772398B530
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......j..'..{t..{t..{t.g.t).{t#..t-.{t#..t".{t#..t".{t#..t,.{tS..ty.{t.8.t".{t..zt..{tS..t/.{t#..t/.{tS..t/.{tRich..{t................PE..L...oPjW...........!.....V...........=.......p.....m.........................P............@.............................^...............................@.... ..h'......................................@............p...............................text....T.......V.................. ..`.rdata...j...p...l...Z..............@..@.data.... ..........................@....rsrc...............................@..@.reloc..h'... ...(..................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\gstreamer-lite.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	514112
Entropy (8bit):	6.805344203686025
Encrypted:	false
SSDEEP:	12288:Y5JbfdT5NYGe8m51QSWvopH1kdMDbA2ZoNnYX:Y5JV7eB3KopvnAe2YX
MD5:	8D0CE7151635322F1FE71A8CEA22A7D6
SHA1:	81E526D3BD968A57AF430ABB5F55A5C55166E579
SHA-256:	43C2AC74004F307117D80EE44D6D94DB2205C802AE6F57764810DEE17CFC914D
SHA-512:	3C78C0249B06A798106FEAF796AA61D3A849F379BD438BF0BB7BFED0DC9B7E7EA7DE689BC3874ED8B97FF2B3BA40265DED251896E03643B696EFDBF2E01AC88C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Es.J$..J$..J$....N$..Gv..I$..Gv.G$..Gv..G$..Gv..H$..7]..%$.....B$..7]..H$..J$...%..7]..K$..Gv.K$..7].K$..RichJ$..........PE..L...pPjW...........!................g..............m......................................@..........................F.......I..........................@.......lT...................................E..@............................................text............................... ..`.rdata..............................@..@.data....0...`..."...D..............@....rsrc................f..............@..@.reloc..lT.......V...j..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\hprof.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	132672
Entropy (8bit):	6.708436670828807
Encrypted:	false
SSDEEP:	3072:HGBc2vf2AWlvx+Kre9vVv3CoLORljxWEXyB/NK3GyNf9:mxvffVvyo0X8NKW+1
MD5:	6376B76728E4A873B2BB7233CBCD5659
SHA1:	3BE08074527D5B5BC4A1DDCEC41375E3B3A8A615
SHA-256:	4FDF86D78ABC66B44B8AFF4BBCE1F2A5D6D9900767BE3CAAE450409924DBC5AD
SHA-512:	955E7C5AB735183B491A753710B6F598A142A2876DDAE5AD301C3DA82A65CE82238E0F20C9F558F80138D58F8DC00B4EBD21483CEED0AABEEDA32CCA5D2E3D48
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........vu^............8Y...............................o..............................................Rich............................PE..L...oPjW...........!.....z...x......_..............m......................... ......^.....@.............................i...\|...d.......................@........................................... ...@...............d............................text...Ny.......z.................. ..`.rdata...N.......P...~..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\instrument.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	115776
Entropy (8bit):	6.787384437276838
Encrypted:	false
SSDEEP:	1536:0LHPDcdivqC4xMfl/hAxfZ/t0QHQIM7iVxoQCpGlyir0wIOfnToIfemrVZQirM:0rPDco4xMNEfZ1LQG4igmvTBfem7QcM
MD5:	AB6ED0CFD0C52DBEDE1BE910EFA8A89B
SHA1:	83CBC2746A50C155261407ECE3D7A5C58AAD0437
SHA-256:	8A6FBB08E0F418A3BB80CC65233E7270C820741DD57525ED7FD3CC479A49396E
SHA-512:	41773183FC20E42BF208064163AA55658692B9221560146E4F6A676F96FC76541ED82F1EFDFA31F8C25BA42F271F7D9087DE681DA937BBF0EB2C781E027F1218
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........g0...c...c...c..c...c...c...cP..c...c.\|.c...c.\|.c...c.\|.c...c.\|.c...c.\|.c...c.\|.c...cRich...c........PE..L...oPjW...........!........................0.....m......................................@.........................@.......\|...(.......................@...........p1.............................. ...@............0..0............................text...L........................... ..`.rdata...f...0...h..................@..@.data....,..........................@....rsrc...............................@..@.reloc..Z...........................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\j2pcsc.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	16448
Entropy (8bit):	6.490137326885244
Encrypted:	false
SSDEEP:	384:WCMJqfiSZzDonPV5TyVIbb8nYPLr7VblXT:WLJqrNkndQIsC7Vhj
MD5:	1F004C428E01F8BEB07B52EB9659A661
SHA1:	4D6AAB306CB1F4925890BF69FCDF32BBFE942B81
SHA-256:	1BDEFECDF8CFA3F6DA606AD4D8BD98EC81E4A244D459A141723CCB9DC47E57CB
SHA-512:	61888A778394950D2840E4D211196FFE1CB18FA45D092CBADBEDF2809BDED3D4421330CFE95392DD098E4AE3F6F8A3070E273FFCA2FB495C43C76332CA331DBF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3...w.x^w.x^w.x^...^v.x^l..^u.x^l..^u.x^l..^u.x^~..^r.x^w.y^[.x^l..^y.x^l..^v.x^l..^v.x^l..^v.x^Richw.x^........PE..L...oPjW...........!.........................0.....m.........................p.......!....@..........................7.......2..P....P...............(..@....`..`....0..............................`1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@....... ..............@....rsrc........P......."..............@..@.reloc.......`.......&..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\j2pkcs11.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	51264
Entropy (8bit):	6.576803205025954
Encrypted:	false
SSDEEP:	1536:urOHh9t7/GAzqHcGxAARrZT9ixHDyo/r0rV9LrBH1bjPEwhEdheBwHWQFgE/XudL:G+9t7/qHcGHuy/pb
MD5:	3A744B78C57CFADC772C6DE406B6B31E
SHA1:	A89BF280453C0BCF8C987B351C168AEB3D7F7141
SHA-256:	629393079539B1B9849704CE4757714D1CBE5C80E82C6BB3BC4445F4854EFA7B
SHA-512:	506A147F33C09FA7338E0560F850E42139D0875EF48C297DDB3CC3A29F12822011915FACCB21DA908CF51A462F0EBA56B6B37C71D9C0F842BDE4A697FB4FFB64
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O^;w.?U$.?U$.?U$.G.$.?U$...$.?U$.?T$&?U$...$.?U$...$.?U$...$.?U$...$.?U$...$.?U$...$.?U$Rich.?U$........................PE..L...oPjW...........!.....v...8......l..............m................................O1....@.............................u...\|...<.......................@.......................................... ...@............................................text...~t.......v.................. ..`.rdata...'.......(...z..............@..@.data...............................@....rsrc...............................@..@.reloc..V...........................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jaas_nt.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19520
Entropy (8bit):	6.452867740862137
Encrypted:	false
SSDEEP:	384:45kF/QP8xkI6hgWIE0PVlyJSZ9nYPLr7+:4SqP7I6rkd4EfC7+
MD5:	503275E515E3F2770A62D11E386EADBF
SHA1:	C7BE65796AA0E490779F202C67EEC5E9FBB65113
SHA-256:	97B5D1C8E7AAACE5C86A418CB7418D3B0BA4F5E178DE3CF1031029F7F36832AF
SHA-512:	AC7C0CB626C2D821F0F4E392EE4E02C9E0093F019AA5B2947E0C7B3290A0098A3D9BB803AB44FD304CA1F1D272CFB7B775E3C75C72C7523FF7240F38440CFC3C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."..\|fl./fl./fl./}.(/dl./}./gl./}../dl./o.'/al./fl./_l./}../kl./}.//gl./}../gl./}.)/gl./Richfl./................PE..L...pPjW...........!.........................0.....m.........................p............@..........................=.......8..d....P...............4..@....`..\....1...............................6..@............0...............................text............................... ..`.rdata..w....0......................@..@.data...`....@.....................@....rsrc........P.......,..............@..@.reloc.......`.......0..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jabswitch.exe

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	30784
Entropy (8bit):	6.413942547146628
Encrypted:	false
SSDEEP:	768:+HhfWinfwUFAvnb5TIUX+naSOu9MQQ5jhC7EY:cuin5FAvNTIUX+nbMQQ54EY
MD5:	530D5597E565654D378F3C87654CCABA
SHA1:	6FAC0866EE0E68149AC0A0D39097CEF8F93A5D9E
SHA-256:	0CFAA99AE669DDC00BD59B5857F725DFF5D4C09834E143AB1B5C5F0B5801D13B
SHA-512:	D7520A28C3054160FCD62C9D816A27266BE9333E00794434FB4529F0FF49A2B08E033B5E67A823E5C184EE2D19D7F615FF9EE643FE71C84011A7E5C03251F3B4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............I...I...I..HI...I..JI...I..~I...I..GI...I...I..I...I...I..NI...I..II...IRich...I........PE..L....DjW.................0...,.......1.......@....@..................................<....@.................................dR..x....p...............`..@.......t....A...............................P..@............@..p............................text............0.................. ..`.rdata.......@.......4..............@..@.data........`.......N..............@....rsrc........p.......P..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\java-rmi.exe

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15936
Entropy (8bit):	6.466457942735197
Encrypted:	false
SSDEEP:	384:GpsbHnDiW6gejmSHhV8cGees7snYPLr7Wj53:GpsbHn/HS/8cresgC743
MD5:	CF2F023D2B5F0BFB2ECF8AEEA7C51481
SHA1:	6EB867B1AC656A0FC363DFAE4E2D582606D100FB
SHA-256:	355366D0C7D7406E2319C90DF2080C0FAE72D9D54E4563C48A09F55CA68D6B0C
SHA-512:	A2041925039238235ADC5FE8A9B818DFF577C6EA3C55A0DE08DA3DEDD8CD50DC240432BA1A0AEA5E8830DCDCCD3BFBF9CF8A4F21E9B56DC839E074E156FC008D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R%^.<v^.<v^.<vW..v\.<vEx.v_.<vEx.v\.<vEx.v[.<v^.=vo.<vEx.vJ.<vEx.v_.<vEx.v_.<vRich^.<v........PE..L....DjW..................................... ....@..........................`......B.....@..................................#..P....@..\............&..@....P....... ...............................!..@............ ...............................text............................... ..`.rdata..z.... ......................@..@.data........0......................@....rsrc...\....@......................@..@.reloc.......P.......$..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\java.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	126528
Entropy (8bit):	6.8082748642937725
Encrypted:	false
SSDEEP:	3072:Kw2b3Kr+uWU9XzFhziJ1TBZAhsIn/B9NZwMgjeNXLD:43KFFheLCBpV/
MD5:	73BD0B62B158C5A8D0CE92064600620D
SHA1:	63C74250C17F75FE6356B649C484AD5936C3E871
SHA-256:	E7B870DEB08BC864FA7FD4DEC67CEF15896FE802FAFB3009E1B7724625D7DA30
SHA-512:	EBA1CF977365446B35740471882C5209773A313DE653404A8D603245417D32A4E9F23E3B6CD85721143D2F9A0E46ED330C3D8BA8C24AEE390D137F9B5CD68D8F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........!..r..r..r.W.r..r.W(r..r...r..r..(r..r...r..r.W.r..r..r..r.W)r..r.W.r..r.W.r..r.W.r..rRich..r................PE..L...qPjW...........!..... ...........(.......0.....m................................6N....@......................... u...B...U..........................@............5...............................S..@............0......<U..@....................text...b........ .................. ..`.rdata.......0.......$..............@..@.data...............................@....rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\java.exe

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	191040
Entropy (8bit):	6.75061028420578
Encrypted:	false
SSDEEP:	3072:iUJiEoGLsncZizZQ7QBdCPdG3TBfMzrjZqMNGSplN2:iUJsnVzy7QBdC1G3TBEvFp6
MD5:	E3E51A21B00CDDE757E4247257AA7891
SHA1:	7F9E30153F1DF738179FFF084FCDBC4DAE697D18
SHA-256:	7E92648B919932C0FBFE56E9645D785D9E18F4A608DF06E7C0E84F7CB7401B54
SHA-512:	FC2981A1C4B2A1A3E7B28F7BF2BE44B0B6435FD43F085120946778F5C2C2CA73AD179796DEC0B92F0C6C8F6B63DD329EECC0AF1BB15392364C209DCF9CD6F7CA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........+H..E...E...E.L.....E..E....E..E....E......E...D...E..E..{.E..E....E..E....E.Rich..E.........PE..L....DjW.....................&....................@..........................0......aN....@.................................L*..d.......................@............................................$..@............................................text...~........................... ..`.rdata...s.......t..................@..@.data....4...@....... ..............@....rsrc................6..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\java_crw_demo.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	23616
Entropy (8bit):	6.620094371728742
Encrypted:	false
SSDEEP:	384:Qp2dG5pC/ujTc8ZrEnrZm8WXLFnPV52WZQAnYPLr7lOGa:uvCGjJ0Q9ndRZdC71a
MD5:	1C47DD47EBD106C9E2279C7FCB576833
SHA1:	3BA9B89D9B265D8CEC6B5D6F80F7A28D2030A2D1
SHA-256:	58914AD5737F2DD3D50418A89ABBB7B30A0BD8C340A1975197EEA02B9E4F25B2
SHA-512:	091F50B2E621ED80BAFE2541421906DE1BCC35A0E912055B93E40CD903BE8B474103C0D8FECDF46E7F2F3C44BDADE64A857AB2B9CB5404306055150EE4ED002A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2..v...v...v.....+.t...m'$.u...v...\...m'&.w...m'..t...m'..{...m'#.w...m'".w...m'%.w...Richv...................PE..L...wPjW...........!................4.......@.....m................................F.....@..........................I..\|....E..<....`...............D..@....p.......@...............................D..@............@...............................text....)......................... ..`.rdata.......@......................@..@.data...(....P.......:..............@....rsrc........`.......<..............@..@.reloc..^....p.......@..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javacpl.cpl

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	160256
Entropy (8bit):	6.469497559123052
Encrypted:	false
SSDEEP:	3072:a2lpElIhbyyH3c1CX766zKELxKvFaPSnjZqMNJlGle:a2rE+xdW+76DEVKv8wv
MD5:	4E3C37A4DE0B5572D69AD79B7A388687
SHA1:	6B274E166641F9CE0170E99FE2D1F4319B75A9E8
SHA-256:	893A86E7B1DE81DEDAB4794732FCCD02790756A2DBE4815C102F039088DFCBD2
SHA-512:	8352A1CD859D17A27560448C6FFB0E8200096CAC744C8BB56330397FDE0B7F702E2295999D89FBAD74DF72DF200C391113A23A9B4342ABAC738167967533F9CD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d6.. We. We. We.;...9We.;...We.)/..)We. Wd..We.O!.(We.;...We.;...!We.;...!We.;...!We.Rich We.........................PE..L....HjW...........!.....r...........q....................................................@.............................Z.......d.... ..............................@...................................@............................................text....p.......r.................. ..`.rdata..jH.......J...v..............@..@.data...,3..........................@....rsrc........ ......................@..@.reloc..@............T..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javacpl.exe

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	70208
Entropy (8bit):	6.353501201479367
Encrypted:	false
SSDEEP:	768:jFVfr2k521ZnrawwMmqPXt+rP3b/9/YMCxx0OpPOrEE14EVHLAuDeGJiqrmehiV9:PxioMmqF+2x0MORLVq7qjh3rmKPNpwGg
MD5:	C2A59C7343D370BC57765896490331E5
SHA1:	A50AF979E08A65EB370763A7F70CDB0E179D705D
SHA-256:	40614FE8B91E01AD3562102E440BDBF5FAC5D9F7292C6B16A58F723BFFFE6066
SHA-512:	CA266F1B2E51F66D119E2D71E3377C229A3D583853FFB606C101AFEB41689ACE7D1F1594781091DA67F9BE9D09F3019BF048C0F819777E8F1827A56BEEC252C4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._...1...1...1..9....1.j...1..9....1..9...1.....1...0.q.1.....1..9....1..9....1..9....1.Rich..1.................PE..L....HjW.................B...........B.......`....@..........................@......5C....@..................................}..x.......................@....0.......b...............................u..@............`......@{.......................text...,@.......B.................. ..`.rdata..x'...`...(...F..............@..@.data................n..............@....rsrc................p..............@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javafx_font.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	57408
Entropy (8bit):	6.6711491011490285
Encrypted:	false
SSDEEP:	1536:f6arRmcnq2lxm+Na6C7HIT6T8E2pLSSm3:fzm+q7HITS8E2pLSSA
MD5:	AEADA06201BB8F5416D5F934AAA29C87
SHA1:	35BB59FEBE946FB869E5DA6500AB3C32985D3930
SHA-256:	F8F0B1E283FD94BD87ABCA162E41AFB36DA219386B87B0F6A7E880E99073BDA3
SHA-512:	89BAD9D1115D030B98E49469275872FFF52D8E394FE3F240282696CF31BCCF0B87FF5A0E9A697A05BEFCFE9B24772D65ED73C5DBD168EED111700CAAD5808A78
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................I2.......(.......*.....................\.:.....\.>...............................)...............+.....Rich............PE..L...tPjW...........!.....r...V.......w.............m......................................@.........................@...x...............................@.......8.......................................@...............4............................text....p.......r.................. ..`.rdata...@.......B...v..............@..@.data...............................@....rsrc...............................@..@.reloc..8...........................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javafx_font_t2k.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446528
Entropy (8bit):	6.603555069382601
Encrypted:	false
SSDEEP:	12288:RreTVhY4gXwLR4YS+OX3kQg4O5kM2LY58gwDTxXvwGSelo:Rr4VhyK7eTxXvwelo
MD5:	8AE40822B18B10494527CA3842F821D9
SHA1:	202DFFA7541AD0FAD4F0D30CEE8C13591DCA5271
SHA-256:	C9742396B80A2241CE5309C388B80000D0786A3CAB06A37990B7690FD0703634
SHA-512:	AA324A265639C67843B4BF6828029B413044CBE4D7F06A253B78B060EA554FECC6E803D59D03742C485B2EB3D52E5C0A44928DCC927501F413EE4664BB8A11F5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........f.4Z..gZ..gZ..g.}g^..gWUggX..gWUeg\..gWUZgW..gWU[g_..g..qg]..gZ..g...g'~Zg~..g'~[g...g'~fg[..gWUag[..g'~dg[..gRichZ..g........PE..L...uPjW...........!..............................m......................................@.........................@..........d.......................@........%...................................\..@...............,............................text...{........................... ..`.rdata..............................@..@.data...............................@....rsrc...............................@..@.reloc...%.......&..................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javafx_iio.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	126016
Entropy (8bit):	6.608910794554507
Encrypted:	false
SSDEEP:	3072:oOxjjADzd+aeaPB9JhjxkM2wzGdXJbD/jn8Y6:ocKzeaPB9JhjxknwzG5JbDb8F
MD5:	01706B7997730EAA9E2C3989A1847CA6
SHA1:	7CEAD73CBE94E824FA5E44429B27069384BFDB41
SHA-256:	20533C66C63DA6C2D4B66B315FFCF5C93AE5416E3DAE68CDD2047EFE7958AB3A
SHA-512:	3272C8DE6C32D53372D481441DA81AE2B6EA02E8360B23D7F793B24827BD683A6604F43BE18CE2BEE40038FBE7D5F7AF78B2C465A51F82478D881DBEB5744DC2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........y.r..r..r.O...r..r..r.. ..r.. ..r.. 0.r.. 1.r...0.r.....r.. ..r.....r.Rich.r.........PE..L...vPjW...........!.........:.....................m................................c.....@.....................................<.......................@.......\...................................0...@............................................text... ........................... ..`.rdata..8(.......*..................@..@.data...............................@....rsrc...............................@..@.reloc..\...........................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	191552
Entropy (8bit):	6.744419946343284
Encrypted:	false
SSDEEP:	3072:lScg0xvhTZNIs3Ft+STckCBQo3C0Y22vncTBfsO9jZqMN3cH1Tefqk:lSclI6nTc3BQo3C0YHncTBxvs65
MD5:	48C96771106DBDD5D42BBA3772E4B414
SHA1:	E84749B99EB491E40A62ED2E92E4D7A790D09273
SHA-256:	A96D26428942065411B1B32811AFD4C5557C21F1D9430F3696AA2BA4C4AC5F22
SHA-512:	9F891C787EB8CEED30A4E16D8E54208FA9B19F72EEEC55B9F12D30DC8B63E5A798A16B1CCC8CEA3E986191822C4D37AEDB556E534D2EB24E4A02259555D56A2C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........v...%...%...%..w%...%.7D%...%.7q%...%..\|%...%...%...%.7E%..%.7u%...%.7r%...%Rich...%........................PE..L....DjW.....................(...................@..........................0............@.................................\..d.......................@............................................$..@............................................text............................... ..`.rdata...t.......v..................@..@.data....4...@......."..............@....rsrc................8..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaws.exe

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	269888
Entropy (8bit):	6.418120581797452
Encrypted:	false
SSDEEP:	6144:Fp9B0qT85g5Sq+VBY2qVLC2wH5rM8HoQvlHO:5uqT85sSq+ERVm2wZEQvlHO
MD5:	F8211DB97BF852C3292C3E9C710C19D9
SHA1:	46DAD07779E030D8D1214AFE11C4526D9F084051
SHA-256:	ECF4307739CA93F1569CE49377A28B31FE1EB0F44B6950DBAAFA1925B24C9752
SHA-512:	B3E20EECA87136CAE77F06E4149E65EBFEF71A43589F7E2833008FE43811A2BC8B6202B6ADB5CE122A1822E83CE226B833DEF93A2B161476BD5B623794E4F697
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......a..L%...%...%...>c..8...J.4.-...,.......%.......>c5.....>c4.....>c..$...>c..$...Rich%...................PE..L...rGjW.................t...........C............@..................................a....@.................................L...x.......................@.......8................................... ...@...............h...T........................text....r.......t.................. ..`.rdata...c.......d...x..............@..@.data...8........z..................@....rsrc................V..............@..@.reloc..>-..........................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jawt.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13888
Entropy (8bit):	6.274978807671468
Encrypted:	false
SSDEEP:	192:ahKnvndLwm3XLPVlD6yTUZnYe+PjPriT0fwdNJLkoRz:a4j7PVl1TAnYPLr7cLka
MD5:	0291BA5765EE11F36C0040B1F6E821FB
SHA1:	FFE1DCF575CCD0374DF005E9B01D89F6D7095833
SHA-256:	F8540BE2BBD5BDE7962D2FE4E7EC9EF9BF53D95B48781AE549AA792F10032485
SHA-512:	72ADDC631D8CF064E1B047B51EEF7F306CA959D24ED705065C33EE8DDDF7EA84B95B3DE5B0709015A81D36ACA01E15CE99A354D4069D4D798ED128A6A76D1010
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X"._9LR_9LR_9LRD..R^9LRD..RS9LRD..RZ9LRVA.R]9LR_9MR\|9LRD..R\9LRD..R^9LRD..R^9LRD..R^9LRRich_9LR........PE..L...xPjW...........!......................... .....m.........................`............@..........................&..J...\"..P....@..................@....P..@.... ...............................!..@............ ...............................text............................... ..`.rdata..Z.... ......................@..@.data...`....0......................@....rsrc........@......................@..@.reloc..t....P......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jdwp.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	163904
Entropy (8bit):	6.783788147675078
Encrypted:	false
SSDEEP:	3072:XrQPwE5tlGsXVomHvD+1febSICzqozXtrQwnNZkB+5:XU15tpX9HvsfrTtMwNWBY
MD5:	6E08D65F5CBB85E51010F36A84FC181D
SHA1:	4EEE8BE68BAAF6320AEA29131A1C0B322F09F087
SHA-256:	2D8658909D9E357A4B70FCF862D690EEC82A2F77161ABB021E0839C6A67D4825
SHA-512:	DF4494D062E9A8AC82D727D2722DCF32C3FC924FA104F384FA099ADB08ECBDEEA7A19245D779097C0AFCF51F84852328ED595C88380F42BD39560678C8AD9621
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#..cp..cp..cp...p..cp...p..cp.D.p..cp..bp..cp.D.p..cp.D.p..cp.D.p..cp.D.p..cp.D.p..cp.D.p..cpRich..cp........................PE..L...{PjW...........!...............................m......................................@......................... ?..h...\|9..<....P...............h..@....`...)..@...............................(8..@...............,............................text............................... ..`.rdata..._.......`..................@..@.data...0....@.......4..............@....rsrc........P.......8..............@..@.reloc...+...`...,...<..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jfr.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22592
Entropy (8bit):	6.620820751411794
Encrypted:	false
SSDEEP:	384:YL4Z7lZRiY3PB6cGgOp2m1zq2oatSnPV5zYxkpLfsnYPLr7Ybc:E4PZRiY3PB6cVAebaMnd+ypLkC7Cc
MD5:	700F5789D2E7B14B2F5DE9FDB755762E
SHA1:	F35EDE3441D6E5461F507B65B78664A6C425E9AC
SHA-256:	D115EAF96BD41C7A46400DCFF7EF26AC99E3CF7A55A354855C86BAE5C69A895A
SHA-512:	664A442DD424CA04AC0CE072B9BBD5EF7C657B59A26403C44A856738F7998466BFE3010825A13451281841D39B0A34D8997EE24497D626EC60C19AA1AF0EE465
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6...W..W..W../j.W...e.W..W..W....a.W...g.W...R.W...S.W...b.W...c.W...d.W..Rich.W..........PE..L...\|PjW...........!........."......T&.......0.....m.................................O....@.........................`>.......:..<....`...............@..@....p.. ....0...............................9..@............0...............................text...^........................... ..`.rdata..p....0....... ..............@..@.data........P.......6..............@....rsrc........`.......8..............@..@.reloc.......p.......<..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jfxmedia.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	115264
Entropy (8bit):	6.588792190592223
Encrypted:	false
SSDEEP:	3072:2Cgsy+/cydqNiaZr+lOzZPh7/W4MCnc8Ioaa2yFWcC6vsx/8:FZOzZPh7/WSe+S6v+U
MD5:	8BC8FE64128F6D79863BC059D9CC0E2E
SHA1:	C1F2018F656D5500ACF8FA5C970E51A55004DA2E
SHA-256:	B77CD78FF90361E7F654983856EE9697FDC68A0F9081C06207B691B0C9AF1F5D
SHA-512:	6771F23ECF1A449EB6B0B394E0F1D3EB17C973FC0544BA25487C92F215ACC234FC31C9B7BE5528EFD06D29A35BB37DD7934318837576862ADFC2631B4D610A24
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............l..l..l..>7..l..>...l..>5..l..>...l...#..l..5..l..l.zl.....l.....l..4..l..>3..l..6..l.Rich.l.........PE..L...}PjW...........!.........\|......],.......@.....m................................~.....@.....................................x.......................@............................................h..@............@...............................text....-.......................... ..`.rdata..4Z...@...\...2..............@..@.data...4...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jfxwebkit.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	33934912
Entropy (8bit):	6.35314231534845
Encrypted:	false
SSDEEP:	393216:VJ8d7SMzwH5R2sdDcBwHHdI4DKRlDsqXCagQZhzvilh2Wlq7ODI:VJ8d7zzUesdDtevn
MD5:	4D857A5FC9CA16D2A67872FACCF85D9F
SHA1:	EAEB632E526EFA946E4DB1B8CFA31DE6A7B03219
SHA-256:	7FFA7423DDA07499394B345E5ECE2D54C8E19247E6E76C0E23B5BF1470AB0D7F
SHA-512:	8DBC8675CE2DACE8D629C3FA66CF65704346AB829AE0B0A1D7B25BE22783B7E73624BA70F6D67264D6CA1656D7590E3753A8DF2227DA45112C5BD4A5654089AF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........O..z!..z!..z!.c...z!..(...z!..(...z!......z!..z!..z!..(..hz!..(...z!......z!. ...z!..z ..{!......p!......z!..(...z!......z!.Rich.z!.................PE..L...~PjW...........!......... $....................m......................................@.................................X...x.......@...............@..............................................@............................................text.............................. ..`.rdata...E.......F..................@..@.data..............................@....unwante............................@..@.rsrc...@...........................@..@.reloc.............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jjs.exe

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15936
Entropy (8bit):	6.475020301731584
Encrypted:	false
SSDEEP:	384:GpsE5cnm6ObmSHhV8j0eeq4SziahnYPLr79OOu:Gpszn6iS/8jxeqfhC78Ou
MD5:	4F11D43AA2215CE771DA528878F01C8E
SHA1:	8062681D73489FF200CA0BA426FF1FF3F44494A7
SHA-256:	0D554CD4B373D6D9B9C179A468D179388706C0BDE4D878ED75EF575651588B3C
SHA-512:	34CB271C32FB479CFAEEC536A5D35A41730E90001D67DC9DB595DB240A1F58C3BF12334BB5CDE7673C8E56A4C272BFBD66E4EACDEE0082F6FD583E4E039EC540
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R%^.<v^.<v^.<vW..v\.<vEx.v_.<vEx.v\.<vEx.v[.<v^.=vo.<vEx.vJ.<vEx.v_.<vEx.v_.<vRich^.<v........PE..L....DjW............................\|........ ....@..........................`.......C....@.................................$#..P....@..@............&..@....P....... ...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...@....@......................@..@.reloc.......P.......$..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jli.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	158784
Entropy (8bit):	6.816453355323999
Encrypted:	false
SSDEEP:	3072:gLkNbBRaz4rQWiG6wMz9/S3en9pHUw06TBfkqI44:rNbB4Mcnv7z6en9pj06TB6
MD5:	73A76EC257BD5574D9DB43DF2A3BB27F
SHA1:	2C9248EAE2F9F5F610F6A1DFD799B0598DA00368
SHA-256:	8F19B1BA9295F87E701C46CB888222BB7E79C6EE74B09237D3313E174AE0154F
SHA-512:	59ECD5FCF35745BDADCDB94456CB51BB7EA305647C164FE73D42E87F226528D1A53CE732F5EC64CE5B4581FA8A17CFBFDC8173E103AE862D6E92EB3AD3638518
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................6...........0.....=............7....5.....4.....3....Rich............PE..L....PjW...........!...............................o................................Y.....@..........................3..m....*..d....................T..@............................................#..@............................................text...~........................... ..`.rdata...u.......v..................@..@.data....4...@......."..............@....rsrc................6..............@..@.reloc.."............:..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jp2iexp.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	207424
Entropy (8bit):	6.630800216665857
Encrypted:	false
SSDEEP:	6144:ckZ5ktGCru8e6Y3RhNw0mjs+OBS7n7ACKRAHbW:ciIbS6Y37Nw0/QC
MD5:	475DD87198F9C48EFB08AAB4ADE8AF5A
SHA1:	9B657E0837639663D4D721F8C5E25401F11E7BEB
SHA-256:	32764005FCCE7D0E51801528F6B68C860979E08D027A5220DFEC19B2A8013354
SHA-512:	0B492B0FBADC14178A6F79A58E47C30D92B59B18414E38A7B119699D0788ACF3713F925CF0EC570BE3E29AB26BDB6B567C38526BC0603BA78ECC3E2952EA3E2B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........D......................;.....................+..............................................Rich...........................PE..L....PjW...........!.........>.....................o.........................P............@.............................................................@......../...................................C..@...............\|...........................text.../........................... ..`.rdata..............................@..@.data....,.......&..................@....rsrc...............................@..@.reloc...6.......8..................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jp2launcher.exe

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	82496
Entropy (8bit):	6.597347722250847
Encrypted:	false
SSDEEP:	1536:ez2dfBusTTkMffX+xR5kdt94u+508AqDfJOqsbCkq24maADX:kE5u+kkX+P+dt9O08JJOZXX4nADX
MD5:	5F85F7F2DFAC397D642834B61809240F
SHA1:	ECA28E8464208FA11EF7DF677B741CDD561483D9
SHA-256:	B71E00ADB77D87882D58993A5888955BDD62C57D364F60AAA0FA19D32A69C9DA
SHA-512:	2BFE9FCE450E57EA93DEEAA85A746CB17BA946EEFF866F10D67C74F7EA038B16910E0D8EF29E9F358AF7DAABD45E3983C370FEF82A9647546819DCDE3AEE45BC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-..C..C..C.....C..3..C.v...C..3..C..B.X.C.....C..3..C..3...C..3..C..3..C.Rich.C.........PE..L....HjW............................1.............@.................................cE....@.................................\...x....`..H............*..@....p..h.......................................@............................................text............................... ..`.rdata...C.......D..................@..@.data....0... ......................@....rsrc...H....`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jp2native.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19008
Entropy (8bit):	6.372096409611824
Encrypted:	false
SSDEEP:	384:PTjlu57T5J5eFeYW7TPVlN3B+ASZQ4NNR7F3qnYPLr7om0:PnUd5eFeDfd5Sj7oC7om0
MD5:	4023E25F92B5F13E792901BF112A8EA2
SHA1:	31ADCD411905832B89EA55DEC8B9C83AF3C7D3EA
SHA-256:	432AEDAC59FA161FED5A5D95CA5F8CFD1D73A35ABE8A7090D137100F727B687B
SHA-512:	AD0E6F8071EB09E843989E637BACA988DD7706D84FC26DB7C2E18BBE03A78A6C5BFE4F1B28289B5929B2B86C53FB6C3DAE42523DC8EDE8057A8F431AEA77BB20
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~fQ.~fQ.~fQ...Q.~fQ...Q.~fQ...Q.~fQ...Q.~fQ.~gQ.~fQ...Q.~fQ...Q.~fQ...Q.~fQ...Q.~fQ...Q.~fQRich.~fQ................PE..L....PjW...........!.........................0.....o.........................p.......8....@..........................8......43..P....P...............2..@....`.......1..............................P1..@............0.......2..@....................text............................... ..`.rdata..T....0......................@..@.data........@.......&..............@....rsrc........P.......*..............@..@.reloc..J....`......................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jp2ssv.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	186944
Entropy (8bit):	6.612459610032652
Encrypted:	false
SSDEEP:	3072:XsSFQQB7SGWV2xrkvql6QPJD7mGVqjLypDTaDE5zwmFxy7HglbZrdIG:XJ97PxYAPJ/RV0tDCzw+xy0ldOG
MD5:	E9373908186D0DA1F9EAD4D1FDAD474B
SHA1:	C835A6B2E833A0743B1E8F6F947CFE5625FE791F
SHA-256:	E2FBD6C6334D4765FF8DFF5C5FE3DF8B50015D0BF9124142748FADB987B492FF
SHA-512:	BFDC236D462DAC45FD63C112E40558ED4E11E76FB4D713926A679FD573F67FA16451231A03178926B76BD267F092A33A3B6760CF4812DE2679BB9505B83F8261
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B.+.#.x.#.x.#.x.mGx.#.x..Ax.#.x..ux3#.x.[Lx.#.x.[\x.#.x.#.x #.x.Utx.#.x..tx.#.x..Dx.#.x..Ex.#.x..Bx.#.xRich.#.x................PE..L....PjW...........!................K........ .....o................................,j....@................................. ...d.......................@............"...............................f..@............ ..P...L\|.......................text...\........................... ..`.rdata...m... ...n..................@..@.data....5...........z..............@....rsrc...............................@..@.reloc...%.......&..................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jpeg.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	145984
Entropy (8bit):	6.69725055196282
Encrypted:	false
SSDEEP:	3072:S2yRKm4/j/dKLnjHy7OMD+MqS1RYio7+oD33GnUV0fem2M:S2ytqlYnjHehDzqiq+oD33OUV8Vx
MD5:	4294D39CC9E5F23754D41B9DDE710112
SHA1:	1BAA1E136F18108AB4E31EC005DEC54FC3F23A7C
SHA-256:	DE3EEDED01B35DC7C29B0B758211BB1DB73CCFFB9298D281DAF56924ED9E93CB
SHA-512:	E88DFF129DD35445B32A2DBCAB97CF752E9ACDF82FF88B184FA6D3B461D55BD2D195794802C5BA5E7EFFA086DC89E0C2CEF0C8B0BFA29AC70B75CFB1B4B0584C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:.j.i.j.i.j.i..5i.j.i..8i.j.i...i.j.i..:i.j.i.j.i.j.i...i.j.i..=i.j.i..<i.j.i..;i.j.iRich.j.i................PE..L....PjW...........!.........P......)..............o.........................`............@.........................."..X.......P....@..............."..@....P..........................................@............................................text...N........................... ..`.rdata...9.......:..................@..@.data........0......................@....rsrc........@......................@..@.reloc..4....P......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jsdt.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	16448
Entropy (8bit):	6.482296988184946
Encrypted:	false
SSDEEP:	384:n11I27Bf0jeZy+hiqEyRoPV527rBnYPLr7/U:nrJfYqodYJC78
MD5:	4BDF31D370F8A893A22820A3B291CC1D
SHA1:	BD27656B42F881EEE1940CFE15CF84C1938B57BA
SHA-256:	C98DFAC99CC1E05D5F86B2577031A7624DCC13D0A8344B2855F166335177BC16
SHA-512:	51623274C13DA71AD01DBAD7950444B512F08C3DC04E27F0321DF02E9F3C4DFB308DEF35F58524CCCCE79ED2A8859D85C16DC0D9BEA378E5538E23602D35AA76
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{.m..d>..d>..d>.b.>..d>...>..d>..e>..d>...>..d>...>..d>...>..d>...>..d>...>..d>...>..d>Rich..d>........................PE..L....PjW...........!.........................0.....o.........................p......n.....@.........................P8..:....4..<....P...............(..@....`.......0...............................3..@............0...............................text............................... ..`.rdata.......0......................@..@.data...`....@....... ..............@....rsrc........P......."..............@..@.reloc.......`.......&..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jsound.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	30784
Entropy (8bit):	6.609051738644882
Encrypted:	false
SSDEEP:	384:mk87qhVj8sqgP7CRLMOPfkGo7UdJs0flkg2uG8RPGHTR5ny5pnYPLr7z:mk87qhVjaMOPJdJFflLJR+V03C7z
MD5:	7BD914407C6D236B27865A8C63147B7F
SHA1:	9B49E48705341D30E3F92B85652E924C7985E415
SHA-256:	549849DC910261D817670B192715430395993E811D0FD3103651237D7F18929D
SHA-512:	624DC95F696BEA311726EAFB0017F363C8703B95A2E08DE984C642867888CF5B9172326C2E2567ED4A2EA28F806B633840552C80BE49EB6CF2A8FC4A0C259117
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U.Nu.h &.h &.h &...&.h &...&.h &...&.h &.h!&_h &...&.h &...&.h &...&.h &...&.h &...&.h &Rich.h &........PE..L....PjW...........!.....8...(.......A.......P.....o.................................G....@.........................P^.......V..P....................`..@...........`Q...............................U..@............P..D............................text...66.......8.................. ..`.rdata.. ....P.......<..............@..@.data...$....p.......V..............@....rsrc................X..............@..@.reloc...............\..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\jsoundds.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	27712
Entropy (8bit):	6.6264206752006825
Encrypted:	false
SSDEEP:	768:hgWe1DWI+mB7JkJKe3xVF2XNbuHEqe8yIGn3zY9pcQ/oGmEsg0sqkgiHmNs2Qd6X:qWbEK1Ms2dYJG
MD5:	6280201C1918EA3293919BB282D2B563
SHA1:	3F6F5299A435E2A0C36BE8AAD4CB2FCAACD0897D
SHA-256:	0711127A297E4CC1927D77013FC040CAA26930C34A4C7B4D7631BCE9C8041B74
SHA-512:	A4C4507ED4FDEC038FAFA62970161E7B75FF9A2ABBDF854ED55483144DCDC0FC9D21235FDDDF1B38303723F9C615AE388397C4D17B5391D8827A5B40AC52C5FC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............q...q...q.......q.......q.......q...q...q....=..q....<..q.......q.......q.......q..Rich.q..........................PE..L....PjW...........!.....6...$.......?.......P.....o................................p;....@.........................0Y.......S.......p...............T..@.......0....Q...............................R..@............P...............................text...f4.......6.................. ..`.rdata.......P.......:..............@..@.data...L....`.......J..............@....rsrc........p.......L..............@..@.reloc...............P..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\kcms.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	178240
Entropy (8bit):	6.793245389378621
Encrypted:	false
SSDEEP:	3072:gWosiKTxga2KtpdhEnGF5PNyR0BxDxxKF5HkEWnuYsauj9Fom1QB:3RRKAtpdhEn/0BzwFpvYm0z
MD5:	BF299F73480AF97A750492E043D1FADD
SHA1:	C93C4A2DAE812F31603E42D70711D3B6822F9E8E
SHA-256:	0334E3B7AE677116B92516172D0CA905723DAF847D8B3B0DC3FC118EDC703D51
SHA-512:	7265783F0DD653DBC4693D5EFEB156281620C5421F29910F14C22B75A936233E9E897087E64B641335795484837F28F113EE9F380027698A898F19115FD0F648
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........:..di..di..di.k.i..di.k.i..di...i..di.k.i..di..ei..di.k.i..di.k.i..di.k.i..di.k.i..diRich..di................PE..L...pPjW...........!.....^...F.......g.......p.....o.................................Z....@.............................d....x..P.......h...............@....... ...`q..............................pw..@............p..H............................text....\.......^.................. ..`.rdata.......p.......b..............@..@.data................v..............@....rsrc...h...........................@..@.reloc.. ...........................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\keytool.exe

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15936
Entropy (8bit):	6.474237923131844
Encrypted:	false
SSDEEP:	384:Gps45cnQ6DmSHhV8r0eeU4Szi6nYPLr70aG:Gpsnn4S/8rxeUvC7RG
MD5:	9A4CF09834F086568DF469E3F670BF07
SHA1:	594C4E0394475A6299C79E3A063C7D5AE49635F3
SHA-256:	709E9E544434C52285A72F29AD6B99CE1E7668545F10AD385C87ABF34D2052BB
SHA-512:	CD551E7944461F3288B880B9D161F19F97EB4599A3A46CC93C4172B5112960FB0C040B9996F13CF0761FB85A283E2F20944135EC59660C807A59B29CDDC44586
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R%^.<v^.<v^.<vW..v\.<vEx.v_.<vEx.v\.<vEx.v[.<v^.=vo.<vEx.vJ.<vEx.v_.<vEx.v_.<vRich^.<v........PE..L....DjW............................\|........ ....@..........................`.......@....@.................................4#..P....@..T............&..@....P....... ...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...T....@......................@..@.reloc.......P.......$..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\kinit.exe

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15936
Entropy (8bit):	6.477340414037824
Encrypted:	false
SSDEEP:	384:Gps45cnk6LlmSHhV8i+ceek4SzS+nYPLr7wd:Gpsnn5AS/8jZek7C7wd
MD5:	4DE6BFE6EA98BC42A5358ED8307107B2
SHA1:	8F687E60784FD9046A361DC1DC85D43051CBD577
SHA-256:	7C07D167AA4A23AB64A205301663C87E578FF6B31985DF8B51AF80CA6999176F
SHA-512:	8091AADEACAD1DAC5191EBB996D1E4BE25A19C10A4E76F79AB7EA2A592711FD39AAD7E89D7DEE09385296AA7A649AABFA7C325C4A627AFE1C009C906709EDB5A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R%^.<v^.<v^.<vW..v\.<vEx.v_.<vEx.v\.<vEx.v[.<v^.=vo.<vEx.vJ.<vEx.v_.<vEx.v_.<vRich^.<v........PE..L....DjW............................\|........ ....@..........................`............@.................................4#..P....@..H............&..@....P....... ...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...H....@......................@..@.reloc.......P.......$..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\klist.exe

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15936
Entropy (8bit):	6.477747126356611
Encrypted:	false
SSDEEP:	384:GpsJ5cn66FmSHhV8Teeek4SzSgnYPLr7mpB:GpsUngS/8TDekdC7yB
MD5:	CA17B8CBD623477C5D1D334B79890225
SHA1:	2BFC372A28EDE40093286CDA45003951A2CE424F
SHA-256:	A7AC47AC8518E2D53575E12521B3A766A5E2EE4133C6C6AB9AE1C3C6777F5E77
SHA-512:	D9DDF3E67B9A4E0197D271243623D4DF8A26A35EC2F5195AB316E910E133BA09C70F6D28E7CA69184E4ABABCF063C014D7A6E6EA48F82382B316864A945175C5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R%^.<v^.<v^.<vW..v\.<vEx.v_.<vEx.v\.<vEx.v[.<v^.=vo.<vEx.vJ.<vEx.v_.<vEx.v_.<vRich^.<v........PE..L....DjW............................\|........ ....@..........................`....... ....@.................................4#..P....@..H............&..@....P....... ...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...H....@......................@..@.reloc.......P.......$..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\ktab.exe

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15936
Entropy (8bit):	6.476844183458217
Encrypted:	false
SSDEEP:	384:Gpsw5cnL6U0mSHhV89+ee84SzSFnYPLr7KTdK:Gps/nHpS/89je80C7KQ
MD5:	B4AD335E868693F009B7644E2ED555C1
SHA1:	ECCB9711CF78BCD5BD78231A838B1852764B301C
SHA-256:	CCA46A54A1A9CE78F7FFC49D195C4AB970AD540B5FCB2B6D9BF57EEDF38EC28D
SHA-512:	04A4670345B47C5B256220A85FFC68A1DD6DFE8D44838A4C634EB0EBC469EFC307B0BCF838AA1244634A315F365518B1633586B872C6D459EE80374D14234CA4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R%^.<v^.<v^.<vW..v\.<vEx.v_.<vEx.v\.<vEx.v[.<v^.=vo.<vEx.vJ.<vEx.v_.<vEx.v_.<vRich^.<v........PE..L....DjW............................\|........ ....@..........................`......{.....@.................................4#..P....@..H............&..@....P....... ...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...H....@......................@..@.reloc.......P.......$..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\lcms.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	185920
Entropy (8bit):	6.517453559791758
Encrypted:	false
SSDEEP:	3072:pmxoFzYbnERrNyf0VCyqp2pswAG8wJfV1cnrQKUCc9rBTq/bKQcUMZ:koFJcQCyuZG8wdKcLgbDcU6
MD5:	D4246AF96E1FFA5E63C55E6F0A63ED82
SHA1:	30F319CEBD7BCCCFC3637231D07F45BD5A79B03E
SHA-256:	84576AAC88D08E864645415D8A81F4B8F04C881B7624973C952BA6BCB94F4C8C
SHA-512:	92EDFE62BE5BDDC47EC51B01F8FE71C69691423ABECBB358A972766ACCDC8F9365C064FD0A7833C8853EDD5DED51791A7662584DB5F54BE3586AC2787160FA6A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......AE.m.$z>.$z>.$z>.\.>.$z>...>.$z>...>.$z>...>.$z>.${>T$z>...>"$z>...>.$z>...>.$z>...>.$z>Rich.$z>........................PE..L...pPjW...........!.................%.......0.....o......................................@..........................P..h...LK..d.......................@.......$... 1...............................I..@............0...............................text............................... ..`.rdata..H#...0...$... ..............@..@.data....h...`...\...D..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\management.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	33344
Entropy (8bit):	6.5580840927675945
Encrypted:	false
SSDEEP:	768:5TuVpsEkV3/azbYJHf2ZdCwhxKdv0tCFC7dRb:5YQV3/az8x2HCSScC4dRb
MD5:	EFF31A13A4A5D3E9A5BD36E7349D028B
SHA1:	8E47BE8C1CE4DFD73B7041679E96EA4A17DDB4C0
SHA-256:	307B816892FDD9BAD9E28953E1BBB4BCE35C8F8CA783C369D7EB52A22BCC4229
SHA-512:	72148C757624868D3866C40B31149CCA171737D82ADBCDF2C8FB03A9D8F3C1CEA2B2FC5137DD11DAAD2328D3AF8FAE43568DCCD843664BC43323F9357B67B6A0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\j.29.29.29w..9.29...9.29...9.29..9.29...9.29.39..29...9..29...9.29...9.29...9.29Rich.29........PE..L...pPjW...........!.....,...>......H6.......@.....o................................T.....@..........................T.......K.......................j..@...........pA..............................XJ..@............@..P............................text...^+.......,.................. ..`.rdata...-...@.......0..............@..@.data...@....p.......^..............@....rsrc................`..............@..@.reloc...............d..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\mlib_image.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	574528
Entropy (8bit):	6.508068830472597
Encrypted:	false
SSDEEP:	12288:NtKMEr1LBBgPcvhwhtRtL+tKJZetu4zxLukaMevlOjPMat4+8NMutQaLqqiINw3X:NtKMEr1VBgPcvhwhtRtL+tkZezxLuQeS
MD5:	5E1B7D0ACCB4275DEAB6312AA246CB3E
SHA1:	488A5CB9D9C0CF27824DF32B9B76D4F67F6FB485
SHA-256:	9FC49B3F6FD11A2B2B92748C24F21721D1011B1920D092E38AF4021102125543
SHA-512:	5A875DD4731E862F753EBB987593DC61D39DD3D3D13CDED284DE27DD09AFA946FA96824AC194EC0DD45AA2CE0D56637A5522F49F28F3C89B7F5248D389B1B62E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Y...8i.8i.8i.@..8i....8i.8h.8i....8i....8i.....8i....8i....8i....8i.Rich.8i.........PE..L...pPjW...........!...............................o.....................................@......................... ..."......<.......................@...........................................p...@............................................text............................... ..`.rdata..B...........................@..@.data...,...........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\msvcp120.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	455328
Entropy (8bit):	6.698367093574994
Encrypted:	false
SSDEEP:	12288:uZ/8wcqw2oe+Z3VrfwfNOOoWhUgiW6QR7t5ss3Ooc8DHkC2e77/:W/8wVwHZFTwFOOos3Ooc8DHkC2e77/
MD5:	FD5CABBE52272BD76007B68186EBAF00
SHA1:	EFD1E306C1092C17F6944CC6BF9A1BFAD4D14613
SHA-256:	87C42CA155473E4E71857D03497C8CBC28FA8FF7F2C8D72E8A1F39B71078F608
SHA-512:	1563C8257D85274267089CD4AEAC0884A2A300FF17F84BDB64D567300543AA9CD57101D8408D0077B01A600DDF2E804F7890902C2590AF103D2C53FF03D9E4A5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o...+.N+.N+.N.3wN).N+.N..Nm.aN(.Nm.cN#.Nm.]N..Nm.\Ne.Nm.YN-.Nm.`N.Nm.gN.Nm.bN*.NRich+.N........................PE..L....\|OR.........."!.........................0.......................................x....@..........................W..L...<...<........................>.......D...................................K..@...............<............................text...<........................... ..`.data....^...0...0... ..............@....idata...............P..............@..@.rsrc................j..............@..@.reloc...D.......F...n..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\msvcr100.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	773968
Entropy (8bit):	6.901569696995594
Encrypted:	false
SSDEEP:	12288:yMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BV0eAI:dmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV4I
MD5:	BF38660A9125935658CFA3E53FDC7D65
SHA1:	0B51FB415EC89848F339F8989D323BEA722BFD70
SHA-256:	60C06E0FA4449314DA3A0A87C1A9D9577DF99226F943637E06F61188E5862EFA
SHA-512:	25F521FFE25A950D0F1A4DE63B04CB62E2A3B0E72E7405799586913208BF8F8FA52AA34E96A9CC6EE47AFCD41870F3AA0CD8289C53461D1B6E792D19B750C9A1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.y.~...~...~...w...}...~.......eD.....eD..+...eD..J...eD......eD......eD......eD......Rich~...................PE..L..."._M.........."!.........................0.....x................................u.....@..........................H......d...(.......................P.......$L...!..8...........................hE..@............................................text...!........................... ..`.data....Z...0...N..................@....rsrc................f..............@..@.reloc..$L.......N...j..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\msvcr120.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	970912
Entropy (8bit):	6.9649735952029515
Encrypted:	false
SSDEEP:	12288:LBmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJQV:dmFyjLF847eiWWcoGZVOIxh/WxIAIbGV
MD5:	034CCADC1C073E4216E9466B720F9849
SHA1:	F19E9D8317161EDC7D3E963CC0FC46BD5E4A55A1
SHA-256:	86E39B5995AF0E042FCDAA85FE2AEFD7C9DDC7AD65E6327BD5E7058BC3AB615F
SHA-512:	5F11EF92D936669EE834A5CEF5C7D0E7703BF05D03DC4F09B9DCFE048D7D5ADFAAB6A9C7F42E8080A5E9AAD44A35F39F3940D5CCA20623D9CAFE373C635570F7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S9...XlA.XlA.XlA..A.XlA.XmA.XlAQ..A.ZlAQ..AvXlAQ..A!XlAQ..A.XlAQ..A.XlAQ..A.XlAQ..A.XlARich.XlA........PE..L....\|OR.........."!................D............................................... .....@.........................`........R..(....p...................>......d]..@...8...........................H...@............P...............................text............................... ..`.data...4e.......V..................@....idata.......P......................@....rsrc........p.......0..............@..@.reloc..d].......^...4..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\net.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	79936
Entropy (8bit):	6.675027571633986
Encrypted:	false
SSDEEP:	1536:ygRdVzzmTj2iu+wk5eQjBE55W+hYRwZZ3GFjJJ5n5WF:yIfmHsM5j6VqJJ55WF
MD5:	691B937A898271EE2CFFAB20518B310B
SHA1:	ABEDFCD32C3022326BC593AB392DEA433FCF667C
SHA-256:	2F5F1199D277850A009458EDB5202688C26DD993F68FE86CA1B946DC74A36D61
SHA-512:	1C09F4E35A75B336170F64B5C7254A51461DC1997B5862B62208063C6CF84A7CB2D66A67E947CBBF27E1CF34CCD68BA4E91C71C236104070EF3BEB85570213EC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!.._e.}.e.}.e.}.~'..d.}.~'..g.}.....f.}.~'..c.}.e.\|..}.l...b.}.l...d.}.~'..D.}.~'..d.}.~'..d.}.~'..d.}.Riche.}.................PE..L...pPjW...........!.........l.....................o.........................`......-.....@.............................1............0............... ..@....@...................................... ...@...................l...`....................text............................... ..`.rdata...L.......N..................@..@.data........ ......................@....rsrc........0......................@..@.reloc..*....@......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\nio.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	51264
Entropy (8bit):	6.565433654691718
Encrypted:	false
SSDEEP:	768:a+BEJER/xSW/EoB8VBQZbKYawLysHFhIAqQbQMD8YpwQ+Qi4v8qUYVC7R:a+BEJERvQGbKnwusjIAq08YDi4UqUYoR
MD5:	95EDB3CB2E2333C146A4DD489CE67CBD
SHA1:	79013586A6E65E2E1F80E5CAF9E2AA15B7363F9A
SHA-256:	96CF590BDDFD90086476E012D9F48A9A696EFC054852EF626B43D6D62E72AF31
SHA-512:	AB671F1BCE915D748EE49518CC2A666A2715B329CAB4AB8F6B9A975C99C146BB095F7A4284CD2AAF4A5B4FCF4F939F54853AF3B3ACC4205F89ED2BA8A33BB553
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J!...@..@..@...@..@...u..@...B..@..@..@..8M..@...t..@...E..@...D..@...C..@.Rich.@.........PE..L...pPjW...........!.....V...Z......9_.......p.....o................................X.....@..............................+..L\|..........................@.......t....r...............................{..@............p...............................text...TT.......V.................. ..`.rdata...F...p...H...Z..............@..@.data...(...........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\npt.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17472
Entropy (8bit):	6.403594687791098
Encrypted:	false
SSDEEP:	192:A3PK394shTLHzW8KMw3X+PVR6y/FNdoEUtnYe+PjPriT0fwoBpp6Z:BThTrzPPQOPV5NNdoEwnYPLr7xc
MD5:	94CAADA66F6316A9415A025C68388A18
SHA1:	57544E446B2B0CFBA0732F1F46522354F94B7908
SHA-256:	D1C4FB91296D643AEE6AB9CD66CC70ACBE2667AD572D969A06FFEAA2A8859FAF
SHA-512:	AC29E7C722A266DCB633953EF2A7E33DF02059AC7876FF94828464B5B74B5BC321C5D2D2851F3CBBFE1328D18F3CD9A49E5EFFE7E4E8AC2BEB3A0E4AAA53AD87
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............w...w...w....@..w..O9K..w....O..w...w...w....M..w....x..w....y..w....H..w....I..w....N..w..Rich.w..........PE..L...qPjW...........!................)........0.....o.........................p......w.....@..........................7.._....3..<....P...............,..@....`.......0...............................2..@............0...............................text...>........................... ..`.rdata..O....0......................@..@.data...X....@......."..............@....rsrc........P.......$..............@..@.reloc.......`.......(..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\orbd.exe

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	16448
Entropy (8bit):	6.380289288441742
Encrypted:	false
SSDEEP:	384:GpsCgvnvId6YmSHhV85AeencGtnYPLr7Vz:GpsDngGS/851ebC7Vz
MD5:	7DA6AA3CC4763C6F9C20B43E6C9A9547
SHA1:	3F28CF8E6AAD199DCC621F2A2C8AD50126813B05
SHA-256:	F7375AD07F0BE6FD75E822A9ECFF5ACA073DB03B95894C05C7657BEC7AF59AF4
SHA-512:	7948EAA11B4026F9975B6CC4225A4C0B617341299364196F3825EEF4484A6EEB529319BF4F6D19436689083C36BF1F6B9880574764612FC900C8CC1D73EED1BB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R%^.<v^.<v^.<vW..v\.<vEx.v_.<vEx.v\.<vEx.v[.<v^.=vo.<vEx.vJ.<vEx.v_.<vEx.v_.<vRich^.<v........PE..L....DjW............................z........ ....@..........................`......1.....@..................................#..P....@..H............(..@....P....... ..............................h"..@............ ...............................text............................... ..`.rdata..*.... ......................@..@.data........0......................@....rsrc...H....@......................@..@.reloc.......P.......&..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\pack200.exe

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15936
Entropy (8bit):	6.4779230305378315
Encrypted:	false
SSDEEP:	384:Gpsk5Bn46zmSHhV8yYAeeU4Sz5uwnYPLr73ki:GpsungS/8yY1eUuwC79
MD5:	E9AA62B1696145A08D223E7190785E25
SHA1:	A9A0CB22A28A3843CF6CCBC9578B1438F0A7B500
SHA-256:	EA9DF3432EF31B6864112AF1CEC94E6BE33B92A9030369B9F99225113BCA6EF8
SHA-512:	516FA102922980DF592DD08A840DA9073B6568F5E52847968C59995F2BD067AC6D2668D0272AE017D0C71AF627766A8676AE1EB1BC520B76F1F9C5CEEB4BA840
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R%^.<v^.<v^.<vW..v\.<vEx.v_.<vEx.v\.<vEx.v[.<v^.=vo.<vEx.vJ.<vEx.v_.<vEx.v_.<vRich^.<v........PE..L....DjW............................\|........ ....@..........................`.......#....@.................................D#..P....@..T............&..@....P....... ...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...T....@......................@..@.reloc.......P.......$..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\plugin2\msvcr100.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	773968
Entropy (8bit):	6.901569696995594
Encrypted:	false
SSDEEP:	12288:yMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BV0eAI:dmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV4I
MD5:	BF38660A9125935658CFA3E53FDC7D65
SHA1:	0B51FB415EC89848F339F8989D323BEA722BFD70
SHA-256:	60C06E0FA4449314DA3A0A87C1A9D9577DF99226F943637E06F61188E5862EFA
SHA-512:	25F521FFE25A950D0F1A4DE63B04CB62E2A3B0E72E7405799586913208BF8F8FA52AA34E96A9CC6EE47AFCD41870F3AA0CD8289C53461D1B6E792D19B750C9A1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.y.~...~...~...w...}...~.......eD.....eD..+...eD..J...eD......eD......eD......eD......Rich~...................PE..L..."._M.........."!.........................0.....x................................u.....@..........................H......d...(.......................P.......$L...!..8...........................hE..@............................................text...!........................... ..`.data....Z...0...N..................@....rsrc................f..............@..@.reloc..$L.......N...j..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\plugin2\npjp2.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	172096
Entropy (8bit):	6.3747906238754855
Encrypted:	false
SSDEEP:	3072:1WkHL+UE3r2l5p2WqjgFWcWpPa6QoCzOb/UcODMM4cBqg8UyJNd5uGZzfYtRD+Em:YdNq5YkFuPYzOb/UcODMM4cBqg8UyJNR
MD5:	FB658E2F5E185FE5762B169A388BA0BD
SHA1:	386235AB2F7AD35E82CD9AC97E9B56E1E308BC90
SHA-256:	A91E68C76A90A02D9EDF75E5141C248B3AA5DD612E37883D27065D78A782AF20
SHA-512:	B0EAB6F2572552298CD221AF9E71CA7C02375D92E14F7EBD783F5DC9247964F72E658DBFC4273BD3C36DF57199171263F1A4969F133823965448C552BB514EEC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-n.C=.C=.C=...=..C=a..=..C=...=..C=...=..C=.B=..C=...=..C=...=.C=...=.C=...=.C=...=.C=...=.C=Rich.C=........................PE..L...rPjW...........!.....J...@.......-.......`.....o......................................@.............................A............ ...h..............@.......h....c..................................@............`..H............................text....H.......J.................. ..`.rdata..!....`.......N..............@..@.data...X!..........................@....rsrc....h... ...j..................@..@.reloc...".......$...d..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\policytool.exe

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15936
Entropy (8bit):	6.477211573452372
Encrypted:	false
SSDEEP:	384:Gps25Bnb61mSHhV8nOeet4SzvBQnYPLr7D8/:Gpson1S/8nTetJSC7+
MD5:	ED3F3D8E4C382BF8095B9DE217511E29
SHA1:	CAE91B9228C99DCC88BAC3293822AC158430778C
SHA-256:	800F41B877AA792A8469C4DBB99838E7A833B586EC41BD81DA81EAA571F7FAC1
SHA-512:	023855267C6CC6BD5230E7A922310328E8DC0521C041C038C579035C9B1E70EAC168695B56357793505375E0B134FAD040BB284C6B02B3190EE7F6FCAEC33FE9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R%^.<v^.<v^.<vW..v\.<vEx.v_.<vEx.v\.<vEx.v[.<v^.=vo.<vEx.vJ.<vEx.v_.<vEx.v_.<vRich^.<v........PE..L....DjW............................\|........ ....@..........................`...........@.................................D#..P....@..h............&..@....P....... ...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...h....@......................@..@.reloc.......P.......$..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\prism_common.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	52800
Entropy (8bit):	6.433054716020523
Encrypted:	false
SSDEEP:	1536:Rk2X5KQaT9nNrmTTY99ccAlGGzGRulFJWpiDO:RkgUhpmA99ccOGGzGRuPJWpgO
MD5:	6D05EAD2F6B95C4AFFCFB1B27DC0C188
SHA1:	0D04A67505D006493F252985AC294B534D271EF2
SHA-256:	6330591A151E565B5EAB2D174DF8E2F6523A8F403E4E8D8C8DC58D0945881F19
SHA-512:	DBE98FA16162636039853E9A82CADBE4E6D5A4E6E282A3FBBC122229C314C91E7C445FEB83921EBFE024DC09BC6AA76682F903036A2D2BEA363F1D09DD571B10
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q..D5.w.5.w.5.w..J..7.w.5.v...w.8..6.w.8..6.w.8..9.w.8..7.w.H..2.w.H..4.w.8..4.w.H..4.w.Rich5.w.........................PE..L...pPjW...........!...............................o................................/&....@....................................<.......................@...............................................@............................................text.............................. ..`.rdata..X...........................@..@.data...D...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\prism_d3d.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	116288
Entropy (8bit):	5.7845827860105885
Encrypted:	false
SSDEEP:	3072:UbqmeUF67oaebwU3ta+uHMg9glgFvcfgfgzgG4g9XTXDXp+RuXGXlXdY9vXTXvXQ:8qmeUF67ZeUUVjcIA
MD5:	5AADADF700C7771F208DDA7CE60DE120
SHA1:	E9CF7E7D1790DC63A58106C416944FD6717363A5
SHA-256:	89DAC9792C884B70055566564AA12A8626C3AA127A89303730E66ABA3C045F79
SHA-512:	624431A908C2A835F980391A869623EE1FA1F5A1A41F3EE08040E6395B8C11734F76FE401C4B9415F2055E46F60A7F9F2AC0A674604E5743AB8301DBADF279F2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........tm....X...X...X.G.X...X.G.X...X.G.X...X.G.X...XR..X...X...X...X.l.X...X.l.X...X.G.X...X.l.X...XRich...X........PE..L...pPjW...........!................=..............o................................\|.....@.........................0...K...\|...d.......................@....... ......................................@...............4............................text.............................. ..`.rdata..X...........................@..@.data...............................@....rsrc...............................@..@.reloc.. ...........................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\prism_sw.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	86592
Entropy (8bit):	6.686302444148156
Encrypted:	false
SSDEEP:	1536:/QsPinZd9lmzFRQnJ9sSpkWgVenAe7C3xWxNO3A4:lPE9lEmtpkj7eqWxNCA4
MD5:	5E6DDF7CF25FD493B8A1A769EF4C78F7
SHA1:	42748051176B776467A31885BB2889C33B780F2D
SHA-256:	B9BEACA57BFF23C953917C0B2037351EF3334E6A9DE447DCA6542FE5C815BF9F
SHA-512:	C47F742F064B99E5B9C2BDEAC97472D9D8C9466C9071E9799AF79F820199D9B30B198C33EF635F07A972B77475AFEA9E7417AA6335D22A7380E7B0E552869C18
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!3.ueRr&eRr&eRr&...&gRr&eRs&ERr&h..&fRr&h..&oRr&h..&hRr&h..&gRr&.+.&nRr&.+.&dRr&h..&dRr&.+.&dRr&RicheRr&........PE..L...qPjW...........!................~..............o................................O.....@........................../..B...D4..<....p...............:..@.......\...................................0...@...............\|............................text...4........................... ..`.rdata..*w.......x..................@..@.data...$....@....... ..............@..._RDATA.......`.......(..............@..@.rsrc........p.......0..............@..@.reloc..\............4..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\resource.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14912
Entropy (8bit):	6.381906222478272
Encrypted:	false
SSDEEP:	192:kNncquU+hyD13XLPVlD6o+N9F5os7USnYe+PjPriT0fwXF27:kNcWp7PVl67/nYPLr7s27
MD5:	3C9DC0ED8ADD14A0E5B845C1ACC2FF2E
SHA1:	25C395ADE02199BEDCEE95C65E088B758CD84435
SHA-256:	367C552FBA3DA5F22791CF8F22B983871639ECD2EF7F5B1880021FE4C4F65EE4
SHA-512:	4DD5F68180D03B6621E46732F04B47F996B96F91F67845538D1B303E598CCFDB5E4F785A76DE7DFCB8918125FDB06B9068C4EAB06984B5AA9224DCE90190BA1A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z>Mg._#4._#4._#4.'.4._#4..4._#4..4._#4..4._#4._"4>_#4..4._#4..4._#4..4._#4..4._#4Rich._#4................PE..L...pPjW...........!......................... .....o.........................`.......>....@..........................%......\"..d....@..............."..@....P..D.... ...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...`....0......................@....rsrc........@......................@..@.reloc.......P....... ..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\rmid.exe

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15936
Entropy (8bit):	6.466364086630595
Encrypted:	false
SSDEEP:	384:Gpss5cnn6vmSHhV8TI1ee84SzK8nYPLr7HuY:Gps7nnS/8Tte8tC7HuY
MD5:	12B6E1C3205A8B17AC20E00A889DFC43
SHA1:	42458CFA7135858ACEF10803B87A208FA7E66413
SHA-256:	EAEA20A794EC6BB15808EF278376A87CF91F9BE15FE6A7DE92014AC4BF75555D
SHA-512:	174703820636DED2BA081420A8D1E37D67FDA6C13AC406C2F08E16DCF0C7B7D9642E37BC888802B50ED3438D6029C4FECCD7C151B82CF9A91F13F36C4A0B2019
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R%^.<v^.<v^.<vW..v\.<vEx.v_.<vEx.v\.<vEx.v[.<v^.=vo.<vEx.vJ.<vEx.v_.<vEx.v_.<vRich^.<v........PE..L....DjW............................\|........ ....@..........................`......r.....@.................................4#..P....@..H............&..@....P....... ...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...H....@......................@..@.reloc.......P.......$..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\rmiregistry.exe

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15936
Entropy (8bit):	6.475930674615241
Encrypted:	false
SSDEEP:	384:GpsFG5BnK6xmSHhV8TCeeX4SzREnYPLr7Ggp:Gpsen0S/8TveXUC7jp
MD5:	31C0CED43A07A2DFF3AFC557EBABBE0F
SHA1:	9100A7393B919EB35C79CE16A559D783219E2F20
SHA-256:	B93D0D62436D89C84C66ABBDCF817084A6BA01F7E10053C8F343DF5D53D37536
SHA-512:	716818BBF6E4F21C2A627259F1D35E8375EFEF9C3B197B3AF6E10A4A1735CC643141C32270DF7F6FE25733517BE38CAA09205B98119996237E8EAE6A7D0825A7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R%^.<v^.<v^.<vW..v\.<vEx.v_.<vEx.v\.<vEx.v[.<v^.=vo.<vEx.vJ.<vEx.v_.<vEx.v_.<vRich^.<v........PE..L....DjW............................\|........ ....@..........................`......84....@.................................D#..P....@..h............&..@....P....... ...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...h....@......................@..@.reloc.......P.......$..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\servertool.exe

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15936
Entropy (8bit):	6.475447140204412
Encrypted:	false
SSDEEP:	384:Gps85BnF26emSHhV8QM1eet4SzvBonYPLr7I:GpsGnFjS/8QBetJWC7I
MD5:	43C1D1D0E248604CB3B643C0BDF4EC9A
SHA1:	7BEE9DEB1E43F0FECF0FC57BDFD3F79CF048151F
SHA-256:	165BFF317674BE33F2920320F3EF0957539E5BF149B673C2073DF48FF93A6D94
SHA-512:	CAA9B14DF20FFF92CFC4F9A8557804FBD4CC02831824CD53AEAC7D0EE7918BBD50E22A69AB5FFC9E92A468A5201DF263707D373D60378817DC5FEFDE1ABC48BF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R%^.<v^.<v^.<vW..v\.<vEx.v_.<vEx.v\.<vEx.v[.<v^.=vo.<vEx.vJ.<vEx.v_.<vEx.v_.<vRich^.<v........PE..L....DjW............................\|........ ....@..........................`.......t....@.................................D#..P....@..h............&..@....P....... ...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...h....@......................@..@.reloc.......P.......$..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\splashscreen.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	177216
Entropy (8bit):	6.909590121652277
Encrypted:	false
SSDEEP:	3072:L9Wyo+Jyru3w8WqWnJjOUrI7vh+Dug9PVWU+kmaVE9TBfQiJ8:BWyPsi34i+DugFj+kmaVE9TB4/
MD5:	8DC2356E3FF3A595AEDE81594A2D259A
SHA1:	A05E05E9EA8FB0C8928112CA931EB4F5E977B92A
SHA-256:	B9DE5D3ABBC0AC956E7F590E4C8507FF570B6C353374BB80F413B5846CE322FE
SHA-512:	D5C83EBDB7192DD361856B236A07AFD4FF95E68E0036396D68A3407ED680D4A36EC857AB101DBA5F583AA67CC45A2835178DAC84A68472C7F619EFA674FE51F0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................8h....z.l.....8j.....8_......_......g.......h....8^......8o.....8n.....8i....Rich...........................PE..L...pPjW...........!...............................o......................................@.........................`...........P.......................@...........`...................................@...............D...\|...@....................text............................... ..`.rdata..]...........................@..@.data....1..........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\ssv.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	473152
Entropy (8bit):	5.475991416072106
Encrypted:	false
SSDEEP:	6144:ngmgmb+p19k+j4QJKFDSha+IJ6NyLu/wtAWvrMZp5WMuBzj:n17bsj4QJlha+XNyLu/iAWvhBzj
MD5:	79CFE207E05F771E29847573593F6DE1
SHA1:	34DFA813802C6F5A57A557BF72B2B306F8042E90
SHA-256:	AEB27727F428116069944BB92B477D7487C9DEB3921E1005814536459E35222F
SHA-512:	2C71A827BB156BD012BE20B30D701D5123D8B6C7889D4F4A47A483D3477C25BF224E7F205CA9FCCB08DA0A2EF28AF6433D018A0E555BCE911C31A5F462F41578
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......@.....@..@..@..4@..@.u2@..@.u.@..@../@..@..?@..@..@:.@k..@..@.u.@\.@.u7@..@.u6@..@.u1@..@Rich..@........PE..L...pPjW...........!.....^..........r .......p.....o.........................p............@.........................@D.......+...........s........... ..@.... ..H6...t..................................@............p.......).......................text...\\.......^.................. ..`.rdata.......p.......b..............@..@.data....I...P...*...8..............@....rsrc....s.......t...b..............@..@.reloc...H... ...J..................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\ssvagent.exe

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	52800
Entropy (8bit):	6.367562931371078
Encrypted:	false
SSDEEP:	768:0UD9dxWf4b4UoY6sUsaJ2sQ7O+phclByW3T9KMDbgz2dN6lDb/9/YMw0c3D6QsTY:0IofovBbS9KMvHR0cz6QsTPOXm2BT9j7
MD5:	F434A8AC7F1C8C0E2587B9A9F30E397B
SHA1:	BD62E10E44117A60EB4180412112593D9460299D
SHA-256:	6A994B389B8F7109238DE6F230B1B540186ED2EC8D081C7601C6996863AA4DC8
SHA-512:	9896DAC36BD4F7289C7701B75AD8EB9F7ACD233384075A3FBA6E6F2F38E420F37C1A29317EEEA3C4DDBA1791F6F17187DD5BDFDD9F98F095E7D4DF20C0D5EA3E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Hi.m...>...>...>..u>...>.Fq>...>..w>...>..C>...>.pj>...>.pz>...>...>...>c~B>...>..B>...>..s>...>..t>...>Rich...>........PE..L....HjW.................f...R.......i............@.................................._....@.....................................x.......................@.......X...@...............................P...@...................`........................text....e.......f.................. ..`.rdata...5.......6...j..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\sunec.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	123968
Entropy (8bit):	6.699694377005066
Encrypted:	false
SSDEEP:	1536:jWi/SLhxEJKv0O4+zwtKg3HquHB2u0YUdRXGCDilgKptxG0ULtt1vtxgl0IlgqA2:+vdtg6ZYUniPe5vtxgl0IlgqA2
MD5:	0BAB62A0CF67481EA2A7F3CAFD7C5144
SHA1:	D6B010C815F4D9C675DF918B615FE0AAE45249EA
SHA-256:	FC57682FDBCA50FAEBFC6B4F5D199FC407A541C110C15F0C850503006D32301A
SHA-512:	0128813DE247246BF4AECE1B222B6611E5AE1EDE01A1B339CFE0F98184739D7A066DAE4F1A271F544BB39F9B79F053F4B96F2E471B9444C29855CF52FB7835CB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......y..@=..=..=..4.1.?....:.<..&G>.>..=.....&G<.:..&G..>..&G.....&G9.<..&G8.<..&G?.<..Rich=..................PE..L...qPjW...........!.........................0.....p......................................@.........................p...:...\...<.......................@............0..................................@............0...............................text............................... ..`.rdata.......0......................@..@.data...............................@....rsrc...............................@..@.reloc..>...........................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\sunmscapi.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	25664
Entropy (8bit):	6.488681310308951
Encrypted:	false
SSDEEP:	384:GxZ2v7Oc56lspQEgde9M3z27lFOJIjkzIPV5yKlWFKbKwnYPLr7Wo5L:Xr5PQEOe9MD4lFhjk8ddeKWwC7dL
MD5:	039AD8A7A4B14C321F156878838A2340
SHA1:	6AD9D2FBA988193D16E7B3278C0D0757AB99B3EF
SHA-256:	ED3AD7EBA989FB31C2ABC3220694D1446D33659782CB1B333318EC54A577389D
SHA-512:	7D5B8C191A7D0C4FEDB831DE197A3CB5DC0564AD3F2E57EEE8C506B2308B656D2F0FE086D508FAB8F03CA0E1B0574E708728373DFA3116C9B9FC5DFDB72FEE46
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........O.............................;......V...............:..........................Rich....................PE..L...rPjW...........!.....(..."......h2.......@.....p.................................3....@.........................`O.......G..d....p...............L..@...........PA..............................8D..@............@..4............................text....&.......(.................. ..`.rdata..8....@.......,..............@..@.data...`....`.......B..............@....rsrc........p.......D..............@..@.reloc..^............H..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\t2k.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	195136
Entropy (8bit):	6.80727029211823
Encrypted:	false
SSDEEP:	3072:fmtIwyq6lFq857zCYLFYEVothL10xYOXjV5qECVTHLy71vJ2qIcWYEfQQxIYh5t+:mIwyqM7qYLVVIqhfqfTm1W+Tws
MD5:	E1904A4B2D6F657B9FEF053893FE3C41
SHA1:	59AC965A1029AE936DDD5AE623A9A025D49737EC
SHA-256:	5929E3510F67FEAE073B8995BFC542FD7A0626F57D2FBC829EFC95206DF8F85F
SHA-512:	C0A60928299EA2E6DC8AD1E3DE9CEF77C8E520585F8D73BD7F56E33705D1A2AEC04AE9C01A8069AE5A0D71F28AEF42F4A260CF4D5BB44A95DCEB70E5C8DB8FEA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`.zS$...$...$...-..&...?>..'...?>..!...$.......?>.. ...?>......?>..%...?>..%...?>..%...Rich$...................PE..L...pPjW...........!.....f...........p.............p......................... .......]....@.............................f...\...P.......................@...............................................@............................................text....e.......f.................. ..`.rdata..v[.......\...j..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\tnameserv.exe

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	16448
Entropy (8bit):	6.392776971200692
Encrypted:	false
SSDEEP:	384:GpssZwnvNmc6DDmSHhV8Ogee1cGPnYPLr7fl:GpssqnFm16S/8OVeLC7fl
MD5:	7624A9B769CDCF3A75FE5A9FEAADD61F
SHA1:	9269968968CD63D6E1ECC14F78B9A630FCC26FBE
SHA-256:	41F9A804C888A58DECDE2B63A544DBFF536B40D87CECED197E1A14050858C0DA
SHA-512:	1AF7BB30E1FC7600AD0A209DB4E077DAB9CEAA5C4332F8B1353ED0DB7EA71B4A9B7D126E756B634D3FB22618E39AFC5ED52263C88E9F7646EAABB0D9240E382B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R%^.<v^.<v^.<vW..v\.<vEx.v_.<vEx.v\.<vEx.v[.<v^.=vo.<vEx.vJ.<vEx.v_.<vEx.v_.<vRich^.<v........PE..L....DjW............................z........ ....@..........................`......n.....@..................................#..P....@..\............(..@....P....... ..............................."..@............ ...............................text............................... ..`.rdata..J.... ......................@..@.data........0......................@....rsrc...\....@......................@..@.reloc.......P.......&..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\unpack.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	65600
Entropy (8bit):	6.461111208462538
Encrypted:	false
SSDEEP:	1536:lVeogiQWo3IzLIoDY9p6K/sdDAZ5e1x3afX:veDib4oDu4K/sdDAZ5CxEX
MD5:	806580640A68234A711D3BB0642130A7
SHA1:	1EDF20DAAC15FE90E9891E95130D0DD70D005B62
SHA-256:	CCCC2A9F54E4F5961DD45DAA1F6C97ECFB156EA8E0DF82277A2C109EA4D2E036
SHA-512:	0AAC087449DEECBB1CFAEE5C3144500CDC4C1D209D1F1F7D8EB41DD7870504BF71D0CC9AE7761BFC609F42273B7FB3CA7801AA54FB0E92BC71C41CC5CAECD31C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........D.H%..H%..H%..A]).J%...k".I%..S.$.L%..S...D%..S.&.O%..H%..w%..S...A%..S.!.I%..S. .I%..S.'.I%..RichH%..........PE..L...pPjW...........!.........L.....................p......................... .......<....@.........................`...........d.......................@...........................................P...@............................................text............................... ..`.rdata..q-..........................@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\unpack200.exe

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	159296
Entropy (8bit):	6.019927381236816
Encrypted:	false
SSDEEP:	3072:9vFy5zbJEQFFB9AYeb11tzTQrTBfYEaf9zQ6NlUlh5:7iFry3b11twTBgEaf9zQ6Nc
MD5:	C15F0FE651B05F4288CBC3672F6DC3CE
SHA1:	FFCE84FE532B41F31CDDC41C84024FAFE6BC30E6
SHA-256:	869DC4D40444F10325057B0CC3BB7EA48942DD712DF8A1AE331A554FF0397F1A
SHA-512:	E9E27C4C68972E3250B380C1A5D5EB02BEC03028D389234A44A7D56974BFA233D177173F929BDB6FF877AE17A529D85D384684B0037E260A0143F7A95A0204C6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ar.:%..i%..i%..i,kKi'..i.]@i&..i>.Di&..i%..in..i>.Fi ..i>.ri8..i>.si,..i>.Bi$..i>.Ei$..iRich%..i........PE..L....DjW..........................................@..................................c....@..................................p..<....................V..@........... ...............................@6..@............q...............................text............................... ..`.rdata.............................@..@.data........P.......(..............@....idata..D....p.......8..............@....rsrc................B..............@..@.reloc...............J..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\verify.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	39488
Entropy (8bit):	6.751057397220933
Encrypted:	false
SSDEEP:	768:Okt1MVMrA9/Klzwz9UyCgMUt9onPs3h3nVt83OndMY7dmMpAnC70N:Oo1oMQ/CrPa3VWO+gdmMW6q
MD5:	DE2167A880207BBF7464BCD1F8BC8657
SHA1:	0FF7A5EA29C0364A1162A090DFFC13D29BC3D3C7
SHA-256:	FD856EA783AD60215CE2F920FCB6BB4E416562D3C037C06D047F1EC103CD10B3
SHA-512:	BB83377C5CFF6117CEC6FBADF6D40989CE1EE3F37E4CEBA17562A59EA903D8962091146E2AA5CC44CFDDDF280DA7928001EEA98ABF0C0942D69819B2433F1322
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W.d....]...]...]...]...].H.]...].H.]...].H.]...]...]_..].H.]...].H.]...].H.]...].H.]...]Rich...]........................PE..L...pPjW...........!.....N...4.......W.......`.....p................................*k....@.................................<x..P.......................@...........Pa...............................v..@............`..<............................text....L.......N.................. ..`.rdata..e!...`..."...R..............@..@.data...(............t..............@....rsrc................v..............@..@.reloc...............z..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\w2k_lsa_auth.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	21568
Entropy (8bit):	6.4868701533420925
Encrypted:	false
SSDEEP:	384:uVI9/tEAHVvfiqiW9LEiGTHb6hVXbS7fLsD5bGGNET7T7T7T7JyFoynPV5hgGLVt:uVI9/yA9f1iW9LEiGTHb6hVXbS7QbGG9
MD5:	7C2959F705B5493A9701FFD9119C5EFD
SHA1:	5A52D57D1B96449C2B40A82F48DE2419ACA944C3
SHA-256:	596F89E7E5D9AC2B1F97FA36A20A7405C1CC41A9FCBA96DB089ADA4550131B24
SHA-512:	B7B48BD14701F75B9018BEDEE5A4CFCEBDAC342F83339FB3F1EFB7855598474C9D1CC993B5D4ADD3326140435087D2BD7CBBC18BC76C64EAD6234A9A7D57C552
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D..3..`..`..`.E.`..`.E.`..`.E `..`...`..`..`2.`.E!`..`.E.`..`.E.`..`.E.`..`Rich..`........................PE..L...pPjW...........!.........".......#.......0.....p.................................h....@.........................@B.......<..x....`...............<..@....p.......0...............................;..@............0...............................text............................... ..`.rdata..6....0......................@..@.data........P.......2..............@....rsrc........`.......4..............@..@.reloc..&....p.......8..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\wsdetect.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	163904
Entropy (8bit):	6.508553433039132
Encrypted:	false
SSDEEP:	3072:onzJtwzsrYx6cY+90AiVrM5muIqltkt7maRoM/X1fJqO0NJT:onttwzsrYxTaVVY5muIq3mx/X1fcb
MD5:	A63387A1BFDF760575B04B7BFD57FF89
SHA1:	9384247599523D97F40B973A00EE536848B1D76F
SHA-256:	5DF5B7E6EFCC345DDC8448AFC707B666F5F696F554B00ACA64D8E23EDBC176BF
SHA-512:	CB3A6A394424345FFA076E0BE58F284A0E4DB6FBFCE02D93FB4871D350A7FA1E673175AE988C26453DB1C983C0D06A01DD413DE47031BB4BF308CAAF3513C36F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........5...T.^.T.^.T.^..)^.T.^../^.T.^...^&T.^.".^.T.^.,2^.T.^.,"^.T.^.T.^MT.^...^.T.^..*^.T.^..+^.T.^..,^.T.^Rich.T.^................PE..L...rPjW...........!...............................p......................................@.................................D........p..P............h..@.......d...................................P...@.......................@....................text............................... ..`.rdata...d.......f..................@..@.data...`@... ..."..................@....rsrc...P....p.......(..............@..@.reloc..~/.......0...8..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\zip.dll

Download File

Process:	C:\Users\Public\123.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	69696
Entropy (8bit):	6.89860109289213
Encrypted:	false
SSDEEP:	1536:ZCghp1EJqcGdjandlraksIOwIOpVnToIft4tpgO6:/142jUhimp9TBft4tqO6
MD5:	CB99B83BBC19CD0E1C2EC6031D0A80BC
SHA1:	927E1E24FD19F9CA8B5191EF3CC746B74AB68BCD
SHA-256:	68148243E3A03A3A1AAF4637F054993CB174C04F6BD77894FE84D74AF5833BEC
SHA-512:	29C4978FA56F15025355CE26A52BDF8197B8D8073A441425DF3DFC93C7D80D36755CC05B6485DD2E1F168DF2941315F883960B81368E742C4EA8E69DD82FA2BA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........H....................2.................4.....................5.............................Rich............PE..L...pPjW...........!.........h.....................p.........................0......V.....@.................................L...d.......................@.... ..X...0...................................@............................................text............................... ..`.rdata..wV.......X..................@..@.data...............................@....rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\accessibility.properties

Download File

Process:	C:\Users\Public\123.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	155
Entropy (8bit):	4.618267268558291
Encrypted:	false
SSDEEP:	3:nSkoZgZLXnuWxVEsTwVAAiuKIn7IRAdSPGGzJ0vwQAnfMaAHCRyvy:nBcAPWEwVAkIiSPhwwpkaAHCIa
MD5:	9E5E954BC0E625A69A0A430E80DCF724
SHA1:	C29C1F37A2148B50A343DB1A4AA9EB0512F80749
SHA-256:	A46372B05CE9F40F5D5A775C90D7AA60687CD91AAA7374C499F0221229BF344E
SHA-512:	18A8277A872FB9E070A1980EEE3DDD096ED0BBA755DB9B57409983C1D5A860E9CBD3B67E66FF47852FE12324B84D4984E2F13859F65FABE2FF175725898F1B67
Malicious:	false
Preview:	#..# Load the Java Access Bridge class into the JVM..#..#assistive_technologies=com.sun.java.accessibility.AccessBridge..#screen_magnifier_present=true....

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\calendars.properties

Download File

Process:	C:\Users\Public\123.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1438
Entropy (8bit):	5.214662998532387
Encrypted:	false
SSDEEP:	24:QVDpdQYHLOVhl86bePCkHUMCLC9TFcgg+DR+Oby:MQ4LOVh2WGfUMCLC9Zcgg2Ru
MD5:	92BA2D87915E6F7F58D43344DF07E1A6
SHA1:	872BC54E53377AAC7C7616196BCCE1DB6A3F0477
SHA-256:	68F0CF30429A42A6FE78B1DE91970E5C78FD03D1599BEB080C1C196D5C59E4C0
SHA-512:	A964E2CEB4D601FAF28ECF13FB11777B70708C21CF9EA23721E462B6E911051108B8A42EBF6447FA49CB61D7FA2D79475F50EE791F1121616371E2B02FAB71B6
Malicious:	false
Preview:	# Copyright (c) 2005, 2013, Oracle and/or its affiliates. All rights reserved...# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms...#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#....#..# Japanese imperial calendar..#..# Meiji since 1868-01-01 00:00:00 local time (Gregorian)..# Taisho since 1912-07-30 00:00:00 local time (Gregorian)..# Showa since 1926-12-25 00:00:00 local time (Gregorian)..# Heisei since 1989-01-08 00:00:00 local time (Gregorian)..calendar.japanese.type: LocalGregorianCalendar..calendar.japanese.eras: \...name=Meiji,abbr=M,since=-3218832000000; \...name=Taisho,abbr=T,since=-1812153600000; \...name=Showa,abbr=S,since=-1357603200000; \...name=Heisei,abbr=H,since=600220800000....#..# Taiwanese calendar..# Minguo since 1911-01-01 00:00:00 local time (Gregorian)..calendar.taiwanese.type: LocalGregorianCalendar..calendar.taiwanese.eras: \...name=MinGuo,since=-1830384000000....#..# Thai Buddhist calendar..# Buddhist Era since -5

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\charsets.jar

Download File

Process:	C:\Users\Public\123.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	3091908
Entropy (8bit):	6.633254981822853
Encrypted:	false
SSDEEP:	49152:puZi4j4TQkgaSOHEhjy2twRYEc1sJzlbguMuD:puZiW4smxGocuJlbgq
MD5:	0B3923ABB0D48FDAE7A2306717967B39
SHA1:	0882294FFEC2769023AA36FF9CC53562F8E26020
SHA-256:	E88AEC2A49F07CAC9471D9E4C113FA189600B57245685814D043C20EA8A8B471
SHA-512:	CF622081B290140CE8419B30FB25442F7204C9A37E1490030A4D656F66C509946F48C50CC7794DA51007EFB202805605FE3C2AC3534D63FBF928EA35CE16A040
Malicious:	false
Preview:	PK........s..H................META-INF/....PK........s..H<:S1D...D.......META-INF/MANIFEST.MFManifest-Version: 1.0..Created-By: 1.7.0_07 (Oracle Corporation)....PK...........HUi..............sun/nio/cs/ext/Big5.class.......4."..........t....t............................................................................................................................................................................................................................................................................................................................................................................~.........b2cSBStr...Ljava/lang/String;...ConstantValue...b2cStr...[Ljava/lang/String;...b2c...[[C...b2cSB...[C...b2cInitialized...Z...c2b...c2bIndex...c2bInitialized...<init>...()V...Code...LineNumberTable...historicalName...()Ljava/lang/String;...contains...(Ljava/nio/charset/Charset;)Z...StackMapTable...newDecoder..#()Ljava/nio/charset/CharsetDecoder;...newEncoder..#()Ljava/nio/charset/Ch

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\classlist

Download File

Process:	C:\Users\Public\123.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	84355
Entropy (8bit):	4.927199323446014
Encrypted:	false
SSDEEP:	1536:4X/nxfn5rxLyMznYolTzlff5OK3COHoHNG5rb/cxNwmCX1g86K2oWdAqNqc+KMjD:qxn5rxLyMzbf5OK3CJNG51g86A
MD5:	7FC71A62D85CCF12996680A4080AA44E
SHA1:	199DCCAA94E9129A3649A09F8667B552803E1D0E
SHA-256:	01FE24232D0DBEFE339F88C44A3FD3D99FF0E17AE03926CCF90B835332F5F89C
SHA-512:	B0B9B486223CF79CCF9346AAF5C1CA0F9588247A00C826AA9F3D366B7E2EF905AF4D179787DCB02B32870500FD63899538CF6FAFCDD9B573799B255F658CEB1D
Malicious:	false
Preview:	java/lang/Object..java/lang/String..java/io/Serializable..java/lang/Comparable..java/lang/CharSequence..java/lang/Class..java/lang/reflect/GenericDeclaration..java/lang/reflect/AnnotatedElement..java/lang/reflect/Type..java/lang/Cloneable..java/lang/ClassLoader..java/lang/System..java/lang/Throwable..java/lang/Error..java/lang/ThreadDeath..java/lang/Exception..java/lang/RuntimeException..java/lang/SecurityManager..java/security/ProtectionDomain..java/security/AccessControlContext..java/security/SecureClassLoader..java/lang/ClassNotFoundException..java/lang/ReflectiveOperationException..java/lang/NoClassDefFoundError..java/lang/LinkageError..java/lang/ClassCastException..java/lang/ArrayStoreException..java/lang/VirtualMachineError..java/lang/OutOfMemoryError..java/lang/StackOverflowError..java/lang/IllegalMonitorStateException..java/lang/ref/Reference..java/lang/ref/SoftReference..java/lang/ref/WeakReference..java/lang/ref/FinalReference..java/lang/ref/PhantomReference..sun/misc/Cleaner

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\cmm\CIEXYZ.pf

Download File

Process:	C:\Users\Public\123.exe
File Type:	Sun KCMS color profile 2.0, type KCMS, XYZ/XYZ-spac device, 51236 bytes, 2-12-1997 18:50:04, dependently, PCS X=0xf6b3 Z=0xd2f8 "XYZ to XYZ Identity Profile"
Category:	dropped
Size (bytes):	51236
Entropy (8bit):	7.226972359973779
Encrypted:	false
SSDEEP:	1536:2Qnt0y7xFNksbeCqY39JJ8GmaNo68GmaNo68GmaNoW:JOy7xXjtqYNfHxNo6HxNo6HxNoW
MD5:	10F23396E21454E6BDFB0DB2D124DB85
SHA1:	B7779924C70554647B87C2A86159CA7781E929F8
SHA-256:	207D748A76C10E5FA10EC7D0494E31AB72F2BACAB591371F2E9653961321FE9C
SHA-512:	F5C5F9FC3C4A940D684297493902FD46F6AA5248D2B74914CA5A688F0BAD682831F6060E2264326D2ECB1F3544831EB1FA029499D1500EA4BFE3B97567FE8444
Malicious:	false
Preview:	...$KCMS....spacXYZ XYZ .........2..acspSUNW....KODA.ODA............................................................................A2B0.......4B2A0.......4cprt.......Gwtpt...T....desc...h....K070........K071........mft2................................................................................................................ !!""##$$%%&&''(())++,,--..//00112233445566778899::;;<<==>>??@@AABBCCDDEEFFGGHHIIJJKKLLMMNNOOPPQQRRSSTTUUVVWWXXYYZZ[[\\]]^^__``aabbccddeeffgghhiijjkkllmmnnooppqqrrssttuuvvwwxxyyzz{{\|\|}}~~.................................................................................................................................................................................................................................................................................................................................. !!""##$$%%&&''(())++,,--..//00112233445566778899::;;<<==>>??@@AABBCCDDEEFFGGHHIIJJKKLLMMNNOOPPQQRRSSTTUUVVWWXXYYZZ[[\\]]^^__``aabbccddeeffgghhiijjkkllmm

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\cmm\GRAY.pf

Download File

Process:	C:\Users\Public\123.exe
File Type:	Sun KCMS color profile 2.0, type KCMS, GRAY/XYZ-mntr device, KODA/GRAY model, 632 bytes, 27-7-95 17:30:15, embedded, relative colorimetric, PCS Z=0xd32b "KODAK Grayscale Conversion - Gamma 1.0"
Category:	dropped
Size (bytes):	632
Entropy (8bit):	3.7843698642539243
Encrypted:	false
SSDEEP:	12:51AP3fJgXQ531yqQac/lkgz42WlHlYujlOl9Fhl:vA2XQCqpUlkgzulHiXl3hl
MD5:	1002F18FC4916F83E0FC7E33DCC1FA09
SHA1:	27F93961D66B8230D0CDB8B166BC8B4153D5BC2D
SHA-256:	081CAAC386D968ADD4C2D722776E259380DCF78A306E14CC790B040AB876D424
SHA-512:	334D932D395B46DFC619576B391F2ADC2617E345AFF032B592C25E333E853735DA8B286EF7542EB19059CDE8215CDCEA147A3419ED56BDD6006CA9918D0618E1
Malicious:	false
Preview:	...xKCMS....mntrGRAYXYZ ._..........acspSUNW....KODAGRAY.......................+....................................................cprt.......?desc........dmnd.......`wtpt........kTRC........dmdd.......dtext....COPYRIGHT (c) 1997 Eastman Kodak, All rights reserved...desc.......'KODAK Grayscale Conversion - Gamma 1.0..................@...............~.......................~.......~..............desc........KODAK..................@..................................................,...,....XYZ ...............+curv............desc........Grayscale..................@..................................................,...,....

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\cmm\LINEAR_RGB.pf

Download File

Process:	C:\Users\Public\123.exe
File Type:	color profile 2.0, type KCMS, RGB/XYZ-mntr device by KODK, 1044 bytes, 2-2-1998, PCS Z=0xd32c "linear sRGB"
Category:	dropped
Size (bytes):	1044
Entropy (8bit):	6.510788634170065
Encrypted:	false
SSDEEP:	6:zwuau/7De0/q98EAsBIMD/WvaKIV4R0/lCAEdD0WlV9AEdwKKt/n3knR3lfR/NHD:zw7ePB/rEAsBIkVuUlAYKu/nUnKw
MD5:	A387B65159C9887265BABDEF9CA8DAE5
SHA1:	7913274C2F73BAFCF888F09FF60990B100214EDE
SHA-256:	712036AA1951427D42E3E190E714F420CA8C2DD97EF01FCD0675EE54B920DB46
SHA-512:	359D9B57215855F6794E47026C06036B93710998205D0817C6E602B2A24DAEB92537C388F129407461FC60180198F02A236AEB349A17430ED7AC85A1E5F71350
Malicious:	false
Preview:	....KCMS....mntrRGB XYZ ............acsp........KODK...........................,KODK................................................cprt.......Hdesc...8....rXYZ........gXYZ........bXYZ........rTRC........gTRC........bTRC........wtpt........text....Copyright (c) Eastman Kodak Company, 1998, all rights reserved..desc........linear sRGB............l.i.n.e.a.r. .s.R.G.B.....linear sRGB........................................................XYZ ......m...6.....XYZ ......e........!XYZ ......#B...^...Kcurv........................................................................ !!""##$$%%&&''(())**++,,--..//00112233445566778899::;;<<==>>??@@AABBCCDDEEFFGGHHIIJJKKLLMMNNOOPPQQRRSSTTUUVVWWXXYYZZ[[\\]]^^__``aabbccddeeffgghhiijjkkllmmnnooppqqrrssttuuvvwwxxyyzz{{\|\|}}~~..........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\cmm\PYCC.pf

Download File

Process:	C:\Users\Public\123.exe
File Type:	Sun KCMS color profile 2.0, type KCMS, 3CLR/Lab-spac device, 274474 bytes, 6-11-1996 7:50:04, PCS X=0xf6b3 Z=0xd2f8 "Std Photo YCC Print"
Category:	dropped
Size (bytes):	274474
Entropy (8bit):	7.843290819622709
Encrypted:	false
SSDEEP:	6144:nJleRNRyAnAqNaADEJHeeeeevoAuaiqwV6sg0pUjRVgYgI:nJleRNRpN0j3qhjRC9I
MD5:	24B9DEE2469F9CC8EC39D5BDB3901500
SHA1:	4F7EED05B8F0EEA7BCDC8F8F7AAEB1925CE7B144
SHA-256:	48122294B5C08C69B7FE1DB28904969DCB6EDC9AA5076E3F8768BF48B76204D0
SHA-512:	D23CE2623DE400216D249602486F21F66398B75196E80E447143D058A07438919A78AE0ED2DDF8E80D20BD70A635D51C9FB300E9F08A4751E00CD21883B88693
Malicious:	false
Preview:	..0KCMS....spac3CLRLab .........2..acspSUNW....KODAnone............................................................................A2B0... ...4B2A0...T..f4cprt..-....Gdmnd..-....ndmdd...@...zwtpt........desc.......nK013../@....K019../L....K030../.....K031..0.....K070..0.....K071..0 ....mft2.....................................................K.S.8.....l.....0...3.........U.. .!h".$.%\&.'.)5y+.,..5/o0.1.3.4E5v6.7.8.:;S<z=.>.?.A.B,CLDkE.F.G.H.I.K.L!M7NLO`PsQ.R.S.T.U.V.W.X.Y.[.\.].^._%`,a2b8c=dAeEfHgJhLiMjMkMlLmKnIoFpCq@r;s7t1u,v%w.x.y.z.z.{.\|.}.~...............p.b.S.C.3.#..............~.j.U.@.+.............t.\.C............r.W.;...........p.R.3..........w.V.6.........l.J.'........v.R.-.......t.N.(.......f.?........v.N.%........U.+.......U.......z.N."......n.@.......Z.+......o.@.........P. .......\.+.......d.1...........................z.p.f.[.Q.G.=.3.). ........................ .!.".#.$.%.&{'s(k)d]+U,N-G.@/9021,2%3.4.5.6.7.8.8.9.:.;.<.=.>.?.@.A.B.C.D.E.F.

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\cmm\sRGB.pf

Download File

Process:	C:\Users\Public\123.exe
File Type:	Microsoft color profile 2.1, type Lino, RGB/XYZ-mntr device, IEC/sRGB model by HP, 3144 bytes, 9-2-1998 6:49:00 "sRGB IEC61966-2.1"
Category:	dropped
Size (bytes):	3144
Entropy (8bit):	7.026867070945169
Encrypted:	false
SSDEEP:	48:+FflsXlf/lulel4wlwx+6MjnNsvIYWiR5QkyTJbZPHXZ9u6gbVwyKzJgWjU:aN26MT0D5MdtbZPAVwzV0
MD5:	1D3FDA2EDB4A89AB60A23C5F7C7D81DD
SHA1:	9EAEA0911D89D63E39E95F2E2116EAEC7E0BB91E
SHA-256:	2B3AA1645779A9E634744FAF9B01E9102B0C9B88FD6DECED7934DF86B949AF7E
SHA-512:	16AAE81ACF757036634B40FB8B638D3EBA89A0906C7F95BD915BC3579E3BE38C7549EE4CD3F344EF0A17834FF041F875B9370230042D20B377C562952C47509B
Malicious:	false
Preview:	...HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Viewing Condition in IEC61966-2.1...........,Reference Viewing Condition in IEC61966-2.1..........................view.........._.....

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\content-types.properties

Download File

Process:	C:\Users\Public\123.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5824
Entropy (8bit):	5.074440246603207
Encrypted:	false
SSDEEP:	96:6M5VfH+uEMmPDkZeujdJfZUB8BB/+PhPXsOQ71GAXf5lZuU1EbWF7Ycx/AQ12a8T:6M6p4ZeWd1ZUB8BBGPhPXsOQ71GAXBly
MD5:	95AE170D90764B3F5E68C72E8C518DDC
SHA1:	1939B699D16A5DB3E3F905466222099D7C29285A
SHA-256:	A2B31E9CBCEAB296A5E1CF056EFD953CED23B888CD929B0BBE6EB6B53D2BF861
SHA-512:	87E970BEAC8141C757D622FC8B6D84FE173EA4B134AFD8E2F979714C1110C3D92F3CE5F2B9DC74804DD37D13AB2A0EDF0FCA242F61CF8ED065AE81B7331F8816
Malicious:	false
Preview:	#sun.net.www MIME content-types table..#..# Property fields:..#..# <description> ::= 'description' '=' <descriptive string>..# <extensions> ::= 'file_extensions' '=' <comma-delimited list, include '.'>..# <image> ::= 'icon' '=' <filename of icon image>..# <action> ::= 'browser' \| 'application' \| 'save' \| 'unknown'..# <application> ::= 'application' '=' <command line template>..#....#..# The "we don't know anything about this data" type(s)...# Used internally to mark unrecognized types...#..content/unknown: description=Unknown Content..unknown/unknown: description=Unknown Data Type....#..# The template we should use for temporary files when launching an application..# to view a document of given type...#..temp.file.template: c:\\temp\\%s....#..# The "real" types...#..application/octet-stream: \...description=Generic Binary Stream;\...file_extensions=.saveme,.dump,.hqx,.arc,.obj,.lib,.bin,.exe,.zip,.gz....application/oda: \...description=ODA Document;\...file_extens

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\currency.data

Download File

Process:	C:\Users\Public\123.exe
File Type:	data
Category:	dropped
Size (bytes):	4122
Entropy (8bit):	3.2585384283455134
Encrypted:	false
SSDEEP:	48:BlWxFFGFSupi94blATFxjGph5vLC6/w37ZXQTbVm/eVzOBJ:BlWJEi94blAT+ph5vLkApmGqr
MD5:	F6258230B51220609A60AA6BA70D68F3
SHA1:	B5B95DD1DDCD3A433DB14976E3B7F92664043536
SHA-256:	22458853DA2415F7775652A7F57BB6665F83A9AE9FB8BD3CF05E29AAC24C8441
SHA-512:	B2DFCFDEBF9596F2BB05F021A24335F1EB2A094DCA02B2D7DD1B7C871D5EECDA7D50DA7943B9F85EDB5E92D9BE6B6ADFD24673CE816DF3960E4D68C7F894563F
Malicious:	false
Preview:	CurD..........................@C..,M...................... K...C..PF..4@...........R...........C......TF...........M..DL...C.......S..........<M...c...................C...C...A..........hK...C...M.......... O......8...PC...C..........@E...............E..............`.......pX...O...........B...C.......O...D..............,J..........................................@J..............XO..........................................0C...........................O...........................................M.......A...............................................................C...O...................................................................O..........TK...........R...O..............8C...........................P.................. C..............................................`C..........PK...............J......0F..pE...................................Q...............................R.......Q...........c...Q...................................................................................C

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\deploy.jar

Download File

Process:	C:\Users\Public\123.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	2282861
Entropy (8bit):	7.951223313727943
Encrypted:	false
SSDEEP:	49152:ABSxAmHHJwEu4l3Dyz7oQHeNHJJ2aAvfZc:ABEtHHaEuI3Dy3oQH2pFAvW
MD5:	2388C4C8D5F95E0379A8997C7C2492F4
SHA1:	906BF87EB1D8881ABADBF93A3C4BBA7887CA2A01
SHA-256:	A1FD508EACF76645EB0885B243B5DD14239F1E039E8B53ED038226DF91A30539
SHA-512:	2CCE11A5F97DF842964B55408FCF1EC84C0CD561E664ABA3A51275EAFE59D7C920FCFD954C527DA4D53ACB191200CC64BF8150A33BCB9B038F36ADB2CC69B1A1
Malicious:	false
Preview:	PK...........H................META-INF/....PK...........H...7Z...e.......META-INF/MANIFEST.MF.M..LK-...K-...R0.3..r.C.q,HL.HU...%...y...R.KRSt....L....u....4....sR......K..5y.x..PK...........H................com/PK...........H................com/oracle/PK...........H................com/oracle/deploy/PK...........H................com/oracle/deploy/update/PK...........H................com/sun/PK...........H................com/sun/applet2/PK...........H................com/sun/applet2/preloader/PK...........H............ ...com/sun/applet2/preloader/event/PK...........H................com/sun/deploy/PK...........H................com/sun/deploy/appcontext/PK...........H................com/sun/deploy/association/PK...........H............#...com/sun/deploy/association/utility/PK...........H................com/sun/deploy/cache/PK...........H................com/sun/deploy/config/PK...........H................com/sun/deploy/jardiff/PK...........H................com/sun/deploy/model/PK.....

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\deploy\ffjcext.zip

Download File

Process:	C:\Users\Public\123.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	14156
Entropy (8bit):	5.649187440261259
Encrypted:	false
SSDEEP:	48:E84SHTDIbZI+R9ufdITe3MPu20DguN9P5YOinvYrJJ0JKP/U8HtK8NJO8lJi8VJb:kld6uQZ9P5dTC7IjZUkPmpaemFqKs8n
MD5:	91052ADB799AEF68EA76931997C40CE4
SHA1:	19255B8E335C22A171C26148099191708C99EE7A
SHA-256:	61D1382375238F90E2E4EE2AF985D978F1409E01B38080E710DF4ACB2897E63B
SHA-512:	39BAA49A1CEF533E5D3FFF1A86BC72CB346A6BF1928A9D8B505EBA09A4AB1506400234DE78BDFD925821F0A690B8887BD004A18CC64337DEB666CC2509DEE5DA
Malicious:	false
Preview:	PK........$..H............'...{CAFEEFAC-0018-0000-0101-ABCDEFFEDCBA}/UT....GjW.GjWux.............PK........#..H................{CAFEEFAC-0018-0000-0101-ABCDEFFEDCBA}/chrome/UT....GjW.GjWux.............PK........#..H............6...{CAFEEFAC-0018-0000-0101-ABCDEFFEDCBA}/chrome/content/UT....GjW.GjWux.............PK........#..H............>...{CAFEEFAC-0018-0000-0101-ABCDEFFEDCBA}/chrome/content/ffjcext/UT....GjW.GjWux.............PK........#..H...V........H...{CAFEEFAC-0018-0000-0101-ABCDEFFEDCBA}/chrome/content/ffjcext/ffjcext.jsUT....GjW.GjWux.............const gJavaConsole1_8_0_101 = {...id.: "javaconsole1.8.0_101",...mimeType: "application/x-java-applet;jpi-version=1.8.0_101",...install.: function() {...window.addEventListener("load",this.init,false);..},...init.: function() { ...if (navigator.mimeTypes[gJavaConsole1_8_0_101.mimeType]) {....var toolsPopup = document.getElementById("menu_ToolsPopup");.....toolsPopup.addEventListener("popupshowing",gJavaConsole1_8_0_101.enable,false)

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\deploy\messages.properties

Download File

Process:	C:\Users\Public\123.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2917
Entropy (8bit):	4.838706790124659
Encrypted:	false
SSDEEP:	48:KaDMJ9TmsHDmDDCDP2un8YzgKe1E13Tstub22tTeF/Qi/WRtAXikTzgaENZzT3JI:KaD+9TmAe29vBotubbt2Oz+ENlbJI
MD5:	2EB9117D147BAA0578E4000DA9B29E12
SHA1:	3D297ECF3D280D4AA3D1423E885994495243F326
SHA-256:	B8D9C69FF7F4832A9B365D4A43CF66DFF9847051752B13EEDF024CAA9C1EF46B
SHA-512:	C3F7730767941B3C8F6F53D4686E9F898D1907D978F6D1FA35BA02C3FCD8306335406A5F9ABAA844F27F7AFD9E548810BECB9EC3E6B84888EA5EAC57B6ED6FDB
Malicious:	false
Preview:	#..# Copyright (c) 2004, 2011, Oracle and/or its affiliates. All rights reserved...# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms...#....error.internal.badmsg=internal error, unknown message..error.badinst.nojre=Bad installation. No JRE found in configuration file..error.launch.execv=Error encountered while invoking Java Web Start (execv)..error.launch.sysexec=Error encountered while invoking Java Web Start (SysExec) ..error.listener.failed=Splash: sysCreateListenerSocket failed..error.accept.failed=Splash: accept failed..error.recv.failed=Splash: recv failed..error.invalid.port=Splash: didn't revive a valid port..error.read=Read past end of buffer..error.xmlparsing=XML Parsing error: wrong kind of token found..error.splash.exit=Java Web Start splash screen process exiting .....\n..# "Last WinSock Error" means the error message for the last operation that failed...error.winsock=\tLast WinSock Error: ..error.winsock.load=Couldn't load winsock.dll..error.winsock.start

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\deploy\messages_de.properties

Download File

Process:	C:\Users\Public\123.exe
File Type:	ASCII text, with very long lines (1345), with CRLF line terminators
Category:	dropped
Size (bytes):	3338
Entropy (8bit):	4.919780187496773
Encrypted:	false
SSDEEP:	48:WvaqyL1nlrDtzh5+VN9JrnjXyv6jq/YgKe1h/KZkCUdr5pAvA1t2CPTOsdIamy:txrj5Snk6+wuir25pAvAv2ITOsd9
MD5:	FF9CFEE1ACFCD927253A6E35673F1BB7
SHA1:	957E6609A1AF6D06A45A6F7B278BE7625807B909
SHA-256:	E130FBD5FA378A380F46F42981F2C97BC152059C27120204AB4DA47079D31513
SHA-512:	F42601092436D7AF30CCD81126185232D9D643B195D3D4619AEC451E3E2A60E33E6378E770DD1A4CDF7AB20CB749371665A992CA73D2842A7102F3FB34B6B9EB
Malicious:	false
Preview:	#..# Copyright (c) 2004, 2013, Oracle and/or its affiliates. All rights reserved...# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms...#....error.internal.badmsg=interner Fehler, unbekannte Meldung..error.badinst.nojre=Ung\u00FCltige Installation. Keine JRE in Konfigurationsdatei gefunden..error.launch.execv=Fehler beim Aufrufen von Java Web Start (execv) aufgetreten..error.launch.sysexec=Fehler beim Aufrufen von Java Web Start (SysExec) aufgetreten..error.listener.failed=Startbildschirm: sysCreateListenerSocket nicht erfolgreich..error.accept.failed=Startbildschirm: accept nicht erfolgreich..error.recv.failed=Startbildschirm: recv nicht erfolgreich..error.invalid.port=Startbildschirm: Reaktivierung eines g\u00FCltigen Ports nicht m\u00F6glich..error.read=\u00DCber Pufferende hinaus gelesen..error.xmlparsing=XML-Parsefehler: Falscher Tokentyp gefunden..error.splash.exit=Prozess f\u00FCr Startbildschirm von Java Web Start wird beendet.....\n..# "Last WinSock Error" mean

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\deploy\messages_es.properties

Download File

Process:	C:\Users\Public\123.exe
File Type:	ASCII text, with very long lines (1475), with CRLF line terminators
Category:	dropped
Size (bytes):	3632
Entropy (8bit):	4.776451902180833
Encrypted:	false
SSDEEP:	96:KHelXJn5woLUosi30hrleaRSfvlBY0CQ1Z:KHelNTAxFtlE/71Z
MD5:	72BDAE07C5D619E5849A97ACC6A1090F
SHA1:	9FC8A7A29658AC23A30AB9D655117BB79D08DC3B
SHA-256:	821A3452ECB9F29BCEC16C0B39FB668C2CC30C7F7283B34BFC5400040723892B
SHA-512:	67F0D1D60012B5598864B68612AA488AF1B5876FF5F347CD98ABCF1E3C0D267CF0354D5085BF12B0A09C6EF124FD0117CD16FCC032DA2B195D45BAB19740BB78
Malicious:	false
Preview:	#..# Copyright (c) 2004, 2013, Oracle and/or its affiliates. All rights reserved...# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms...#....error.internal.badmsg=Error interno, mensaje desconocido..error.badinst.nojre=Instalaci\u00F3n incorrecta. No se ha encontrado JRE en el archivo de configuraci\u00F3n..error.launch.execv=Se ha encontrado un error al llamar a Java Web Start (execv)..error.launch.sysexec=Se ha encontrado un error al llamar a Java Web Start (SysExec) ..error.listener.failed=Pantalla de Presentaci\u00F3n: fallo de sysCreateListenerSocket..error.accept.failed=Pantalla de Presentaci\u00F3n: fallo de accept..error.recv.failed=Pantalla de Presentaci\u00F3n: fallo de recv..error.invalid.port=Pantalla de Presentaci\u00F3n: no se ha activado un puerto v\u00E1lido..error.read=Lectura m\u00E1s all\u00E1 del final del buffer..error.xmlparsing=Error de an\u00E1lisis de XML: se ha encontrado un tipo de token no v\u00E1lido..error.splash.exit=Saliendo del proceso d

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\deploy\messages_fr.properties

Download File

Process:	C:\Users\Public\123.exe
File Type:	ASCII text, with very long lines (1575), with CRLF line terminators
Category:	dropped
Size (bytes):	3441
Entropy (8bit):	4.832330268062187
Encrypted:	false
SSDEEP:	48:KE2CXpRLJDNXQC6tNaEGBlu9hUv5//zEvDiwkISAyHgKe1p6KF/uoYuh1LNRtS0f:KERXlp6tN1VHq1Kt1S4x8Xi
MD5:	FFE3CC16616314296C3262B0A0E093CD
SHA1:	198DD1C6E6707C10AE74A1C42E8A91C429598F3B
SHA-256:	3941736BEF6A8E53D002B6B67ECE4793C2F3F34BCC1ECB271684EB3F73FC4103
SHA-512:	CD3A9329F405CA14E11CDBB74D467B31A31530CBF00537B16FB23AEBC6C07EB268E9624FDBC997AA0CF4852DAC288E1D011E2FC392D71E25DBDF52E359BA9D4E
Malicious:	false
Preview:	#..# Copyright (c) 2004, 2011, Oracle and/or its affiliates. All rights reserved...# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms...#....error.internal.badmsg=erreur interne, message inconnu..error.badinst.nojre=Installation incorrecte. JRE introuvable dans le fichier de configuration..error.launch.execv=Erreur lors de l'appel de Java Web Start (execv)..error.launch.sysexec=Erreur lors de l'appel de Java Web Start (SysExec) ..error.listener.failed=Accueil : \u00E9chec de sysCreateListenerSocket..error.accept.failed=Accueil : \u00E9chec d'accept..error.recv.failed=Accueil : \u00E9chec de recv..error.invalid.port=Accueil : impossible de r\u00E9activer un port valide..error.read=Lecture apr\u00E8s la fin de tampon..error.xmlparsing=Erreur d'analyse XML : type incorrect de jeton..error.splash.exit=Le processus d'affichage de l'\u00E9cran d'accueil de Java Web Start est en cours de fermeture...\n..# "Last WinSock Error" means the error message for the last operation that

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\deploy\messages_it.properties

Download File

Process:	C:\Users\Public\123.exe
File Type:	ASCII text, with very long lines (1392), with CRLF line terminators
Category:	dropped
Size (bytes):	3255
Entropy (8bit):	4.7050139579578145
Encrypted:	false
SSDEEP:	48:KTi+qOaVUVVMsD/B0FN5+eADELDHxhdpHgKe1uo265eLaqMQ6URhmwgFs+ur60:KJBa2VtzeDLDRhd5A26+7RhZgR0
MD5:	BF5E5310B2DCF8E8B3697B358AD4446D
SHA1:	C746AC1F46F607FA8F971BEA2B6853746A4FB28D
SHA-256:	CC9AD73957535011EE2376C23DE2C2597F877ACEBA9173E822EE79AAD3C4E9E6
SHA-512:	B6C61D38B0ACC427B9B2F4C19DABD7EACBE8EEA6B973FD31B3555C4C5B3FFAF1CA036B730359346F57223B44CCE79E04A6D06BBC13C6F7DD26ED463776BB6DCC
Malicious:	false
Preview:	#..# Copyright (c) 2004, 2011, Oracle and/or its affiliates. All rights reserved...# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms...#....error.internal.badmsg=errore interno, messaggio sconosciuto..error.badinst.nojre=Installazione errata. Impossibile trovare il JRE nel file di configurazione..error.launch.execv=Errore durante la chiamata di Java Web Start (execv)..error.launch.sysexec=Errore durante la chiamata di Java Web Start (SysExec) ..error.listener.failed=Apertura: sysCreateListenerSocket non riuscito..error.accept.failed=Apertura: accept non riuscito..error.recv.failed=Apertura: recv non riuscito..error.invalid.port=Apertura: impossibile identificare una porta valida..error.read=Tentativo di lettura dopo la fine del buffer..error.xmlparsing=Errore durante l'analisi XML: trovato un tipo di token errato..error.splash.exit=Uscita dal processo di schermata iniziale di Java Web Start in corso...\n..# "Last WinSock Error" means the error message for the last oper

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\deploy\messages_ja.properties

Download File

Process:	C:\Users\Public\123.exe
File Type:	ASCII text, with very long lines (2924), with CRLF line terminators
Category:	dropped
Size (bytes):	6381
Entropy (8bit):	4.5983590678211135
Encrypted:	false
SSDEEP:	96:Mu7cepcgD8do+O2D+k8/RJFGQcHGqo72hzEflA44CAmIbIC3j5pN/o8woJe:PctgYqhTYzG2O
MD5:	D830FC76BDD1975010ECE4C5369DADF8
SHA1:	D8CC3F54325142EFA740026E2BC623AFE6F3ACB5
SHA-256:	11E886336BA51A9044AB1A87C60CEEE34C29BB724E06A16968D31531A7001064
SHA-512:	7B867A50A811FBD7FFDAD0B729CA4501E16386EE5C4940A4CF9A805767CC0D10F7E3BDFD6A60204D79292D778D93E3BD915368AC0E9453BBB1010ADFD9655F0F
Malicious:	false
Preview:	#..# Copyright (c) 2004, 2013, Oracle and/or its affiliates. All rights reserved...# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms...#....error.internal.badmsg=\u5185\u90E8\u30A8\u30E9\u30FC\u3001\u4E0D\u660E\u306A\u30E1\u30C3\u30BB\u30FC\u30B8..error.badinst.nojre=\u30A4\u30F3\u30B9\u30C8\u30FC\u30EB\u304C\u6B63\u3057\u304F\u3042\u308A\u307E\u305B\u3093\u3002\u69CB\u6210\u30D5\u30A1\u30A4\u30EB\u5185\u306BJRE\u304C\u3042\u308A\u307E\u305B\u3093..error.launch.execv=Java Web Start\u306E\u547C\u51FA\u3057\u4E2D\u306B\u30A8\u30E9\u30FC\u304C\u767A\u751F\u3057\u307E\u3057\u305F(execv)..error.launch.sysexec=Java Web Start\u306E\u547C\u51FA\u3057\u4E2D\u306B\u30A8\u30E9\u30FC\u304C\u767A\u751F\u3057\u307E\u3057\u305F(SysExec) ..error.listener.failed=\u30B9\u30D7\u30E9\u30C3\u30B7\u30E5: sysCreateListenerSocket\u306B\u5931\u6557\u3057\u307E\u3057\u305F..error.accept.failed=\u30B9\u30D7\u30E9\u30C3\u30B7\u30E5: accept\u306B\u5931\u6557\u3057\u307E\u3057\u305F..error.recv.fai

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\deploy\messages_ko.properties

Download File

Process:	C:\Users\Public\123.exe
File Type:	ASCII text, with very long lines (2601), with CRLF line terminators
Category:	dropped
Size (bytes):	5744
Entropy (8bit):	4.781504394194986
Encrypted:	false
SSDEEP:	96:GhymCk3kjLqgz9RkfrsEW/p9M32i0HkZr+ywc8b8+/moD7yct070DL70Dm:Dm5kLfIErMbT/44in
MD5:	64DE22212EE92F29BCA3ACED72737254
SHA1:	C4DBC247043578CCF9CD8DAB652D096703D5B26E
SHA-256:	292696C94D5FD0BF2FF4AF9E4D363BFCBE888D2E65BD18A20CF71081FB1C9B0D
SHA-512:	CA33C75B66D8B5316B1C3ED41A9A14DD8611A3BB9B26EFDC7F468250696D515CF1E966831975C9ABDC33E9A1C59167FE79BA547592D2A04997E1342433E7B628
Malicious:	false
Preview:	#..# Copyright (c) 2004, 2016, Oracle and/or its affiliates. All rights reserved...# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms...#....error.internal.badmsg=\uB0B4\uBD80 \uC624\uB958\uAC00 \uBC1C\uC0DD\uD588\uC2B5\uB2C8\uB2E4. \uC54C \uC218 \uC5C6\uB294 \uBA54\uC2DC\uC9C0\uC785\uB2C8\uB2E4...error.badinst.nojre=\uC124\uCE58\uAC00 \uC798\uBABB\uB418\uC5C8\uC2B5\uB2C8\uB2E4. \uAD6C\uC131 \uD30C\uC77C\uC5D0\uC11C JRE\uB97C \uCC3E\uC744 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4...error.launch.execv=Java Web Start(execv)\uB97C \uD638\uCD9C\uD558\uB294 \uC911 \uC624\uB958\uAC00 \uBC1C\uC0DD\uD588\uC2B5\uB2C8\uB2E4...error.launch.sysexec=Java Web Start(SysExec)\uB97C \uD638\uCD9C\uD558\uB294 \uC911 \uC624\uB958\uAC00 \uBC1C\uC0DD\uD588\uC2B5\uB2C8\uB2E4. ..error.listener.failed=\uC2A4\uD50C\uB798\uC2DC: sysCreateListenerSocket\uC744 \uC2E4\uD328\uD588\uC2B5\uB2C8\uB2E4...error.accept.failed=\uC2A4\uD50C\uB798\uC2DC: \uC2B9\uC778\uC744 \uC2E4\uD328\uD588\uC2B5\uB2C8\uB2E4...error.r

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\deploy\messages_pt_BR.properties

Download File

Process:	C:\Users\Public\123.exe
File Type:	ASCII text, with very long lines (1319), with CRLF line terminators
Category:	dropped
Size (bytes):	3317
Entropy (8bit):	4.869662880084367
Encrypted:	false
SSDEEP:	48:3c6BeKTDcUsLYg9tStwmx+supWBxKy0HgKe1u6K0NCMc6MTNTjtA7NZdlw7ZHAW:3c6fbEf1mxPuUBxKy4va+mZdlw7Z7
MD5:	4078691AB22C4F0664856BE0C024A52F
SHA1:	6247FC05DE429F65DC4E1356C4715DC51F43B98F
SHA-256:	6869B27B12B99C9D169B3E018284BE0F7631DBDF2DDD5F4EA5B1A458736FDFDF
SHA-512:	BB02765F69E23C732C790EB994800C83BB8EFE7FF8CE0BCDC475EC5A29CEF5A33A5513AB1A7DC9F0F066B807A0980C41EC0037710873A32BD2952DBED79D24CA
Malicious:	false
Preview:	#..# Copyright (c) 2004, 2016, Oracle and/or its affiliates. All rights reserved...# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms...#....error.internal.badmsg=erro interno, mensagem desconhecida..error.badinst.nojre=Instala\u00E7\u00E3o incorreta. Nenhum JRE encontrado no arquivo de configura\u00E7\u00E3o..error.launch.execv=Erro encontrado ao chamar Java Web Start (execv)..error.launch.sysexec=Erro encontrado ao chamar Java Web Start (SysExec) ..error.listener.failed=Tela Inicial: falha em sysCreateListenerSocket..error.accept.failed=Tela Inicial: falha na fun\u00E7\u00E3o accept..error.recv.failed=Tela Inicial: falha na fun\u00E7\u00E3o recv..error.invalid.port=Tela Inicial: n\u00E3o reativou uma porta v\u00E1lida..error.read=Ler ap\u00F3s o final do buffer..error.xmlparsing=Erro durante o parsing de XML: tipo incorreto de token encontrado..error.splash.exit=Saindo do processamento da tela inicial do Java Web .....\n..# "Last WinSock Error" means the error message

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\deploy\messages_sv.properties

Download File

Process:	C:\Users\Public\123.exe
File Type:	ASCII text, with very long lines (1386), with CRLF line terminators
Category:	dropped
Size (bytes):	3441
Entropy (8bit):	4.927824210480987
Encrypted:	false
SSDEEP:	96:KYD1QNsQZ/lmo8ZuLgdBGpv3JRJ/7coh91XlK7Q/vm2QAfO:9D1+sCmapce1KGm2QIO
MD5:	81BBDEA4DC9803A6EB78CE7D5CA018ED
SHA1:	9AAF012276AD89CE7273CF5F0BE4C95B72D906AB
SHA-256:	565B8FF1F31784378884D9D7468FFDFDDA5B001ACB5BB393A5006AC19BE4E67A
SHA-512:	310017DD27C91C492188737494DA04CAB241D0BF4E91326AFB4A3F98CBFF78A6C0BBC14EC7E883597E9D506FAA80BA4E9A25B5F46BFD2543850323061E829A84
Malicious:	false
Preview:	#..# Copyright (c) 2004, 2011, Oracle and/or its affiliates. All rights reserved...# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms...#....error.internal.badmsg=internt fel, ok\u00E4nt meddelande..error.badinst.nojre=Felaktig installation. Ingen JRE har hittats i konfigurationsfilen..error.launch.execv=Ett fel intr\u00E4ffade under starten av Java Web Start (execv)..error.launch.sysexec=Ett fel intr\u00E4ffade under starten av Java Web Start (SysExec) ..error.listener.failed=V\u00E4lkomstsk\u00E4rm: sysCreateListenerSocket utf\u00F6rdes inte..error.accept.failed=V\u00E4lkomstsk\u00E4rm: kunde inte accepteras..error.recv.failed=V\u00E4lkomstsk\u00E4rm: kunde inte mottaga..error.invalid.port=V\u00E4lkomstsk\u00E4rm: \u00E5terskapade inte en giltig port..error.read=L\u00E4ste f\u00F6rbi slutet av bufferten..error.xmlparsing=XML-tolkningsfel: fel typ av igenk\u00E4nningstecken hittades..error.splash.exit=Java Web Start - v\u00E4lkomstsk\u00E4rmen avslutas .....\n..# "Last

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\deploy\messages_zh_CN.properties

Download File

Process:	C:\Users\Public\123.exe
File Type:	ASCII text, with very long lines (1857), with CRLF line terminators
Category:	dropped
Size (bytes):	4104
Entropy (8bit):	5.04197285715923
Encrypted:	false
SSDEEP:	96:Me7R8zl0Zf4z3X4Gv2hEpeStEKADydYL1WfK0eSm91j7:1R8pOfWHJvOJT1WPtK1j7
MD5:	823D1F655440C3912DD1F965A23363FC
SHA1:	50B941A38B9C5F565F893E1E0824F7619F51185C
SHA-256:	86663DED105B77261C0556468A93BC8666A094B918299A61AF0A8E30F42019C7
SHA-512:	1EBF989D2121CF05FFC912B9B228C4D4523763EB1A689EC74568D811C88DCF11032FFC8007BB24DAF7D079B580662B77D94B4B8D71A2E891EF27979FF32CD727
Malicious:	false
Preview:	#..# Copyright (c) 2004, 2013, Oracle and/or its affiliates. All rights reserved...# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms...#....error.internal.badmsg=\u5185\u90E8\u9519\u8BEF, \u672A\u77E5\u6D88\u606F..error.badinst.nojre=\u9519\u8BEF\u5B89\u88C5\u3002\u914D\u7F6E\u6587\u4EF6\u4E2D\u627E\u4E0D\u5230 JRE..error.launch.execv=\u8C03\u7528 Java Web Start (execv) \u65F6\u9047\u5230\u9519\u8BEF..error.launch.sysexec=\u8C03\u7528 Java Web Start (SysExec) \u65F6\u9047\u5230\u9519\u8BEF..error.listener.failed=\u542F\u52A8\u5C4F\u5E55: sysCreateListenerSocket \u5931\u8D25..error.accept.failed=\u542F\u52A8\u5C4F\u5E55: \u63A5\u53D7\u5931\u8D25..error.recv.failed=\u542F\u52A8\u5C4F\u5E55: recv \u5931\u8D25..error.invalid.port=\u542F\u52A8\u5C4F\u5E55: \u672A\u6062\u590D\u6709\u6548\u7AEF\u53E3..error.read=\u8BFB\u53D6\u8D85\u51FA\u7F13\u51B2\u533A\u7ED3\u5C3E..error.xmlparsing=XML \u89E3\u6790\u9519\u8BEF: \u53D1\u73B0\u9519\u8BEF\u7684\u6807\u8BB0\u7C7B\u578B..error.s

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\deploy\messages_zh_HK.properties

Download File

Process:	C:\Users\Public\123.exe
File Type:	ASCII text, with very long lines (1729), with CRLF line terminators
Category:	dropped
Size (bytes):	3784
Entropy (8bit):	5.17620120701776
Encrypted:	false
SSDEEP:	96:wMWzQq8x9i7zO/JOFtUtQzy+gawZFomWdYQCfQ/ydQCyA:LWzQqms7S/JDtQcJoHWQaQ/6QCH
MD5:	4287D97616F708E0A258BE0141504BEB
SHA1:	5D2110CABBBC0F83A89AEC60A6B37F5F5AD3163E
SHA-256:	479DC754BD7BFF2C9C35D2E308B138EEF2A1A94CF4F0FC6CCD529DF02C877DC7
SHA-512:	F273F8D501C5D29422257733624B5193234635BD24B444874E38D8D823D728D935B176579D5D1203451C0CE377C57ED7EB3A9CE9ADCB3BB591024C3B7EE78DCD
Malicious:	false
Preview:	#..# Copyright (c) 2004, 2013, Oracle and/or its affiliates. All rights reserved...# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms...#....error.internal.badmsg=\u5167\u90E8\u932F\u8AA4\uFF0C\u4E0D\u660E\u7684\u8A0A\u606F..error.badinst.nojre=\u5B89\u88DD\u932F\u8AA4\u3002\u5728\u7D44\u614B\u6A94\u4E2D\u627E\u4E0D\u5230 JRE..error.launch.execv=\u547C\u53EB Java Web Start (execv) \u6642\u9047\u5230\u932F\u8AA4..error.launch.sysexec=\u547C\u53EB Java Web Start (SysExec) \u6642\u9047\u5230\u932F\u8AA4..error.listener.failed=Splash: sysCreateListenerSocket \u5931\u6557..error.accept.failed=Splash: \u63A5\u53D7\u5931\u6557..error.recv.failed=Splash: recv \u5931\u6557..error.invalid.port=Splash: \u6709\u6548\u7684\u9023\u63A5\u57E0\u5C1A\u672A\u56DE\u5FA9..error.read=\u8B80\u53D6\u8D85\u51FA\u7DE9\u885D\u5340\u7D50\u5C3E..error.xmlparsing=XML \u5256\u6790\u932F\u8AA4: \u627E\u5230\u932F\u8AA4\u7684\u8A18\u865F\u7A2E\u985E..error.splash.exit=Java Web Start \u9583\u73FE\u87A2

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\deploy\messages_zh_TW.properties

Download File

Process:	C:\Users\Public\123.exe
File Type:	ASCII text, with very long lines (1729), with CRLF line terminators
Category:	dropped
Size (bytes):	3784
Entropy (8bit):	5.17620120701776
Encrypted:	false
SSDEEP:	96:wMWzQq8x9i7zO/JOFtUtQzy+gawZFomWdYQCfQ/ydQCyA:LWzQqms7S/JDtQcJoHWQaQ/6QCH
MD5:	4287D97616F708E0A258BE0141504BEB
SHA1:	5D2110CABBBC0F83A89AEC60A6B37F5F5AD3163E
SHA-256:	479DC754BD7BFF2C9C35D2E308B138EEF2A1A94CF4F0FC6CCD529DF02C877DC7
SHA-512:	F273F8D501C5D29422257733624B5193234635BD24B444874E38D8D823D728D935B176579D5D1203451C0CE377C57ED7EB3A9CE9ADCB3BB591024C3B7EE78DCD
Malicious:	false
Preview:	#..# Copyright (c) 2004, 2013, Oracle and/or its affiliates. All rights reserved...# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms...#....error.internal.badmsg=\u5167\u90E8\u932F\u8AA4\uFF0C\u4E0D\u660E\u7684\u8A0A\u606F..error.badinst.nojre=\u5B89\u88DD\u932F\u8AA4\u3002\u5728\u7D44\u614B\u6A94\u4E2D\u627E\u4E0D\u5230 JRE..error.launch.execv=\u547C\u53EB Java Web Start (execv) \u6642\u9047\u5230\u932F\u8AA4..error.launch.sysexec=\u547C\u53EB Java Web Start (SysExec) \u6642\u9047\u5230\u932F\u8AA4..error.listener.failed=Splash: sysCreateListenerSocket \u5931\u6557..error.accept.failed=Splash: \u63A5\u53D7\u5931\u6557..error.recv.failed=Splash: recv \u5931\u6557..error.invalid.port=Splash: \u6709\u6548\u7684\u9023\u63A5\u57E0\u5C1A\u672A\u56DE\u5FA9..error.read=\u8B80\u53D6\u8D85\u51FA\u7DE9\u885D\u5340\u7D50\u5C3E..error.xmlparsing=XML \u5256\u6790\u932F\u8AA4: \u627E\u5230\u932F\u8AA4\u7684\u8A18\u865F\u7A2E\u985E..error.splash.exit=Java Web Start \u9583\u73FE\u87A2

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\deploy\splash.gif

Download File

Process:	C:\Users\Public\123.exe
File Type:	GIF image data, version 89a, 320 x 139
Category:	dropped
Size (bytes):	8590
Entropy (8bit):	7.910688771816331
Encrypted:	false
SSDEEP:	192:91m4OqvVyG+LMIcBc2qPjHmxJCCG/h97dIYhOX:9/OqdivcqzjH3tfDE
MD5:	249053609EAF5B17DDD42149FC24C469
SHA1:	20E7AEC75F6D036D504277542E507EB7DC24AAE8
SHA-256:	113B01304EBBF3CC729A5CA3452DDA2093BD8B3DDC2BA29E5E1C1605661F90BE
SHA-512:	9C04A20E2FA70E4BCFAC729E366A0802F6F5167EA49475C2157C8E2741C4E4B8452D14C75F67906359C12F1514F9FB7E9AF8E736392AC8434F0A5811F7DDE0CB
Malicious:	false
Preview:	GIF89a@................................................FFF...T..W..V..Is.Kv.W..W..U..Hr.P\|.O{.Mx.Gq.Jt.Fo.Fp.V..U..Gp.T..Lw.P\|.R..Q~.S..S..Nz.Lw.Hq.Ju.X..V..Lx.It.U..Hs.Ny.Nz.P}.R~.S..R~.R..Q}.Q}.My.Lv.It.O{.Ku.My.Oz.Gp.Gq.Hr.....................WWW.........Ry.uuu............i......ggg...]..................{..y..d..........Sz................s............i...............c............v.....X........r...........]........^........p.....z.........r..Y..l..m...............]................Mu........Qw.Nw.........v.....b..j.......V}.]........d.....k........v........Lu....S\|.U{.Oy................W........Lv.U..R}.....Nv.Gp.Nx.Ks....Jr....Hq......V~.T..S~.Z.....Gq.O{.......W..Qz.......Lw.Z.....T...........S~....Lt.Kv....V.................Fo.......!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="ht

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\deploy\splash@2x.gif

Download File

Process:	C:\Users\Public\123.exe
File Type:	GIF image data, version 89a, 640 x 278
Category:	dropped
Size (bytes):	15276
Entropy (8bit):	7.949850025334252
Encrypted:	false
SSDEEP:	192:onqkbSDLFgIBL0IgyZCE/oIuuemXclVO/HemZ8GbRdziHm6tIclW3ZYvvebtssZn:lKMLWkpgy8sdsnOmEyPLaYoauAdI
MD5:	CB81FED291361D1DD745202659857B1B
SHA1:	0AE4A5BDA2A6D628FAC51462390B503C99509FDC
SHA-256:	9DD5CCD6BDFDAAD38F7D05A14661108E629FDD207FC7776268B566F7941E1435
SHA-512:	4A383107AC2D642F4EB63EE7E7E85A8E2F63C67B41CA55EBAE56B52CECFE8A301AAF14E6536553CBC3651519DB5C10FC66588C84C9840D496F5AE980EF2ED2B9
Malicious:	false
Preview:	GIF89a..............................................FFF...W..V..Is.Hr.W..W..U..P\|.T..Kv.O{.V..Mx....S..Fp.Jt.Lw.Gp.Gq.Lw.U..T..R..Q~.Fo.Nz.R~.R..Q}.My.Ju.It.Oz.Gp.Nz.Gq.V..Ny.Hq.P\|.P}.S..S..S..Q}.Ku.Ku.Hr.Lx.X..Mx.It.U..Is.Hs.T..O{.R~.T..O{.Kv.My.Lv..........i...........]..WWWu...........ggguuut.......................................Ry.......{..............b..........................^..l.................X}....a..{.....c..................v..m........T{.f.....l........X.........................j..U\|...........`........j..g..U~........^.....Qz.Jr.Nw.p.....v.....p.....Gp....r..Mt.......y..q.....]..Nv............Tz.Y.....[.....Pw....Ox..............X.....Y..X..W..V..S\|............Mx....Mv.Kt.U..Hq.Lv.W.....Mu.i..Q{.Gq.Lt.S~.T..U..Kv................Fo.......!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="ht

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\deploy\splash_11-lic.gif

Download File

Process:	C:\Users\Public\123.exe
File Type:	GIF image data, version 89a, 320 x 139
Category:	dropped
Size (bytes):	7805
Entropy (8bit):	7.877495465139721
Encrypted:	false
SSDEEP:	96:S88k2wenvMs3iHrSI3yy73VWOcaJpGvrrXqJBcqgbf5bD0jmzDBoqCN2IWsyh:SFHhs73n73V4airrXq41Ll3vBmN2YU
MD5:	9E8F541E6CEBA93C12D272840CC555F8
SHA1:	8DEF364E07F40142822DF84B5BB4F50846CB5E4E
SHA-256:	C5578AC349105DE51C1E9109D22C7843AAB525C951E312700C73D5FD427281B9
SHA-512:	2AB06CAE68DEC9D92B66288466F24CC25505AF954FA038748D6F294D1CFFB72FCC7C07BA8928001D6C487D1BF71FE0AF1B1AA0F35120E5F6B1B2C209BA596CE2
Malicious:	false
Preview:	GIF89a@...................................{...........c.....P\|.l.....].............Ry.........S{.i.....U~........................uuuV..b........T.....WWW}..R~.......Hr.v..T\|.It..........n.............e..f.....].........Hq.`........Y.....i..r.._..l...........]..Y.....v..................s..f.....z.....\........Jr.r.....................i..e.....p.....Y..m........Z..Sz.Ow....Y..Nx.{..w..Jr.T..R}....Pw.Lt.s..`..W..W..Lv...........................................FFF...W..V..Is.Kv.W..W..U..Hr.O{.Mx.Jt.Gq.Fp.Gp.Lw.Fo.U..T..Q~.R..P\|.Lw.S..S..Ju.Nz.V..X..V..U..Ny.Hs.My.Ku.My.Q}.R~.P}.Q}.R..S..S..O{.Oz.Lx.Nz.Lv.It.Gp.Gq....ggg.....................S...............S\|....Gp........Mw.S~.Px.Nz.Pz.......Lt.Kv.a.....V.....r.................Fo.......!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 "> <rdf:RDF xmlns:rdf="ht

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\deploy\splash_11@2x-lic.gif

Download File

Process:	C:\Users\Public\123.exe
File Type:	GIF image data, version 89a, 640 x 278
Category:	dropped
Size (bytes):	12250
Entropy (8bit):	7.901446927123525
Encrypted:	false
SSDEEP:	192:Zzv4QPei/ueMFJ2M4xSGb/xGEyddpTa7Kv9I1BDc3KR3q6xmwJePYueHjAPZKGMr:5vTWvmxSGbkpTaYe1dc3KR3q7wJsOHmu
MD5:	3FE2013854A5BDAA488A6D7208D5DDD3
SHA1:	D2BFF9BBF7920CA743B81A0EE23B0719B4D057CA
SHA-256:	FC39D09D187739E580E47569556DE0D19AF28B53DF5372C7E0538FD26EDB7988
SHA-512:	E3048E8E0C22F6B200E5275477309083AA0435C0F33D1994C10CE65A52F357EE7CF7081F85C00876F438DFA1EE59B542D602287EC02EA340BFDF90C0C6ABD548
Malicious:	false
Preview:	GIF89a.......{.....k......{...........P\|.b..V......................Hr.Hq.......................]...........X...........f.............i............R~....u..It.u.....l..T~.......Qz.......^..Q~....i.......b.............Qx.Y..Y.....q..p.....v..............a..U\|......T..Y........................^..n........f.....Tz.e..j..f..Ox.p..Y~.Ov.......y..Z..h.....l.....W.....w.....R\|.p.....X~.a........Pw.Ks.Ir.......^.....Kt.FFF\........Ox...........W..U..Nw.Mu.W..V..Is.V..Hr.R~.W..W..U..T..O{.Kv.Gp.S..Mx.Lw.Fp.Lw.U..T..Jt.R..Gq.Fo.Ju.My.R..Q}.R~.Nz.Oz.It.Nz.V..V..Gp.Ny.Ku.P\|.Ku.Gq.P}.S..Q}.S..S..Is.Lx.U..O{.Hs.T..O{.My.Mx.Kv.Lv............iii...YYY.............xxx........._.....U..Gp.U..Lv.Mw....Oz......S\|.S}.Hq.\..Kv....Mv.P{.W..T........Mw.T.....Nz.q..Fo.......!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 "> <rdf:RDF xmlns:rdf="ht

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\ext\access-bridge-32.jar

Download File

Process:	C:\Users\Public\123.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	187736
Entropy (8bit):	7.79606817499301
Encrypted:	false
SSDEEP:	3072:9Mxm+j7ZPrDuryFpqOv2xHamAIGiDZDo81qnI/vs7O04OvwFgBgvH6:ONduOJv29amxGiDtonI87aGBgva
MD5:	13794986CA59819F6AF7BD70022D7F8F
SHA1:	6C5609CD023EB001DC82F1E989D535CD7AD407EE
SHA-256:	AF555DD438214DCD68D55EBDDCC0A05BF47DEF0EFD9920E3955D11CC2623628E
SHA-512:	2E3C4E76FD911EFF5F6983D6D7FBB0F998E5FB0BFE11921A83AC9F19BFB0C28B157354F1AC790094C354845025AB42F5A921FDDF2A780497431F3912D7D3E518
Malicious:	false
Preview:	PK........z..H................META-INF/......PK..............PK........{..H................META-INF/MANIFEST.MF.M..LK-...K-...R0.3..r.JM,IM.u.........+h..%&.8.....%...k.r.r..PK..<:S1C...D...PK...........H............/...com/sun/java/accessibility/AccessBridge$1.class.S.n.@.=.........6.....BU.D.T..CQ.x.8+...F.u...$...>..B.....5.....9.gfg......St....,........sp....z. ......".e........MG.\|N..(...a.=..9!Tz.@..GJ.W./...s<..8&t.9...m......8..Jt.`..:....Q.?.a....H......y.$.Y..a.....m.c5...K.....'.....Y.`^.5..\|..z_.q.....]2p....[..P..b.A.C...W..j..(H3.....a.~...;.Z.^,.T...6QB..L.+g...%l_R....H.V..el&..#F.~6.1.9.C.g$M.+.vn..&........k 8 ...._..."G=.6P.#._@.o(}.........s`..Oy..A.Q&\|...._a...c...2.....g$.+..k..:n.s7q..x....?PK....&.........PK...........H............0...com/sun/java/accessibility/AccessBridge$10.class.TYO.Q...e`.. ..X.j;...W.Z*j.u.....7ep.!3w._.1&...&....>.....q..m.s.{..l...._...n..0(IN.!...VajH`D.(.v.$.U....v....$g%9.!....N..T.Wq.!.d..e.Vj.

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\ext\access-bridge.jar

Download File

Process:	C:\Users\Public\123.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	187727
Entropy (8bit):	7.7958934328326075
Encrypted:	false
SSDEEP:	3072:aMxm+j7ZPrDuryFpqOv2xHamAIGiDZDo81qnI/vs7O04OvwFgBPlHl:nNduOJv29amxGiDtonI87aGBPlF
MD5:	82C16750374D5CCA5FDAA9434BAF8143
SHA1:	9B49F07BFB6F4AE73EB9B2FADCAE46E02E31F023
SHA-256:	1F0966EBD65544669395E9F490A3D397DCF122D5261566734BB422C68CFE64B8
SHA-512:	12A32FBE2A0A824EC33BD6D0A22066C0CB74D13EEBC16622FFE420CD48B4EB5878C981384DEBE30285D6231B3224E5CD2380C22D8C18624E52E5C74B62221661
Malicious:	false
Preview:	PK........{..H................META-INF/......PK..............PK........{..H................META-INF/MANIFEST.MF.M..LK-...K-...R0.3..r.JM,IM.u.........+h..%&.8.....%...k.r.r..PK..<:S1C...D...PK...........H............/...com/sun/java/accessibility/AccessBridge$1.class.S.n.@.=.........6.....BU.D.T..CQ.x.8+...F.u...$...>..B.....5.....9.gfg......St....,........sp....z. ......".e........MG.\|N..(...a.=..9!Tz.@..GJ.W./...s<..8&t.9...m......8..Jt.`..:....Q.?.a....H......y.$.Y..a.....m.c5...K.....'.....Y.`^.5..\|..z_.q.....]2p....[..P..b.A.C...W..j..(H3.....a.~...;.Z.^,.T...6QB..L.+g...%l_R....H.V..el&..#F.~6.1.9.C.g$M.+.vn..&........k 8 ...._..."G=.6P.#._@.o(}.........s`..Oy..A.Q&\|...._a...c...2.....g$.+..k..:n.s7q..x....?PK....&.........PK...........H............0...com/sun/java/accessibility/AccessBridge$10.class.TYO.Q...e`.. ..X.j;...W.Z*j.u.....7ep.!3w._.1&...&....>.....q..m.s.{..l...._...n..0(IN.!...VajH`D.(.v.$.U....v....$g%9.!....N..T.Wq.!.d..e.Vj.

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\ext\cldrdata.jar

Download File

Process:	C:\Users\Public\123.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	3860522
Entropy (8bit):	7.9670916513081735
Encrypted:	false
SSDEEP:	98304:PI1SwP9utPgTIb0bxSxwF1nNZVdEILeH9IIyYNO4Inwz:PI1HYgkoxSxI9fs4UVIwz
MD5:	AE86774D28F1C8270A9BCBD12A9A1865
SHA1:	7806C70550F435C2C87D2D15E427E5A9F97774E4
SHA-256:	0402FBCB23D381DEDE4DF4228F2D100D8693C5B3BAB885AB5EB98BCC0A269786
SHA-512:	2EA1E0372A087915FFFCCA2DEFC817C37BD038B02824BFEC1DA4E881A4C908A93AEB37DAA38840F75BCEAFD02EC09088FE648B0305DA0407E93407EAC770BE63
Malicious:	false
Preview:	PK........s..H................META-INF/......PK..............PK........s..H................META-INF/MANIFEST.MF.M..LK-...K-...R0.3..r.q.B........E..%.).N. e.z.......E..9....E..E.%@...\.\.PK...n..N...Z...PK...........H................sun/text/resources/cldr/aa/FormatData_aa.classmPMO.@.}........(.@..xB....!b,1i8..6X..I.5._.'.....(..".9.yy3.f?..?..`?...6T.5l....aG......=...mqN.......t...:6g.;`^....d.L..\0.\|.b...w&.....c.;...8%H...........RqA.......b. ..p./G......B0..K.Sx6...>4\....Zy.!..".R.N....T....=..c~d.7...3(5.<.....a;F....\....a8@..a.@..d^.]YV"k....U...2'#...rX.K...ue...O....bZ.:CB...jZ.]3...2M.s....3}.ct%.GV..PK...]..d.......PK...........H................sun/text/resources/cldr/af/FormatData_af.classuV.x[W.>...a[y......R.+-..K].I.4..(...b.=....a.h...({..B!...{.U......w../...y...?.;w>.u..w..A.......xE.nFxe.nAx...^.p+.k.^..z.7 ...M.oFx..[...v.3..!.....Bx7.{.nGx/....@x?...."..A..!\|....G.>..1..#\|....B......A.,...>..../"\|...._A.*........o"\|.....A...........".

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\ext\dnsns.jar

Download File

Process:	C:\Users\Public\123.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	8286
Entropy (8bit):	7.790619326925194
Encrypted:	false
SSDEEP:	192:tX5jIgU7WbMCc0XmHTEIWB7EH+mqcEb+wYtvEmkbKdG:tXZU7WbMoWTFWBAH+BCrEmkh
MD5:	7FA7F97FA1CC0CC8ACC37B9DAE4464AE
SHA1:	C143646A6DBE2EBDB1FBF69C09793E7F07DBC1F5
SHA-256:	36820223C5B9A225DC3FF7C1C3930BDB112F1D9AAB2BEE954FF1A1C1828E2C54
SHA-512:	AD9A0E358BE7A765B4A554E6BBE35BDD61A52BCAC9F21915D84C2A1929780150DFDCF0E43121D0E844082B1BB92873ED848ACF9B38FF3C7D826E5D0F5D32C26C
Malicious:	false
Preview:	PK........s..H................META-INF/......PK..............PK........s..H................META-INF/MANIFEST.MF.M..LK-...K-...R0.3..r.JM,IM.u.........+h..%&.8.....%...k.r.r..PK..<:S1C...D...PK...........H............2...sun/net/spi/nameservice/dns/DNSNameService$1.class.S]O.A.=......./@."e.,(>AH.` )..g.......l../j....LD..F_.M.xw.j.....s.{g.~.........d.n...9.0e.N..i.E.......~A.&.H..7....[<.7\|....]f_.....r.)W....~(B....nM..F.Z!.z.....Ye.(...B.3..2.AM0......pO..x.!.#.0U.I.G..Tu.&..L.......e.![.U..;...-.2.6.<.02P..9...R.......la....H....!.."-..H..E].Z.k^.W:p.J^s. .x .c..7j>.A..T...TfG...f....!.6zm.p.F..-.q.K.....1.!.w.C+,2..J....0.!C...0Lw...@..s[.cmp%I-.5..o...1.D].]q..4..-.t1...m.q.3.;\....D.+/..../...N....uv...R.\|<<.2M...4...O.yz.F*A...).3{.....7....]..g.i..9&m.[.......K_.}.,;)}F..VR.w........\|I.+..B.a...F.-C....h......Y...N...t..D.:.<..d..u`..r..B...PK..K.".u.......PK...........H............2...sun/net/spi/nameservice/dns/DNSNameService$2.class.

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\ext\jaccess.jar

Download File

Process:	C:\Users\Public\123.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	44516
Entropy (8bit):	7.905075370162141
Encrypted:	false
SSDEEP:	768:2YVL1eqfgKbWnXuZ/QvfBPJr+A6tkZQnWn109KqM9jE4z:2KL1eWgfnXuEfJQAdQnWn10kqg3z
MD5:	1A33FF1FDD789E655D5E2E99E9E719BD
SHA1:	AE88E6000EBD7F547E3C047FC81AE1F65016B819
SHA-256:	A23A9A653A261C640703B42839137F8C4BF7650665E62DBDD7D538171BD72516
SHA-512:	0451393D805414D6633824F3D18B609F7495324FAB56DF4330E874A8995BD9E0DA567D77DB682D7FD1544CD7E6A3D10745C23DB575035E391B02D6EE4C4362FD
Malicious:	false
Preview:	PK........{..H................META-INF/......PK..............PK........{..H................META-INF/MANIFEST.MF.M..LK-...K-...R0.3..r.JM,IM.u.........+h..%&.8.....%...k.r.r..PK..<:S1C...D...PK...........H............Z...com/sun/java/accessibility/util/AccessibilityEventMonitor$AccessibilityEventListener.class.Wkp.........5..5..A6`l..C\j.A...eb)..)dm....J+..h...I.&&...L.4.3.$.aH.q.....M...i..m......KNf4.y..~.9g.>.....[p.:....n..p....(........#.D'".ta/.>.D7.\|.s.!..f.o......#\w?o...;q..]x....B...~.....t..4>?.#N.1$Aw........;..#j.HJ0%..p...M.5...V[.. .........P...).qZ)......a-i...H2.EM..H.2l.H.eX_.>..(..J_..Lj.Z\3G...,...C\|.....T..$,.q.OX...[.u..Qg..6..:...iz.q.-....:sD@9j.2[..w..I3a.r....cXM..m..}P..J.WU.d`o.nhD.3.=).)..o2..F...8^k...f)t.........G...e\|.....CK."#.F...,.m.q..I8)....$..x^......e..?..c.D..8..e..7...U..8..dl...rc.s.7d..3...x.....E`.....n/.8.qY......i.~BQ..\.1.K2~.K...s.C.YN...@.Lh...i....PwwW.W...2.z....<%..F..+..xW.e...K.W0...3......J..)S.

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\ext\jfxrt.jar

Download File

Process:	C:\Users\Public\123.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	18192143
Entropy (8bit):	5.977388717447885
Encrypted:	false
SSDEEP:	49152:ZxJ9lXlkEhZWLyyQSgxv1/FGfnIWkRXe2p0F7tjRozGfVgMS55pU13JbL5xli3d6:ZhLk2bBSgnFGfnhAXLzAeylvi3dGT
MD5:	042B3675517D6A637B95014523B1FD7D
SHA1:	82161CAF5F0A4112686E4889A9E207C7BA62A880
SHA-256:	A570F20F8410F9B1B7E093957BF0AE53CAE4731AFAEA624339AA2A897A635F22
SHA-512:	7672D0B50A92E854D3BD3724D01084CC10A90678B768E9A627BAF761993E56A0C6C62C19155649FE9A8CEEABF845D86CBBB606554872AE789018A8B66E5A2B35
Malicious:	false
Preview:	PK...........H................META-INF/....PK...........H..>.g...g.......META-INF/MANIFEST.MFManifest-Version: 1.0..Ant-Version: Apache Ant 1.8.2..Created-By: 1.8.0_40-b27 (Oracle Corporation)....PK..........H................com/PK..........H................com/sun/PK........j..H................com/sun/deploy/PK........j..H................com/sun/deploy/uitoolkit/PK........j..H................com/sun/deploy/uitoolkit/impl/PK...........H............!...com/sun/deploy/uitoolkit/impl/fx/PK...........H............$...com/sun/deploy/uitoolkit/impl/fx/ui/PK...........H................com/sun/deploy/uitoolkit/impl/fx/ui/resources/PK...........H............4...com/sun/deploy/uitoolkit/impl/fx/ui/resources/image/PK........}..H................com/sun/glass/PK...........H................com/sun/glass/events/PK...........H................com/sun/glass/ui/PK...........H................com/sun/glass/ui/delegate/PK...........H................com/sun/glass/ui/win/PK..........H................com/su

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\ext\localedata.jar

Download File

Process:	C:\Users\Public\123.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	1178848
Entropy (8bit):	7.964832897711047
Encrypted:	false
SSDEEP:	12288:qLvFVMHxMyEg7+dYmx0nqEdgq2C942bjAHcOveMdDLtHHicwqJM5SznKMWKdk/H2:cF9rYmxQ5tOcOdFwqSYzn0DfYHs4jOBK
MD5:	24857AD811CEDA70BD0F087FD28B5B6E
SHA1:	707305EB10B1464D40BDEABADE77B80B984A621A
SHA-256:	321D646AD29A5B180CA98BB49E81C2C732523B7E5145A3C568766CEC06B2B1CD
SHA-512:	A10A340BDB2DE2D0D14ED804F04313D1D4CBD64EF0513A9E54B7FA95FFB05F2123C9095A4B2BFFA4DDF3ADEA9A67E978D26D115A8F5677AE1BD0EE67C416FA5A
Malicious:	false
Preview:	PK........u..H................META-INF/......PK..............PK........u..H................META-INF/MANIFEST.MF.M..LK-...K-...R0.3..r.JM,IM.u.........+h..%&.8.....%...k.r.r..PK..<:S1C...D...PK...........H............,...sun/text/resources/ar/CollationData_ar.classm..O.A...Y[("...E..Q.....z....M.1A.f....m.n.G\|._.WP@.R^T.D._.......b.N.H.....<..!._....!...j...#bCD.U...1"6ED.#[..xp....;.:"....Q..O.'..:....3..5.~.J.~2.8.a.......e/....S....A.#.c.l...<n.ljM%.^.O%.y.w.K.;jD.X...._......,.B'\.;'.K.{...x.G..cL...9^`..x.W..0F....!...P.8&0.)..[..+.e.T.\.+w."g.YW.E...]....[....c....}.(.b..m1n..<`..[,..-&m...C.....W....}..k>y..x.....X K.fY..1.1..L.z.;.K.....n}..4...f0..\|6.}..0..X."..+=.........n...6.Y.............l.o..%..w.8Ks..gq......3t/8C.........~<..<.3<....%....0F...(r..1..\5s..UO..jf..L..f...........................!.!.!.!.!.!.a..............................n&..... ..3.76.....#....l.OD......G.../..J.W..*...k5.V..........?.V..6...F...t.....X...X.

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\ext\meta-index

Download File

Process:	C:\Users\Public\123.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1511
Entropy (8bit):	5.142622776492157
Encrypted:	false
SSDEEP:	24:EV677x6CFRf08P86xX+4jz98ht4QLlJVzDOFw5DOFFVzDOFvVzDOFz5qlV/FRARV:EE796OfT0OZjzGs6lDitfitigXFqX6Kp
MD5:	77ABE2551C7A5931B70F78962AC5A3C7
SHA1:	A8BB53A505D7002DEF70C7A8788B9A2EA8A1D7BC
SHA-256:	C557F0C9053301703798E01DC0F65E290B0AE69075FB49FCC0E68C14B21D87F4
SHA-512:	9FE671380335804D4416E26C1E00CDED200687DB484F770EBBDB8631A9C769F0A449C661CB38F49C41463E822BEB5248E69FD63562C3D8C508154C5D64421935
Malicious:	false
Preview:	% VERSION 2..% WARNING: this file is auto-generated; do not edit..% UNSUPPORTED: this file and its format may change and/or..% may be removed in a future release..! access-bridge-32.jar..com/sun/java/accessibility/..! access-bridge.jar..com/sun/java/accessibility/..! cldrdata.jar..sun/text..sun/util..# dnsns.jar..META-INF/services/sun.net.spi.nameservice.NameServiceDescriptor..sun/net..! jaccess.jar..com/sun/java/accessibility/..# localedata.jar..sun/text..sun/util..# nashorn.jar..jdk/nashorn..META-INF/services/javax.script.ScriptEngineFactory..jdk/internal..# sunec.jar..sun/security..META-INF/ORACLE_J.RSA..META-INF/ORACLE_J.SF..# sunjce_provider.jar..com/sun/crypto/..META-INF/ORACLE_J.RSA..META-INF/ORACLE_J.SF..# sunmscapi.jar..sun/security..META-INF/ORACLE_J.RSA..META-INF/ORACLE_J.SF..# sunpkcs11.jar..sun/security..META-INF/ORACLE_J.RSA..META-INF/ORACLE_J.SF..# zipfs.jar..META-INF/services/java.nio.file.spi.FileSystemProvider..com/sun/nio/..# jfxrt.jar..META-INF/INDEX.LIST..com/sun

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\ext\nashorn.jar

Download File

Process:	C:\Users\Public\123.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	2018860
Entropy (8bit):	7.9328569913001905
Encrypted:	false
SSDEEP:	49152:fBkB7GOrPDSz0fHaIU1KDWtHkLs0amlyYu:fBkoOruSHa/4y/FmA
MD5:	F3E3E7769994C69DFF6E35EF938443CA
SHA1:	758F42C0A03121AD980DC98BE82DCAF790679E79
SHA-256:	CF0268FF39D19876BD42BF59E2CE93BB9AA57E5EE98C212BAE0184BD87F2D35A
SHA-512:	AB4801E8538B9B84124D2B8C36E64232F16DA686C5FA565C5DE2091C910806A850464F5CCC79C9320DF6F8CB943633FC38FEA63F9E0593A44E3541F15F126951
Malicious:	false
Preview:	PK........o..H................META-INF/......PK..............PK........o..H................META-INF/MANIFEST.MFm....0.E.&...:..q.0.....W.g(>Z.v..E4,...{o..>1&y...w.0JsV....<..A..M.bs.. ......F\|.Y... .Bt.K9...N%.).s.D.qVC.......c?......'..B,k...&.......i?^0...o...PK..\K:x........PK........i..H............6...jdk/internal/dynalink/beans/AbstractJavaLinker$1.class.S.N.Q..N[.mY.".....T......7.%....A...t..n..m........k51.....2..H.51....o..\|..9?~~;....9..J.Y.g...5......M%.4......z....=..v.OF"..7.#....-.e......nU...G^ K.a/.BF.....y.....C.C.^..!.R.eH.....j....aK.M...3].....=..;'.;]j..>C....#*.:..Z.(.N...JvEX.I.e..A..."j...C....t.C.q..:..>.J1}...z`..v...[.. .QTa..kXeX..'.1O.c..1...x..W..a.....3.Gl.VG8.C.tE5P...rN.&.v.....F.V.{.say.0^~m.....e....VW.B..x.h..u.i.K..F..j.[;;..Z.z.^f.8.q~.nR.n....Q.2..$.)B.$..\|.;.....'.&. .j\|@.E....FP#....A-..."...b.n.".H/c..Ho..s.I./.X..p...}..]F....SP.L.u."@..$o.9.b.'.!.;X~6..PK..]./.<...H...PK........i..H............K...jdk/internal

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\ext\sunec.jar

Download File

Process:	C:\Users\Public\123.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	39771
Entropy (8bit):	7.92713480980539
Encrypted:	false
SSDEEP:	768:ah0EOq/w9b3jpSo40ROLB2CUrQbNVkJBtw6pcZWztpQeA4Uz7NWnZVNB3gX083/z:aJOyw9b3joo4hLB2CUr2yBw6pcMtpS44
MD5:	A269905BBB9F7D02BAA24A756E7B09D7
SHA1:	82A0F9C5CBC2B79BDB6CFE80487691E232B26F9C
SHA-256:	E2787698D746DC25C24D3BE0FA751CEA6267F68B4E972CFC3DF4B4EAC8046245
SHA-512:	496841CF49E2BF4EB146632F7D1F09EFA8F38AE99B93081AF4297A7D8412B444B9F066358F0C110D33FEA6AE60458355271D8FDCD9854C02EFB2023AF5F661F6
Malicious:	false
Preview:	PK.........r.F................META-INF/MANIFEST.MF..I..H....Q..C.f.X..b......lz..$..dK6..7U....N.5...... .GT.......[.{a...8#(FI......%Ao==...U%%.QOIjL....'.o../..q.q.!....k..)}..4...@J..~\....@..z0._.....L....=..z.=?)..%... n......HoY.>?........]....Nz..,..c./........6$.@....1.2.X...`:G.j.S..IP.-X...0..8jk...\|.....YF.b..u.9...F\.j......y.Q.'..2.i.S.D...z.j...a..a..L.o..+v. .!.h..8H...d..R.d1a...A.9........zC..Z_.p.`...).t. ...q.1.......\...RS."..11.C.Y..I...J.(.(x.m..N..('[..C.o....H..].<#.%....CZ....[....Y......g..=.2...........I....qm.-....(..BZF.r8=.C(F...I.."...$W....]...9..0b......]...5.M.....`"."k...k....T\....WZQ.>.8..KF..g[Y.c5.s...U..-c....!v..$.rG......1T....bb.s>..R.w....&8.NX@o+...~,K..2..yI..._f^.l@..\|.....U...^...#.P.u!.#..g@/d.<.../..:..V.[.6B.TG....>.D..R\.k....E.E.O4K..Z....f.,..f......hRW...) X......\M.#!)..H..b..f...w..R....w.=.........PC.#...K..\|..d.S..Ms.]4q.....c..f......}.NF^.7d...\|.*..^\n.l.D..V......

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\ext\sunjce_provider.jar

Download File

Process:	C:\Users\Public\123.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	279427
Entropy (8bit):	7.90277234368113
Encrypted:	false
SSDEEP:	3072:E/Ieog0SgEOU8pqHbQpr16jWun5bT1aReAaTFMzpx2Xcpll+PrA3YaRBlLi:E/m9eJsppCLJTURe9TFMrQ0fkUK
MD5:	B04074A9FC78DC1409168E1E2D139647
SHA1:	54182C904A48364FC572E3A2631DF14823C29CEF
SHA-256:	BFAD3FB11E7115AAF34719488551BF3205B2FAFFB38681C7F6BDAD19BB7568C2
SHA-512:	E97CA3D53E867E957BF467688F83C53B2FD6FF1EA001B19F03A23096581DC8ADCEC7C1403D164D063B1A437E4BF6FA98E1543626849D4E17E31156CB012F9599
Malicious:	false
Preview:	PK........aZ.H................META-INF/MANIFEST.MF.\|I..V..".?xP...p.#..7.G D.N.......~...)....ic.;..[.k.../3...5.5........O....x....6c4>...].u....h.~2.f,n.O\|3.}.\|<..._}..o........K..Z.=.$m....>...'....O?...G.>&..)no.......Z=...k..~...O.z....c.\|(..9.=..\|....q.vc....}..i.3.~.}x...~.?.+..._...}.......\|..,.,..&`.s..=.....h...%.g.'~..i......p.;A..B..99{....E..k........)......^IW!.._....+..)....d._0...s......v..R.c.*]..0.C..Z}.....j..O%.I.....J.%..).Q..=..0.J.J...A......%T...$..h.#.N%N.e.ne...=DV.......+.....(..f...yn.P..-...f.ON..d=8-....B.^......S.+........$V`..uz....US..h.8.4^Y-;4.M.+i...dw.9.x..k.]...\u..j{<.....r.....y}.E.....X.~%....zF;.<....+-...X.I.I..]..N`.2.G....c~..J.r.o@..My.(.H,...b.e...5'e./...b;D~.%....};....J....1k5CrO..6....n.....>.t..0a.......,.J./;.q.y...w...J.t&s.2.sYk....1...5..._x.....Q..M.J...N.y3{....R..~.F..V......'z...{\|..j5..../.;.NCGG\.....!M...Pfe/l..).zL..9.4....?..o.....}.F..M....~.L.q.] ..x.v..d.]G[...q$.E.o...r.(..

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\ext\sunmscapi.jar

Download File

Process:	C:\Users\Public\123.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	32699
Entropy (8bit):	7.878192531974338
Encrypted:	false
SSDEEP:	768:iLy1giOqjU0jNVmOTuDQJD/RpAczsikFfg0y+7aBTS73dyPoXvvKv2PtvHubyKhi:i4giOaU0jNVmOCADZpVsiUf3yua5S7t7
MD5:	2249EAC4F859C7BC578AFD2F7B771249
SHA1:	76BA0E08C6B3DF9FB1551F00189323DAC8FC818C
SHA-256:	A0719CAE8271F918C8613FEB92A7591D0A6E7D04266F62144B2EAB7844D00C75
SHA-512:	DB5415BC542F4910166163F9BA34BC33AF1D114A73D852B143B2C3E28F59270827006693D6DF460523E26516CAB351D2EE3F944D715AE86CD12D926D09F92454
Malicious:	false
Preview:	PK........)..H................META-INF/MANIFEST.MF....X.........ad2....@..%E..M.^.x.. O_dW.5Qi..8.....).aY=.!.Q....g..AM..&0....d../#..yM+......g.[.O..$....I?>X9..G......h.]...".y....do.O..2.Y.\^...}+....p2..u.]...V0}....&..a.C...-.....n.....M...M.F..,.....v@...>>\|..["J...U7")..#b.oV.a...l.g..e.s..L.D..={.-gLEt.....!/... q....z.J...0.2e...=.....[]{..N...1....Z.....2...I.k...Sy..Qm...{....;.On..!.@..S.IZ..=......Lo.N4..\|.j...!.l..G..}.Q....u....ADh.z.w.-..@%.@...!.".R.nHE.P]..J!..E.9Sw.LM7.&...[v..~.P...bp;.....:id.e..o.h..8.C....l...70..].gp..7.<.P.....Zj.....M......-.(@~...M^.....asJ.Y.1.e...(qW..h.c.Iu...-.A..?.5.Ex.S.oc6.).Qkr..+....\|..._..H..!7..hs.r.;.z=.....#.c....6...O+q.I.....\|.4.V....Y.T.....4XO..4.>..1.$h..lu..l0..?...w.......o.u....6..)BG'..f......d.v...........<.i..Bj..d..L.....G.r@1.....0..d......'............rK....5x..8.V..9(..Y.`'.k.N....3b.rx.p..c...M_j%..U.z.\|Y.1\....d...-I.<g........-.h..F...me.F..p.c.o..

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\ext\sunpkcs11.jar

Download File

Process:	C:\Users\Public\123.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	250826
Entropy (8bit):	7.951088517189604
Encrypted:	false
SSDEEP:	6144:dKtThM4XbBG7v3jUAbE0MEIynrI25ENN/kv1Pv:dKphM4X1G7PjlbE0MxHLbC
MD5:	2E33D8F1FBEB9239C6FFC0D36DE772D1
SHA1:	3F881E3B34693A96CD3D9E20D6AEABAE98757359
SHA-256:	938C497E97E893D0B9325522475AD9FB2C365A4AF832ED180B570C3E4E6FD559
SHA-512:	DB9A5B0F269BBFC9CB712D8BF170414D649CD72F0DEECCDC3A4D742430E2E29E203F7E462D2DF8F9EC2C82723A8A56FF8FD409CDCBE66547C798B15370B8DB65
Malicious:	false
Preview:	PK........mS.F................META-INF/MANIFEST.MF.{.........3.. l@ .G...D.#49A/...........Z.jTUj.{g.\.r..4y...n2.y.........s.UI.4S0=_.......,..sn..N.p..m..C.....F\|{..%Q.....m.v...6.Q.\|a.k.?....}...../Q[.6..?.......v..P....>..O.:%.E..........o.uS..O..S..Jo....}../.........z.b.....?}_..%pL.y....h.aP.a...1....)..$..IH....v.-..q\|..D.z8b..y.<...x..M.K]b=.+.0nSt.co(.-.............C.u..2.W..3...+.....9.d.......L..</..P..z+n..JR;V..K....>...D.....<.....=..+e....>L..`......g.....Os..Ly..T..a.`.}.......Z...R..S...c..z......x.U..)...J.........e..=rr..^K.....hY2.U....e........N.9..r).#!V[..`...B.......CW.}o.q......u7..h0?6.P.14N.-J.\.!u`....H..l...1'J=[.+.-.....X.9.@.......a{C.).Z..P(W.}O...%./..XG=...^..N.enV.F<..oW.\|....CJ.....\x..g;v.L.Wf...N.#..*..!.L..:.MD.Vy.z.0.L..72...\|.=..eB6(z....#:8D..ig....U....SO.t......0_...>S...}.L.ze....=...k&.[...U^p.$...(........m.z.....~.F..........h......z3<LO.y..4.......w.3.......,W8(..3UF.R.....J)J..q.....Z.d.;

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\ext\zipfs.jar

Download File

Process:	C:\Users\Public\123.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	68923
Entropy (8bit):	7.950933538093809
Encrypted:	false
SSDEEP:	1536:YNSe2yN5DbD630l1MIeEfqjGWb2LU2j6rnbisZp/u:Ne2yNhDVl1leEP/qn2sZk
MD5:	4D507E8D7BBF5ECEC8791CBA57B1CE17
SHA1:	A66C0D4648A06B9078252D090D596C91C591AA50
SHA-256:	C3993DF765AFF1068A656B28A7A4EDFFE7710AE3B6AA2EA056A6F9C3EDBDC210
SHA-512:	21B4E729B16947B31657DC5F7F5C75DCDA9F94B4A0ED414E11A6D02951137AC266D605855DDDA7C21BE0200EA07530962D1ECE2FAE009EAE5F2A1A365195C995
Malicious:	false
Preview:	PK........b..H................META-INF/......PK..............PK........b..H................META-INF/MANIFEST.MF..;..0...@...uhI.J6-...E.U..-..(I,..m.\|Up=..;.B.:.19...Y.Y8+M.....p,m...F.....?..zRQ..........l....C..]....cO..T.......ds...(.9,...[.~...;.....>....Y.T6)4. .3..PK.../.?....L...PK........I..H............-...com/sun/nio/zipfs/JarFileSystemProvider.class.U]S.U.~NH.a.@..B.\.!.$.U[.X..J..H..G...$,Mv.....z....9...........Z.d..a.1.y...<..s.y...~....x&c......q..B.`B.......'b.4...'e.1%......i!f../aV.L......B,.XD..KX.......V..^..@....`SD..`[.C._0.'..p.2.EF...SV.3t-.&OW.Yn....i....vx..=..]}O.J.Y.2.m..q.Tmc.Z.....H.arW[[I.7.L...F.k.E&...../.z.J...,U. QD...%....v...".+s.-f.....e..3....."..bvu[..b..Ag.<I7U.^J..j....~.W\.2....i.j..1C7..:..U.QM.UG.d.c`4.8.Pf..MA.E.;0...1.r..bX..$l>h..%..,h...."^=m.90]}.T.}'.&...B;m.-.9.\T....x.p.laD.....#..U.r..P..o...(.a.....`.E.....1..4-......fT......H.kN..1....r.Z"7.J+d....B5.'U...e.).!...rt...^.p3..k.8.j.:..k5T....".

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\flavormap.properties

Download File

Process:	C:\Users\Public\123.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4005
Entropy (8bit):	4.909684349537555
Encrypted:	false
SSDEEP:	96:5Th0S7zmtRUioj/DUXBZZjM8mcWoe+YfVktH:5h0Iz6Uioj/YXLZjnmdoeDktH
MD5:	B0CE9F297D3FEC6325C0C784072908F1
SHA1:	DD778A0E5417B9B97187215FFC66D4C14F95FEF0
SHA-256:	6DA00C1CBE02909DCD6A75DA51D25DBF49BFD1D779C0B8E57B12E757229FC4A8
SHA-512:	4C774BCB9ADE996569C86DD46B3BDB046771AD1BCF9AABB9DB86854C83E18015CBE5DF73DA86EE98E26BA0393F548B1CC09DE60BDA4248EACC4FC833E23B8AB4
Malicious:	false
Preview:	#..# This properties file is used to initialize the default..# java.awt.datatransfer.SystemFlavorMap. It contains the Win32 platform-..# specific, default mappings between common Win32 Clipboard atoms and platform-..# independent MIME type strings, which will be converted into..# java.awt.datatransfer.DataFlavors...#..# These default mappings may be augmented by specifying the..#..# AWT.DnD.flavorMapFileURL ..#..# property in the appropriate awt.properties file. The specified properties URL..# will be loaded into the SystemFlavorMap...#..# The standard format is:..#..# <native>=<MIME type>..#..# <native> should be a string identifier that the native platform will..# recognize as a valid data format. <MIME type> should specify both a MIME..# primary type and a MIME subtype separated by a '/'. The MIME type may include..# parameters, where each parameter is a key/value pair separated by '=', and..# where each parameter to the MIME type is separated by a ';'...#..# Because SystemFla

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\fontconfig.bfc

Download File

Process:	C:\Users\Public\123.exe
File Type:	raw G3 (Group 3) FAX
Category:	dropped
Size (bytes):	3670
Entropy (8bit):	4.40570512634857
Encrypted:	false
SSDEEP:	96:IRsY7hGbXWvaBKvKY5csW4BxciETBT5Bxrws+LW/B56JF:At/vaBKvKY5fxci8jMWY
MD5:	E0E5428560288E685DBFFC0D2776D4A6
SHA1:	2AE70624762C163C8A1533F724AA5A511D8B208E
SHA-256:	AAE23ACC42F217A63D675F930D077939765B97E9C528B5659842515CA975111F
SHA-512:	C726CC2898399579AFA70ACACE86BEC4369D4541112243E51721568B4D25DCC6C66FA64AC475AFF9BA9DE07A630B24A9F221FA00426AD36845203BA809219E3C
Malicious:	false
Preview:	...%.........6.Y.j.{.........+...........6.=.:.-.9.;.<.3...0.4./.2.8.1.5.7......................................................................................................................................... ............... .........................................................................................................................D.C.I.F.A.G.E.B.?.@.>.H...........................................................................................!.".#.$.%.&.'.(.)..+.+.+.+.+.J.M.U.^.f.e.X.W.d.V.R.\._.`.a.Y.O.Z.P.S.K.Q.N.[.c.L.T.].b.g.j.}...r.q.l.{.z.....p.o.\|.s.k.w.~.t.x.v.y.........h.u.i.m.........n.................................................................................................................................................!......."........... .................#.(.-.2.7.<.A.F.K.P.U.[.a.g.m.s.y......................................................... .(.5.;.H.U.d.v................................4.?.H.T.].i.s.~.............................".7.@.J.R.R.^.i

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\fontconfig.properties.src

Download File

Process:	C:\Users\Public\123.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10779
Entropy (8bit):	5.217016051711063
Encrypted:	false
SSDEEP:	192:Pj2TlKg7RzPc/mOHUFN5HX/rS8QbWZjjfVpMbtxp8lcR9NN:Pj6Y8NcFzXbWZjj9pSMlcz
MD5:	0C1DB7410938A3634BD9928BA2F284CB
SHA1:	7EE31F22136E73A2A3D0AAB279199778BAAB06F5
SHA-256:	818A718788E5506EBB84F26DE82B6C60E08861876400E9ED3931346174D5D7FB
SHA-512:	EE267E59564A077713856A307382D40D0D8DF8E7EC2EF930723B076F5E38446D3B2600D10AC192262F9A3A86D9973CF13A9E90D180818C05A6C7896A5BD7AD19
Malicious:	false
Preview:	#..# ..# Copyright (c) 2003, 2011, Oracle and/or its affiliates. All rights reserved...# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms...#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#....# Version....version=1....# Component Font Mappings....allfonts.chinese-ms936=SimSun..allfonts.chinese-ms936-extb=SimSun-ExtB..allfonts.chinese-gb18030=SimSun-18030..allfonts.chinese-gb18030-extb=SimSun-ExtB..allfonts.chinese-hkscs=MingLiU_HKSCS..allfonts.chinese-ms950-extb=MingLiU-ExtB..allfonts.devanagari=Mangal..allfonts.dingbats=Wingdings..allfonts.lucida=Lucida Sans Regular..allfonts.symbol=Symbol..allfonts.thai=Lucida Sans Regular..allfonts.georgian=Sylfaen....serif.plain.alphabetic=Times New Roman..serif.plain.chinese-ms950=MingLiU..serif.plain.chinese-ms950-extb=MingLiU-ExtB..serif.plain.hebrew=David..serif.plain.japanese=MS Mincho..serif.plain.korean=Batang....serif.bold.alphabetic=Times New Roman Bold..serif.bold.chinese-ms950=PMingLiU..serif.bold.chinese-ms9

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\fonts\LucidaBrightDemiBold.ttf

Download File

Process:	C:\Users\Public\123.exe
File Type:	TrueType Font data, 15 tables, 1st "LTSH", 16 names, Macintosh, Copyright (c) 2000 Bigelow & Holmes Inc. Pat. Des 289,422.Lucida BrightDemiboldLucida Bright Dem
Category:	dropped
Size (bytes):	75144
Entropy (8bit):	6.849420541001734
Encrypted:	false
SSDEEP:	768:H8Jwt1GIlZ6l0/9tRWhc0x/YxvsTjyIDXCrGU/tlDaKAgKrTLznvzDJIZmjFA0zG:Mwtze9xQcQ/LDaKAgK3LLvzFogbFt5WD
MD5:	AF0C5C24EF340AEA5CCAC002177E5C09
SHA1:	B5C97F985639E19A3B712193EE48B55DDA581FD1
SHA-256:	72CEE3E6DF72AD577AF49C59DCA2D0541060F95A881845950595E5614C486244
SHA-512:	6CE87441E223543394B7242AC0CB63505888B503EC071BBF7DB857B5C935B855719B818090305E17C1197DE882CCC90612FB1E0A0E5D2731F264C663EB8DA3F9
Malicious:	false
Preview:	...........pLTSH$....#.....OS/2p.{........Vcmap.U.z...T...jcvt 8.E.........fpgm..1.........glyf@>.7...l....hdmx..(:...t..1.head.?....T...6hhea.U........$hmtx..ys...... loca..\4........maxp.8......... name..#.........postM.IA.......prepbM.h.......W.............).......).....d. ............................B&H.. . .3.D.\...... ................................................................................................ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`a.bcdefghijklmnopqrstuvwxyz{\|}~......................................................................................................P...T.@.....~.............&.. . . . . " & 0 : D t .!"!&"."."."."."."+"H"`"e%................3..... .............&.. . . . . & 0 9 D t .!"!&"."."."."."."+"H"`"d%................3.........W.......M...d...............1.....j.y........t.q._./.0.......v.t.r.p.g.T.....R..........................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\fonts\LucidaBrightDemiItalic.ttf

Download File

Process:	C:\Users\Public\123.exe
File Type:	TrueType Font data, 15 tables, 1st "LTSH", 16 names, Macintosh, Copyright (c) 2000 Bigelow & Holmes Inc.Lucida BrightDemibold ItalicLucida Bright Demibold Itali
Category:	dropped
Size (bytes):	75124
Entropy (8bit):	6.805969666701276
Encrypted:	false
SSDEEP:	1536:lww80sTGzcKHwxWL0T+qHi/sbA06PoNORsr5sOnD0OyuusGa7bs4J:lwL0i97WL0T+qHA9cOR05FD0Oyup74w
MD5:	793AE1AB32085C8DE36541BB6B30DA7C
SHA1:	1FD1F757FEBF3E5F5FBB7FBF7A56587A40D57DE7
SHA-256:	895C5262CDB6297C13725515F849ED70609DBD7C49974A382E8BBFE4A3D75F8C
SHA-512:	A92ADDD0163F6D81C3AEABD63FF5C293E71A323F4AEDFB404F6F1CDE7F84C2A995A30DFEC84A9CAF8FFAF8E274EDD0D7822E6AABB2B0608696A360CABFC866C6
Malicious:	false
Preview:	...........pLTSH.....#.....OS/2k.{........Vcmap.U.z...T...jcvt =jC.........fpgm..1.........glyf.......h...Jhdmx.......`..1.head..X.......6hhea...;.......$hmtx.b......... loca..\....0....maxp...:...D... name .7]...d....postM..A........prep.C.f....................).......).....d. ............................B&H..!. .3.D.\...... ................................................................................................ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`a.bcdefghijklmnopqrstuvwxyz{\|}~......................................................................................................P...T.@.....~.............&.. . . . . " & 0 : D t .!"!&"."."."."."."+"H"`"e%................3..... .............&.. . . . . & 0 9 D t .!"!&"."."."."."."+"H"`"d%................3.........W.......M...d...............1.....j.y........t.q._./.0.......v.t.r.p.g.T.....R..........................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\fonts\LucidaBrightItalic.ttf

Download File

Process:	C:\Users\Public\123.exe
File Type:	TrueType Font data, 15 tables, 1st "LTSH", 16 names, Macintosh, Copyright (c) 2000 Bigelow & Holmes Inc. Pat. Des 289,773.Lucida BrightItalicLucida Bright Itali
Category:	dropped
Size (bytes):	80856
Entropy (8bit):	6.821405620058844
Encrypted:	false
SSDEEP:	1536:jw9ESkPFybxWj1V7zbPUoOPjp85rFqXpLboVklDNTc2Wt:jwZO0xWPTU7l85rFYpLbott
MD5:	4D666869C97CDB9E1381A393FFE50A3A
SHA1:	AA5C037865C563726ECD63D61CA26443589BE425
SHA-256:	D68819A70B60FF68CA945EF5AD358C31829E43EC25024A99D17174C626575E06
SHA-512:	1D1F61E371E4A667C90C2CE315024AE6168E47FE8A5C02244DBF3DF26E8AC79F2355AC7E36D4A81D82C52149197892DAED1B4C19241575256BB4541F8B126AE2
Malicious:	false
Preview:	...........pLTSH...2..:L....OS/2p.\|y.......Vcmap.U.z...T...jcvt F.;.........fpgm..1.........glyf.}.....@....hdmx?..p......1.head.A![.......6hhea.......P...$hmtx3..9...t... loca6..........maxp.......... name...p.......~postM..A...H....prep.......................).......).6...d. ............................B&H.... .3.D.\...... ................................................................................................ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`a.bcdefghijklmnopqrstuvwxyz{\|}~......................................................................................................P...T.@.....~.............&.. . . . . " & 0 : D t .!"!&"."."."."."."+"H"`"e%................3..... .............&.. . . . . & 0 9 D t .!"!&"."."."."."."+"H"`"d%................3.........W.......M...d...............1.....j.y........t.q._./.0.......v.t.r.p.g.T.....R..........................................................................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\fonts\LucidaBrightRegular.ttf

Download File

Process:	C:\Users\Public\123.exe
File Type:	TrueType Font data, 15 tables, 1st "LTSH", 16 names, Macintosh, Copyright (c) 2000 Bigelow & Holmes Inc. Pat. Des 289,421.Lucida BrightRegularLucida Bright Regu
Category:	dropped
Size (bytes):	344908
Entropy (8bit):	6.939775499317555
Encrypted:	false
SSDEEP:	6144:oBfQeUG2CCTufrmOufymM8hvFHp277tS9iZFYSATxNm:oNQ3vCCTcaFNJw7tSgYS82
MD5:	630A6FA16C414F3DE6110E46717AAD53
SHA1:	5D7ED564791C900A8786936930BA99385653139C
SHA-256:	0FAAACA3C730857D3E50FBA1BBAD4CA2330ADD217B35E22B7E67F02809FAC923
SHA-512:	0B7CDE0FACE982B5867AEBFB92918404ADAC7FB351A9D47DCD9FE86C441CACA4DD4EC22E36B61025092220C0A8730D292DA31E9CAFD7808C56CDBF34ECD05035
Malicious:	false
Preview:	...........pLTSHN..U..=....~OS/2...S.......Vcmap..tO...T....cvt =\|t>.......tfpgm..1....`....glyf.J.........Jhdmx]......D....head.WD...h...6hhea.j.........$hmtxW.6\|........loca............maxp......4.... nameJO....4....rpost..g...8,..M.prep.].O.......T.............).......).....d. .............."....`........B&H..@. ...D.]...... ................................................................................................ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`a.bcdefghijklmnopqrstuvwxyz{\|}~......................................................................................................\|...........~.............&.u.z.~.......................O.\.....................:.R.m.......... . . . . " & 0 : D t .!"!&!.".%....................3.b.r.t....... .............&.t.z.~.........................Q.^...................!.@.`.p........ . . . . & 0 9 D t .!"!&!.".%....................3.^.p.t.v.........W.......M......................................................

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\fonts\LucidaSansDemiBold.ttf

Download File

Process:	C:\Users\Public\123.exe
File Type:	TrueType Font data, 15 tables, 1st "LTSH", 19 names, Macintosh, Copyright (c) 1999, 2001 by Bigelow & Holmes Inc. Pat. Des. 289,420.Lucida SansDemiboldLucida Sa
Category:	dropped
Size (bytes):	317896
Entropy (8bit):	6.869598480468745
Encrypted:	false
SSDEEP:	6144:R5OO1ZjNDE7/MsTJ30otegK4zJwz3UhG5jXsrg2HLzYv7cf0R7o7+WX/ov2DG:bOO11CEo9xzJwljXsrhHQ7cMuX/16
MD5:	5DD099908B722236AA0C0047C56E5AF2
SHA1:	92B79FEFC35E96190250C602A8FED85276B32A95
SHA-256:	53773357D739F89BC10087AB2A829BA057649784A9ACBFFEE18A488B2DCCB9EE
SHA-512:	440534EB2076004BEA66CF9AC2CE2B37C10FBF5CC5E0DD8B8A8EDEA25E3613CE8A59FFCB2500F60528BBF871FF37F1D0A3C60396BC740CCDB4324177C38BE97A
Malicious:	false
Preview:	...........pLTSH_R.a........OS/2...........Vcmapz.$L.......Zcvt ...y...8...hfpgm..1.........glyf......\....hdmx..0A.......hhead..&..:H...6hhea......:....$hmtx.,Z:..:.....loca.~'...T.....maxp......n.... name..=%..n....Kpost$.#...s$..[?prep......d...a..........................................)........2'............'........ ....................".".............0.%...............%...........)....................... ......0 ..............................) ) ) ) ...........................................2.2.2.2.).......................................................'"'"'"1....0.........................................................................................................'.....'...........)..,...&,....#............./&.....&.&.$.....$...$........'....... ....)...."...,.......+.....'....).,.....-)..)................... ..."..................,.........(.........,........................../..2.......+.........,.#) .....................+..).........0......+...............,.,.,......

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\fonts\LucidaSansRegular.ttf

Download File

Process:	C:\Users\Public\123.exe
File Type:	TrueType Font data, 18 tables, 1st "GDEF", 19 names, Macintosh, Copyright (c) 1999 by Bigelow & Holmes Inc. Pat. Des. 289,420.Lucida SansRegularLucida Sans Regu
Category:	dropped
Size (bytes):	698236
Entropy (8bit):	6.892888039120645
Encrypted:	false
SSDEEP:	12288:6obn11t7t7DxT+3+OQ64cctiOAq12ZX/DmfT6R83Sd8uvx7wSnyER4ky+SH/KPKQ:6oTJZzHniOAZ783Sd8uvx7wSnyER4kyI
MD5:	B75309B925371B38997DF1B25C1EA508
SHA1:	39CC8BCB8D4A71D4657FC92EF0B9F4E3E9E67ADD
SHA-256:	F8D877B0B64600E736DFE436753E8E11ACB022E59B5D7723D7D221D81DC2FCDE
SHA-512:	9C792EF3116833C90103F27CFD26A175AB1EB11286959F77062893A2E15DE44D79B27E5C47694CBBA734CC05A9A5BEFA72E991C7D60EAB1495AAC14C5CAD901D
Malicious:	false
Preview:	........... GDEF..\|.......GPOS.......L...HGSUB.f.........LTSH...........uOS/2.#GQ...,...Vcmap..4........4cvt .y..........fpgm.!&.........glyf. ..........hdmx...M...(...\head..........6hhea...........$hmtx.S........-.loca'.c......-.maxp...Y....... nameW..r........post.&-.........prep.........................).......).....d. ...................{........B&H..@. ...D.]......`................................................................................................ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`a.bcdefghijklmnopqrstuvwxyz{\|}~..........................................................................................................".....".~...............E.u.z.~.......................O.\...............................:.R.m.............9.M.T.p.:.[.... . F p . . .!8!.!.".#.#.#!$i%.%.%.%.%.%.%.%$%,%4%<%l%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.&.&.&.&.&<&@&B&`&c&f&k'.'.'''K'M'R'V'^'g'.'.'................ .3.....6.<.>.A.D.N.b.r.t......... .........P.......t.z.~

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\fonts\LucidaTypewriterBold.ttf

Download File

Process:	C:\Users\Public\123.exe
File Type:	TrueType Font data, 13 tables, 1st "OS/2", 16 names, Macintosh, Copyright (c) 1999, 2001 by Bigelow & Holmes Inc.Lucida Sans TypewriterBoldLucida Sans Typewrite
Category:	dropped
Size (bytes):	234068
Entropy (8bit):	6.901545053424004
Encrypted:	false
SSDEEP:	6144:3BPS7w5KIMtYwqcO3GbA4MJcs2ME9UGQ2n9gM/oD:xVMtgcGGPMJcs4b9gM/4
MD5:	A0C96AA334F1AEAA799773DB3E6CBA9C
SHA1:	A5DA2EB49448F461470387C939F0E69119310E0B
SHA-256:	FC908259013B90F1CBC597A510C6DD7855BF9E7830ABE3FC3612AB4092EDCDE2
SHA-512:	A43CF773A42B4CEBF4170A6C94060EA2602D2D7FA7F6500F69758A20DC5CC3ED1793C7CEB9B44CE8640721CA919D2EF7F9568C5AF58BA6E3CF88EAE19A95E796
Malicious:	false
Preview:	...........POS/2..........VcmapW......4....cvt .M/.........fpgm..1.........glyf\|......@....head.c....L...6hhea...........$hmtx.e.........tloca..h..."....xmaxp......7.... name......7.....post1..%..;h..I.prep.......4... .............3.......3...1.f................+...x.........B&H.. . ...D.]......`................................................................................................ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`a....................................................................................................................................x...........~...............u.z.~.......................O.\...............................:.R.m...........:.[.... . . . " & 0 3 : < > D . . . . .!.!.!.!"!&!.!^!.!.".".".".".".".")"+"H"a"e#.#.#!%.%.%.%.%.%.%.%$%,%4%<%l%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.&<&@&B&`&c&f&k...................3...b.r.t....... ...............t.z.~.........................Q.^.............................!.@.`.p...........?.... . . . &

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\fonts\LucidaTypewriterRegular.ttf

Download File

Process:	C:\Users\Public\123.exe
File Type:	TrueType Font data, 13 tables, 1st "OS/2", 16 names, Macintosh, Copyright (c) 1999 by Bigelow & Holmes Inc.Lucida Sans TypewriterRegularLucida Sans Typewriter R
Category:	dropped
Size (bytes):	242700
Entropy (8bit):	6.936925430880877
Encrypted:	false
SSDEEP:	3072:VwzZsJcCrn271g+UGFDUnrrHqMyBtlc3+fzx5R1zeqZdDgfSkecUfEDpEXzSyPMx:GWcCrn2C46Ak+naqaucYEDpEX3gZoO9
MD5:	C1397E8D6E6ABCD727C71FCA2132E218
SHA1:	C144DCAFE4FAF2E79CFD74D8134A631F30234DB1
SHA-256:	D9D0AAB0354C3856DF81AFAC49BDC586E930A77428CB499007DDE99ED31152FF
SHA-512:	DA70826793C7023E61F272D37E2CC2983449F26926746605C550E9D614ACBF618F73D03D0C6351B9537703B05007CD822E42E6DC74423CB5CC736B31458D33B1
Malicious:	false
Preview:	...........POS/2...s.......`cmap..Rh...<....cvt m......@...<fpgm..1....\|....glyf..;}...8....head.,j..2L...6hhea......2....$hmtx.....2.....loca.PB...H(....maxp.z....].... namex.R...].....post...Q..ax..I.prep.UJ....\.................).......).....d. ..............{.............B&H..@. ...D.\...... ........=..... ......................................................................................... !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`a.bcdefghijklmnopqrstuvwxyz{\|}~..................................................................................................................~...............u.z.~.......................O.\...............................:.R.m...........:.[.... . . . " & 0 3 : < > D . . . .!.!.!.!"!&!.!^!.!.".".".".".".".")"+"H"a"e#.#.#!%.%.%.%.%.%.%.%$%,%4%<%l%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.&<&@&B&`&c&f&k.........................3...b.r.t....... ...............t.z.~.........................Q.^.............................!.@.`.p...........?..

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\hijrah-config-umalqura.properties

Download File

Process:	C:\Users\Public\123.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	14331
Entropy (8bit):	3.512673497574481
Encrypted:	false
SSDEEP:	96:W6Zh/3dzz8XIrN2r1CdaqRWtHwBWgvw0Jy/ArUsJzu0HI:W6jhGIwxCdaqWQBWgvw0JyorBJzu0o
MD5:	6E378235FB49F30C9580686BA8A787AA
SHA1:	2FC76D9D615A35244133FC01AB7381BA49B0B149
SHA-256:	B4A0C0A98624C48A801D8EA071EC4A3D582826AC9637478814591BC6EA259D4A
SHA-512:	58558A1F8D9D3D6F0E21B1269313FD6AC9A80A93CC093A5E8CDEC495855FCD2FC95A6B54FE59E714E89D9274654BB9C1CD887B3FB9D4B9D9C50E5C5983C571B8
Malicious:	false
Preview:	# Copyright (c) 2013, Oracle and/or its affiliates. All rights reserved...# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms...#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..# This properties file defines a Hijrah calendar variant...#..# Fields:..#..# <version> ::= 'version' '=' <version string>..# <id> ::= 'id' '=' <id string>..# <type> ::= 'type' '=' <type string>..# <iso-start> ::= 'iso-start' '=' <start date in the ISO calendar>..# <year> ::= <yyyy> '=' <nn nn nn nn nn nn nn nn nn nn nn nn>..#..# version ... (Required)..#..# id ... (Required)..# Identifies the Java Chronology..#..# type ... (Required)..# Identifies the type of calendar in the standard calendar ID scheme..# iso-start ... (Required)..# Specifies the corresponding ISO date to the first Hijrah day..# in the defined range of dates..#..# year ... (Required)..# Number of days for each month of a Hijrah year..# * Each line defines a ye

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\i386\jvm.cfg

Download File

Process:	C:\Users\Public\123.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	657
Entropy (8bit):	4.993355967240905
Encrypted:	false
SSDEEP:	12:QcwmIzDpneoeoeoeoeoeoeoeoeoeoeoeoeoeoeoeoeoeoeoe9B7aEiwoXH3Eoe4Q:QhDpemaoXHIB5foMS1JUqf07f
MD5:	9FD47C1A487B79A12E90E7506469477B
SHA1:	7814DF0FF2EA1827C75DCD73844CA7F025998CC6
SHA-256:	A73AEA3074360CF62ADEDC0C82BC9C0C36C6A777C70DA6C544D0FBA7B2D8529E
SHA-512:	97B9D4C68AC4B534F86EFA9AF947763EE61AEE6086581D96CBF7B3DBD6FD5D9DB4B4D16772DCE6F347B44085CEF8A6EA3BFD3B84FBD9D4EF763CEF39255FBCE3
Malicious:	false
Preview:	# Copyright (c) 2001, 2013, Oracle and/or its affiliates. All rights reserved...# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms...#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..# List of JVMs that can be used as an option to java, javac, etc...# Order is important -- first in this list is the default JVM...# NOTE that this both this file and its format are UNSUPPORTED and..# WILL GO AWAY in a future release...#..# You may also select a JVM in an arbitrary location with the..# "-XXaltjvm=<jvm_dir>" option, but that too is unsupported..# and may not be available in a future release...#..-client KNOWN..-server KNOWN..

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\images\cursors\cursors.properties

Download File

Process:	C:\Users\Public\123.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	5.02145006262851
Encrypted:	false
SSDEEP:	24:n3lG0Bf4dJ0qEAmG620WKG0WBph8T2AGjGg0kz8lrbfOi7:3E0Bf4qrzrlWzy+ckUfP
MD5:	01B94C63BD5E6D094E84FF3AD640FFBF
SHA1:	5570F355456250B1EC902375B0257584DB2360AE
SHA-256:	52845DEB58038B4375C30B75DD2053726872758C96597C7CC5D6CEF11F42A2BA
SHA-512:	816BE2271CF3ECF10EE40E24A288CE302B2810010BEF76EFC0CE5746591955921B70F19005335F485D61A7B216DCCE0B06750831720DD426D07709154D5FAC7A
Malicious:	false
Preview:	#..#..# Cursors Properties file..#..# Names GIF89 sources for Custom Cursors and their associated HotSpots..#..# Note: the syntax of the property name is significant and is parsed..# by java.awt.Cursor..#..# The syntax is: Cursor.<name>.<geom>.File=win32_<filename>..# Cursor.<name>.<geom>.HotSpot=<x>,<y>..#. Cursor.<name>.<geom>.Name=<localized name>..#..Cursor.CopyDrop.32x32.File=win32_CopyDrop32x32.gif..Cursor.CopyDrop.32x32.HotSpot=0,0..Cursor.CopyDrop.32x32.Name=CopyDrop32x32..#..Cursor.MoveDrop.32x32.File=win32_MoveDrop32x32.gif..Cursor.MoveDrop.32x32.HotSpot=0,0..Cursor.MoveDrop.32x32.Name=MoveDrop32x32..#..Cursor.LinkDrop.32x32.File=win32_LinkDrop32x32.gif..Cursor.LinkDrop.32x32.HotSpot=0,0..Cursor.LinkDrop.32x32.Name=LinkDrop32x32..#..Cursor.CopyNoDrop.32x32.File=win32_CopyNoDrop32x32.gif..Cursor.CopyNoDrop.32x32.HotSpot=6,2..Cursor.CopyNoDrop.32x32.Name=CopyNoDrop32x32..#..Cursor.MoveNoDrop.32x32.File=win32_MoveNoDrop32x32.gif..Cursor.MoveNoDrop.32x32.Ho

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\images\cursors\invalid32x32.gif

Download File

Process:	C:\Users\Public\123.exe
File Type:	GIF image data, version 89a, 32 x 32
Category:	dropped
Size (bytes):	153
Entropy (8bit):	6.2813106319833665
Encrypted:	false
SSDEEP:	3:Csl7X/7/xlXlLaFGkDPF4V0Pee1F/sjtH5ybOCb1C3sxlWn:NljDjkFHF4V0Peene15tutsn
MD5:	1E9D8F133A442DA6B0C74D49BC84A341
SHA1:	259EDC45B4569427E8319895A444F4295D54348F
SHA-256:	1A1D3079D49583837662B84E11D8C0870698511D9110E710EB8E7EB20DF7AE3B
SHA-512:	63D6F70C8CAB9735F0F857F5BF99E319F6AE98238DC7829DD706B7D6855C70BE206E32E3E55DF884402483CF8BEBAD00D139283AF5C0B85DC1C5BF8F253ACD37
Malicious:	false
Preview:	GIF89a . ................!.......,.... . ...j.?...o..T....._]-..9.`..D...f........^...n.`.%C......<..E..S&QL.....n+...R....'\|N...."U........(8HXhx.X..;

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\images\cursors\win32_CopyDrop32x32.gif

Download File

Process:	C:\Users\Public\123.exe
File Type:	GIF image data, version 89a, 31 x 32
Category:	dropped
Size (bytes):	165
Entropy (8bit):	6.347455736310776
Encrypted:	false
SSDEEP:	3:CruuU/XExlHrBwM7Qt/wCvTjh2Azr8ptBNKtWwUzJ7Ful5u44JyYChWn:KP0URwMcx3UAzADBNwUlBul5TLYMWn
MD5:	89CDF623E11AAF0407328FD3ADA32C07
SHA1:	AE813939F9A52E7B59927F531CE8757636FF8082
SHA-256:	13C783ACD580DF27207DABCCB10B3F0C14674560A23943AC7233DF7F72D4E49D
SHA-512:	2A35311D7DB5466697D7284DE75BABEE9BD0F0E2B20543332FCB6813F06DEBF2457A9C0CF569449C37F371BFEB0D81FB0D219E82B9A77ACC6BAFA07499EAC2F7
Malicious:	false
Preview:	GIF89a.. ................!.......,...... ...vL...-....F....o.U.8J..'J.....3...a...."...")..=fPHS......h.Zc.KDj........k.-mF.. V..9'......f.T....w.xW.B.....P..;

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif

Download File

Process:	C:\Users\Public\123.exe
File Type:	GIF image data, version 89a, 32 x 32
Category:	dropped
Size (bytes):	153
Entropy (8bit):	6.2813106319833665
Encrypted:	false
SSDEEP:	3:Csl7X/7/xlXlLaFGkDPF4V0Pee1F/sjtH5ybOCb1C3sxlWn:NljDjkFHF4V0Peene15tutsn
MD5:	1E9D8F133A442DA6B0C74D49BC84A341
SHA1:	259EDC45B4569427E8319895A444F4295D54348F
SHA-256:	1A1D3079D49583837662B84E11D8C0870698511D9110E710EB8E7EB20DF7AE3B
SHA-512:	63D6F70C8CAB9735F0F857F5BF99E319F6AE98238DC7829DD706B7D6855C70BE206E32E3E55DF884402483CF8BEBAD00D139283AF5C0B85DC1C5BF8F253ACD37
Malicious:	false
Preview:	GIF89a . ................!.......,.... . ...j.?...o..T....._]-..9.`..D...f........^...n.`.%C......<..E..S&QL.....n+...R....'\|N...."U........(8HXhx.X..;

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\images\cursors\win32_LinkDrop32x32.gif

Download File

Process:	C:\Users\Public\123.exe
File Type:	GIF image data, version 89a, 31 x 32
Category:	dropped
Size (bytes):	168
Entropy (8bit):	6.465243369905675
Encrypted:	false
SSDEEP:	3:CruuU/XExlHrZauowM7Qt/wCvTjh2Azr8ptBNKtWwUzJZmQYRNbC1MIQvEn:KP0UpawMcx3UAzADBNwUlZaCzn
MD5:	694A59EFDE0648F49FA448A46C4D8948
SHA1:	4B3843CBD4F112A90D112A37957684C843D68E83
SHA-256:	485CBE5C5144CFCD13CC6D701CDAB96E4A6F8660CBC70A0A58F1B7916BE64198
SHA-512:	CF2DFD500AF64B63CC080151BC5B9DE59EDB99F0E31676056CF1AFBC9D6E2E5AF18DC40E393E043BBBBCB26F42D425AF71CCE6D283E838E67E61D826ED6ECD27
Malicious:	false
Preview:	GIF89a.. ................!.......,...... ...yL...-....F....o.U.8J..'J.....3...a...."...")..=fPHS......h.Zc.KDj........k.-mF.6.'.....`1]......u.Q.r.V..C......f.P..;

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

Download File

Process:	C:\Users\Public\123.exe
File Type:	GIF image data, version 89a, 32 x 32
Category:	dropped
Size (bytes):	153
Entropy (8bit):	6.2813106319833665
Encrypted:	false
SSDEEP:	3:Csl7X/7/xlXlLaFGkDPF4V0Pee1F/sjtH5ybOCb1C3sxlWn:NljDjkFHF4V0Peene15tutsn
MD5:	1E9D8F133A442DA6B0C74D49BC84A341
SHA1:	259EDC45B4569427E8319895A444F4295D54348F
SHA-256:	1A1D3079D49583837662B84E11D8C0870698511D9110E710EB8E7EB20DF7AE3B
SHA-512:	63D6F70C8CAB9735F0F857F5BF99E319F6AE98238DC7829DD706B7D6855C70BE206E32E3E55DF884402483CF8BEBAD00D139283AF5C0B85DC1C5BF8F253ACD37
Malicious:	false
Preview:	GIF89a . ................!.......,.... . ...j.?...o..T....._]-..9.`..D...f........^...n.`.%C......<..E..S&QL.....n+...R....'\|N...."U........(8HXhx.X..;

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\images\cursors\win32_MoveDrop32x32.gif

Download File

Process:	C:\Users\Public\123.exe
File Type:	GIF image data, version 89a, 31 x 32
Category:	dropped
Size (bytes):	147
Entropy (8bit):	6.147949937659802
Encrypted:	false
SSDEEP:	3:CruuU/XExlHrSauZKwM7Qt/wCvTjh2Azr8ptBNKtWXOh6WoXt2W:KP0UvEKwMcx3UAzADBNXOh6h9p
MD5:	CC8DD9AB7DDF6EFA2F3B8BCFA31115C0
SHA1:	1333F489AC0506D7DC98656A515FEEB6E87E27F9
SHA-256:	12CFCE05229DBA939CE13375D65CA7D303CE87851AE15539C02F11D1DC824338
SHA-512:	9857B329ACD0DB45EA8C16E945B4CFA6DF9445A1EF457E4B8B40740720E8C658301FC3AB8BDD242B7697A65AE1436FD444F1968BD29DA6A89725CDDE1DE387B8
Malicious:	false
Preview:	GIF89a.. ................!.......,...... ...dL...-....F....o.U.8J..'J.....3...a...."...")..=fPHS......h.Zc.KDj.....-.kj..m.....X,&.......S..;

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Download File

Process:	C:\Users\Public\123.exe
File Type:	GIF image data, version 89a, 32 x 32
Category:	dropped
Size (bytes):	153
Entropy (8bit):	6.2813106319833665
Encrypted:	false
SSDEEP:	3:Csl7X/7/xlXlLaFGkDPF4V0Pee1F/sjtH5ybOCb1C3sxlWn:NljDjkFHF4V0Peene15tutsn
MD5:	1E9D8F133A442DA6B0C74D49BC84A341
SHA1:	259EDC45B4569427E8319895A444F4295D54348F
SHA-256:	1A1D3079D49583837662B84E11D8C0870698511D9110E710EB8E7EB20DF7AE3B
SHA-512:	63D6F70C8CAB9735F0F857F5BF99E319F6AE98238DC7829DD706B7D6855C70BE206E32E3E55DF884402483CF8BEBAD00D139283AF5C0B85DC1C5BF8F253ACD37
Malicious:	false
Preview:	GIF89a . ................!.......,.... . ...j.?...o..T....._]-..9.`..D...f........^...n.`.%C......<..E..S&QL.....n+...R....'\|N...."U........(8HXhx.X..;

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\javafx.properties

Download File

Process:	C:\Users\Public\123.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.4779965120705425
Encrypted:	false
SSDEEP:	3:CEBqRM9LTAGQdLV6ETEBqRM9LHQIuHPy:CEAsnAbLlszQdy
MD5:	3C2B9CCAAD3D986E5874E8C0F82C37CF
SHA1:	D1DDA4A2D5D37249C8878437DBF36C6AE61C33D1
SHA-256:	D5BCD7D43E383D33B904CFF6C80ACE359DBE2CE2796E51E9743358BD650E4198
SHA-512:	4350CCA847D214479C6AE430EB71EE98A220EA10EC175D0AB317A8B43ABC9B4054E41D0FF383F26D593DE825F761FB93704E37292831900F31E5E38167A41BAB
Malicious:	false
Preview:	javafx.runtime.version=8.0.101..javafx.runtime.build=b13..

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\javaws.jar

Download File

Process:	C:\Users\Public\123.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	476286
Entropy (8bit):	7.905283162751186
Encrypted:	false
SSDEEP:	12288:k4VtaECp5plmgYhuWvHuR9Ta/+Aw7okxygk+W:kUChlHYHMaHw7XxW
MD5:	5D8C1723F3005BD63DBA2B478CE15621
SHA1:	AB26A6167789DCF81A0C40D121DC91005804C703
SHA-256:	B637B78CFC33C92D4838D5FABFD0647CE03C3EF69D86EF6A7E6F229510AAF3B5
SHA-512:	9830CCDFE913A492BB4E0015EE3E729BEA8EC1F22EDF48ED7CE2AEFD5376DF24F33948B9155E31EDFA9BC240544406FD2C43A34DD1366E4936B3318D3CA5ED1C
Malicious:	false
Preview:	PK...........H................META-INF/....PK...........H...7Z...e.......META-INF/MANIFEST.MF.M..LK-...K-...R0.3..r.C.q,HL.HU...%...y...R.KRSt....L....u....4....sR......K..5y.x..PK...........H................com/PK...........H................com/sun/PK...........H................com/sun/javaws/PK...........H................com/sun/javaws/exceptions/PK...........H................com/sun/javaws/jnl/PK...........H................com/sun/javaws/net/PK...........H................com/sun/javaws/net/protocol/PK...........H............ ...com/sun/javaws/net/protocol/jar/PK...........H................com/sun/javaws/progress/PK...........H................com/sun/javaws/security/PK...........H................com/sun/javaws/ui/PK...........H................com/sun/javaws/util/PK...........H................com/sun/jnlp/PK...........H................javax/PK...........H................javax/jnlp/PK...........H~p4=........#...com/sun/javaws/BrowserSupport.class.RMO.1.}...].H @.\|.\|(...P..B.....

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\jce.jar

Download File

Process:	C:\Users\Public\123.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	114950
Entropy (8bit):	7.912507028584016
Encrypted:	false
SSDEEP:	1536:5sNJO+ylt6se6sgU0w/XzGYWuSy15DudYLSfaxwpt5g1naZEqwoJ8sYcF+z/VSG8:aj8GHXZSy1pudYLdQe1ATtKVS+ws9O
MD5:	A39F61D6ED2585519D7AF1E2EA029F59
SHA1:	52515AC6DEAB634F3495FD724DEA643EE442B8FD
SHA-256:	60724D9E372FBE42759349A06D3426380CA2B9162FA01EB2C3587A58A34AD7E0
SHA-512:	AC2E9AB749F5365BE0FB8EBD321E8F231D22EAE396053745F047FCBCCF8D3DE2F737D3C37A52C715ADDFBDBD18F14809E8B37B382B018B58A76E063EFBA96948
Malicious:	false
Preview:	PK........gwHG................META-INF/MANIFEST.MF.Y....Y.C,j.m.,....z..I &1.m....b........D..+.$t......]....h.o......x...~..?..<@....7#n3.......m../\..u..>.....#......~.K..A..x ..../J...xa..,.._...G...?^...{...>.uj.AQ?^h....c_.pc..W....c.A..`....-.~ak.....^.&.......l.......X.kG.~yg..f......Z..b..L\|......4....`..}........mG.o.....kU..;W.HCU....e.....V..,...1Y.z<.n.A.j.....P..S.($,z........uD".9;..q...k.:p3pW......O...(....\.B...2...#.,.;w.q..k0r.el\F.^.!p..$.....}.9..lhf.P..:.E.&Lf..5.7....W.A.....[7.N}..+.J!.9.Gl.... ...rL.B}.Q.,.'.....@...W.ry[Ok&.......o...dp%..2.\.[2.........fB.p..Xd._.lA....xw..`.r..8...o.....ad}-..;...6....e...F.&e\....'...fA.Db.......%.@..^..U.....q<.Z.K.T...."r.b...7@8.)4..~.4b....Y.q..u..N..\|...e.#.I....4c{.....g.R....]......F.fo.F.u.).F.Z]..(.c\|s....u.i..8..=..N%....]...)Xj\..t..w..ql..n.....2..u...\|x$7YL.M.?..]..W...m^].~...{....I..{......[-..].f....Sc..c..6..kN.>....7x.k..a7S......8..e.w....*......&.;.

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\jfr.jar

Download File

Process:	C:\Users\Public\123.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	560553
Entropy (8bit):	5.781566946934384
Encrypted:	false
SSDEEP:	12288:G5l+qU67FYWg+YWgYWeoXqgYSq8eh2f/m5NwaHkSIJHvWQ6Q7ooMcgH5lY7TQ5cD:G5l+qU67FYWg+YWgYWeoXqgYSq8eh2f3
MD5:	CCB395235C35C3ACBA592B21138CC6AB
SHA1:	29C463AA4780F13E77FB08CC151F68CA2B2958D5
SHA-256:	27AD8EA5192EE2D91BA7A0EACE9843CB19F5E145259466158C2F48C971EB7B8F
SHA-512:	D4C330741387F62DD6E52B41167CB11ABD8615675FE7E1C14AE05A52F87A348CBC64B56866AE313B2906B33CE98BE73681F769A4A54F6FE9A7D056F88CF9A4E1
Malicious:	false
Preview:	PK........t..H................META-INF/....PK........t..H.s0>...>.......META-INF/MANIFEST.MFManifest-Version: 1.0..Implementation-Vendor: Oracle Corporation..Implementation-Title: Java Runtime Environment..Implementation-Version: 1.8.0_101..Specification-Vendor: Oracle Corporation..Created-By: 1.7.0_07 (Oracle Corporation)..Specification-Title: Java Platform API Specification..Specification-Version: 1.8....PK...........HB.<>^...^...8...com/oracle/jrockit/jfr/client/EventSettingsBuilder.class.......4....5.f..g....f..4.h..4.i..j....f..4.k..l....m..4.n..o....f..4.p..q..r....f....s....t....u....v..w..x..y....z..{....\|....}....~.................................#.........................)...................................................eventDefaultSets...Ljava/util/ArrayList;...Signature..DLjava/util/ArrayList<Loracle/jrockit/jfr/settings/EventDefaultSet;>;...settings..ALjava/util/ArrayList<Loracle/jrockit/jfr/settings/EventSetting;>;...eventDescriptorType..2Loracle/jrockit/jfr/openmbean/

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\jfr\default.jfc

Download File

Process:	C:\Users\Public\123.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	20670
Entropy (8bit):	4.627043889535612
Encrypted:	false
SSDEEP:	192:VOMjUVCEM0Ut0ZINFWbqsZSwOVzx8xyxxxbAJ1muS7khPdyPsXZd2ZhptEgReW82:VONVTVgF9SsTMLA
MD5:	47495DA4E7B3AF33F5C3ED1E35AC25AE
SHA1:	F6DE88A4C6AE0C14B9F875FB4BC4721A104CB0EE
SHA-256:	37D19EAC73DEEB613FBB539AE7E7C99339939EB3EFEC44E9EB45F68426E9F159
SHA-512:	74DBEB118575B8881D5B43270EF878162DBDC222AC6D20F04699B2B733427347ABC76D6E82BF7728FCC435129B114E4C75D011FC5DDDEAF5A59E137BBC81F2B9
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.... .. Recommended way to edit .jfc files is to use Java Mission Control,.. see Window -> Flight Recorder Template Manager...-->....<configuration version="1.0" name="Continuous" description="Low overhead configuration safe for continuous use in production environments, typically less than 1 % overhead." provider="Oracle">.... <producer uri="http://www.oracle.com/hotspot/jvm/" label="Oracle JDK">.... <control>.... .. Contents of the control element is not read by the JVM, it's used.. by Java Mission Control to change settings that carry the control attribute... -->.... <selection name="gc-level" default="detailed" label="Garbage Collector">.. <option label="Off" name="off">off</option>.. <option label="Normal" name="detailed">normal</option>.. <option label="All" name="all">all</option>.. </selection>.... <condition name="gc-enabled-normal" true="true" false="fals

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\jfr\profile.jfc

Download File

Process:	C:\Users\Public\123.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	20626
Entropy (8bit):	4.626761353117893
Encrypted:	false
SSDEEP:	192:VeMjUECOwMsUt0ZINFWbqeZSwOVza8ayaxabAJ1duSikhPdyPsXZd2ZhptEgReWL:VeNEg/gF/ZnixLy
MD5:	5480BEF2CA99090857E5CBF225C12A78
SHA1:	E1F73CA807EC14941656FBE3DB6E5E5D9032041D
SHA-256:	5FB0982C99D6BF258335FB43AAAE91919804C573DFD87B51E05C54ADB3C0392B
SHA-512:	65FE0D6DA17E62CF29875910EB84D57BC5BB667C753369B4F810028C0995E63C322FAD2EB99658B6C19E11E8D2A40CB11B3C09943EB9C0B88F45626579ECE058
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.... .. Recommended way to edit .jfc files is to use Java Mission Control,.. see Window -> Flight Recorder Template Manager...-->....<configuration version="1.0" name="Profiling" description="Low overhead configuration for profiling, typically around 2 % overhead." provider="Oracle">.... <producer uri="http://www.oracle.com/hotspot/jvm/" label="Oracle JDK">.... <control>.... .. Contents of the control element is not read by the JVM, it's used.. by Java Mission Control to change settings that carry the control attribute... -->.... <selection name="gc-level" default="detailed" label="Garbage Collector">.. <option label="Off" name="off">off</option>.. <option label="Normal" name="detailed">normal</option>.. <option label="All" name="all">all</option>.. </selection>.... <condition name="gc-enabled-normal" true="true" false="false">.. <or>.. <test name="

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\jfxswt.jar

Download File

Process:	C:\Users\Public\123.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	33932
Entropy (8bit):	7.930702746433849
Encrypted:	false
SSDEEP:	768:xYJfTGikW6VajSe/SA5vN9kqizE48ojVxQYuW+t:xY5TpkK/nFNIzptjVxYHt
MD5:	C401E00A5DE0DD9723885CEF9E2F5A44
SHA1:	B6735B93811517F062A20869D8A0B57FAEFF6A90
SHA-256:	C6574F4763696F2A83028DE143D9ED1C975062BA2D44CC5C91558751FB84BCD6
SHA-512:	595B950AD5BFF930654BF7FB996BA222D19B4F175821AB0FD6EC4F54D4B7D62B37757429051D1302BC438AB76350B4CD0A07BA712CAECC79DCDB0C60494B5AB2
Malicious:	false
Preview:	PK...........H................META-INF/....PK...........H.E..Z...g.......META-INF/MANIFEST.MF.M..LK-...K-...R0.3..r.C.q,HL.HU...%-..x...R.KRSt.A.-...M.t....4....sR......K..5y.x..PK...........H................javafx/PK...........H................javafx/embed/PK...........H................javafx/embed/swt/PK...........Hj...........%...javafx/embed/swt/CustomTransfer.class.T[S.F.=.MX(..!............8..`h.d....." yd..........4....%..k.N..ka.83..[.....\|+...........#.OD..1...1.1.S1....>..I..TL.....Y...S.q.-KAja..6.M.Y7V\|.v...e............+...u...Z.....Z......k...O.v.....x..f...M.v...~I....j.N.(.R.... ..n.%).l:.N..,J...-.%.os:.v.K..V.._p.u.l..e...S5...^.....3+.Yy.h.RtGR..y.)..~...g..R.;5K...{.G...X.JP....D....8..[3.g...'d.e#Z.\|c.j.t..F.w..t.W.j.,K[q.^..E.=M.a..6d.Z..yV.....=..........:.WG.............RA.<......qT...,.=.....t\......(aI.2.....!..Jp.,..<.x..n.S....N.K.e.W....N.-..`....hmQ.E.fGE..$..n...4I{.......l_.)......?.Z>...t

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\jsse.jar

Download File

Process:	C:\Users\Public\123.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	633957
Entropy (8bit):	6.018176262975427
Encrypted:	false
SSDEEP:	6144:ABoQeW0HKwYGORU+ehqEmke1WEAibVR0GPs4j8GgflXhuuMAjYDTj:Uo40WGdNmpb3DP75
MD5:	FD1434C81219C385F30B07E33CEF9F30
SHA1:	0B5EE897864C8605EF69F66DFE1E15729CFCBC59
SHA-256:	BC3A736E08E68ACE28C68B0621DCCFB76C1063BD28D7BD8FCE7B20E7B7526CC5
SHA-512:	9A778A3843744F1FABAD960AA22880D37C30B1CAB29E123170D853C9469DC54A81E81A9070E1DE1BF63BA527C332BB2B1F1D872907F3BDCE33A6898A02FEF22D
Malicious:	false
Preview:	PK........u..H................META-INF/....PK........u..H.s0>...>.......META-INF/MANIFEST.MFManifest-Version: 1.0..Implementation-Vendor: Oracle Corporation..Implementation-Title: Java Runtime Environment..Implementation-Version: 1.8.0_101..Specification-Vendor: Oracle Corporation..Created-By: 1.7.0_07 (Oracle Corporation)..Specification-Title: Java Platform API Specification..Specification-Version: 1.8....PK...........H....E...E...+...com/sun/net/ssl/internal/ssl/Provider.class.......4...............................serialVersionUID...J...ConstantValue.,..c".J-...<init>...()V...Code...LineNumberTable...(Ljava/security/Provider;)V...(Ljava/lang/String;)V...isFIPS...()Z...install...SourceFile...Provider.java......................%com/sun/net/ssl/internal/ssl/Provider...sun/security/ssl/SunJSSE.1.......................................!...........................)................"........+......................./............."........+...................3...4.)........................

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\jvm.hprof.txt

Download File

Process:	C:\Users\Public\123.exe
File Type:	Algol 68 source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4312
Entropy (8bit):	4.756104846669624
Encrypted:	false
SSDEEP:	96:6VprYJmprYJD9Y3t3qFKPG7hLxVJgdTsfbFfcwQoPv:6HrsursD9Y3t36KPG7HyoBQoX
MD5:	AD91D69A4129D31D72FBE288FF967943
SHA1:	CB510AFCDBECEA3538C3F841C0440194573DBB65
SHA-256:	235A50D958FAEDDE808D071705A6D603F97611F568EEC40D7444984B984A4B18
SHA-512:	600BEE4676D26E2CE5B9171582540021509A4D7888C9C7BADC14F0FAD07007E4CE2B4C007A8EB15BD0D977722B8B34442012EA972FFBD72797475A56CDFD86EE
Malicious:	false
Preview:	Copyright (c) 2003, 2005, Oracle and/or its affiliates. All rights reserved.....Redistribution and use in source and binary forms, with or without..modification, are permitted provided that the following conditions..are met:.... - Redistributions of source code must retain the above copyright.. notice, this list of conditions and the following disclaimer..... - Redistributions in binary form must reproduce the above copyright.. notice, this list of conditions and the following disclaimer in the.. documentation and/or other materials provided with the distribution..... - Neither the name of Oracle nor the names of its.. contributors may be used to endorse or promote products derived.. from this software without specific prior written permission.....THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS..IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,..THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR..PURP

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\logging.properties

Download File

Process:	C:\Users\Public\123.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2514
Entropy (8bit):	4.525846572478507
Encrypted:	false
SSDEEP:	48:/GXieQT8cg6ZGBjn4stbaWUwO61xFMxO9:OXieW8nBjn4x613Mw9
MD5:	0AA5D5EFDB4F2B92BEBBEB4160AA808B
SHA1:	C6F1B311A4D0790AF8C16C1CA9599D043BA99E90
SHA-256:	A3148336160EA7EF451052D1F435F7C9D96EEB738105AC730358EDADA5BD45A2
SHA-512:	A52C2B784CF0B01A2AF3066F4BB8E7FD890A86CFD82359A22266341942A25333D4C63BA2C02AA43ADE872357FC9C8BBC60D311B2AF2AD2634D60377A2294AFDD
Malicious:	false
Preview:	############################################################..# .Default Logging Configuration File..#..# You can use a different file by specifying a filename..# with the java.util.logging.config.file system property. ..# For example java -Djava.util.logging.config.file=myfile..############################################################....############################################################..# .Global properties..############################################################....# "handlers" specifies a comma separated list of log Handler ..# classes. These handlers will be installed during VM startup...# Note that these classes must be on the system classpath...# By default we only configure a ConsoleHandler, which will only..# show messages at the INFO and above levels...handlers= java.util.logging.ConsoleHandler....# To also add the FileHandler, use the following line instead...#handlers= java.util.logging.FileHandler, java.util.logging.ConsoleHandler....# Default global

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\management-agent.jar

Download File

Process:	C:\Users\Public\123.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	381
Entropy (8bit):	4.99308306420453
Encrypted:	false
SSDEEP:	6:5ji0B4r/Rjiszbdy/oocj+sqX2K5YZ5/CUMQxxi6m4xijgxmzbdGh/4:5ji0GJjiIq1cCvXPA/CUMQxoeocx2K/4
MD5:	B608D45DCDD7A4CAD6A63A89A002F683
SHA1:	F6E3BB7050C3B1A3BED9B33122C4A98E6B9A810D
SHA-256:	52CA96531445B437DCA524CB3714FCD8D70221D37A6B9C80F816713C3040DD0A
SHA-512:	407E7CA807826F0E41B085BCA0F54F0134E3B9AC16FA5480EDE02774067DAD46AA07D225BA2981DEC2A7297EA57721EAB8C54E8BED83D352EC6C00ABFDBBF626
Malicious:	false
Preview:	PK........t..H................META-INF/......PK..............PK........t..H................META-INF/MANIFEST.MF.M..LK-...K-...R0.3..r.JM,IM.u.........+h..%&.8.....%...k.r9....:.$..[).....&.%....E..r.\.E....y...r..PK.....k.......PK..........t..H..............................META-INF/....PK..........t..H...k.....................=...META-INF/MANIFEST.MFPK..........}.........

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\management\jmxremote.access

Download File

Process:	C:\Users\Public\123.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4077
Entropy (8bit):	4.472483528668558
Encrypted:	false
SSDEEP:	96:eii7cSoFKfgCe/D4dtQN+wvohSoVGPbPvRZUIpeDMy:eiiISokfXeEk+wQhnMPbnRZR7y
MD5:	41B36D832BE39A3CF0F3D7760E55FDCB
SHA1:	E706E9BE75604A13DFCC5A96B1720A544D76348B
SHA-256:	71A930CBE577CBABB4269650C98D227F739E0D4B9C0B44830DD3D52F5015BE1F
SHA-512:	41E6B8639C1CEB3D09D2FDEEEBA89FFA17C4ED8B1AD0DF1E5AB46C4BF178688D5504DC5A3C854226F7DA23DFA0EDAB0D035D6B56495829F43AAA2A7BABEC4273
Malicious:	false
Preview:	######################################################################..# Default Access Control File for Remote JMX(TM) Monitoring..######################################################################..#..# Access control file for Remote JMX API access to monitoring...# This file defines the allowed access for different roles. The..# password file (jmxremote.password by default) defines the roles and their..# passwords. To be functional, a role must have an entry in..# both the password and the access files...#..# The default location of this file is $JRE/lib/management/jmxremote.access..# You can specify an alternate location by specifying a property in ..# the management config file $JRE/lib/management/management.properties..# (See that file for details)..#..# The file format for password and access files is syntactically the same..# as the Properties file format. The syntax is described in the Javadoc..# for java.util.Properties.load...# A typical access file has multiple

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\management\jmxremote.password.template

Download File

Process:	C:\Users\Public\123.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2920
Entropy (8bit):	4.545881645777106
Encrypted:	false
SSDEEP:	48:MRSflLrmpop7JN/PgP8KAeoYsnZyhNMVJKWfVStEqwP0pba:Mkv7ngUZYsnRnfYdhE
MD5:	5DD28AAF5A06C946DF7B223F33482FDF
SHA1:	D09118D402CA3BA625B165ECACE863466D7F4CE9
SHA-256:	24674176A4C0E5EEFB9285691764EA06585D90BBDAF5BF40C4220DE7CA3E3175
SHA-512:	13C6F37E969A5AECE2B2F938FA8EBF6A72C0C173678A026E77C35871E4AE89404585FB1A3516AE2CA336FC47EAB1F3DD2009123ADBA9C437CD76BA654401CBDF
Malicious:	false
Preview:	# ----------------------------------------------------------------------..# Template for jmxremote.password..#..# o Copy this template to jmxremote.password..# o Set the user/password entries in jmxremote.password..# o Change the permission of jmxremote.password to read-only..# by the owner...#..# See below for the location of jmxremote.password file...# ----------------------------------------------------------------------....##############################################################..# Password File for Remote JMX Monitoring..##############################################################..#..# Password file for Remote JMX API access to monitoring. This..# file defines the different roles and their passwords. The access..# control file (jmxremote.access by default) defines the allowed..# access for each role. To be functional, a role must have an entry..# in both the password and the access files...#..# Default location of this file is $JRE/lib/management/jmx

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\management\management.properties

Download File

Process:	C:\Users\Public\123.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	14415
Entropy (8bit):	4.623139916889837
Encrypted:	false
SSDEEP:	192:PLrOKIXaIr8Jzc90OEqfmdbHHHN6pDIdpgzri:PLrOKIXaIgYiOE0mdbHHHNGD4p0+
MD5:	054E093240388F0322604619EF643F18
SHA1:	6E110C2A5D813013E9C57700BE8B0D17896E950C
SHA-256:	BF41D73EAB0DA8222FE24255E1BBF68327FB02B1A4F1E7A81B9C7B539033FFB2
SHA-512:	BD60C6271CDEFFFF4563E6E2CF97C176D86F160092D1FFCBE7EEFE714BA75DDC5FB4E848A5FDBE7A1D1510720D92AF6A176A76DE2CC599F27E4BEAE8E692C5D3
Malicious:	false
Preview:	#####################################################################..#.Default Configuration File for Java Platform Management..#####################################################################..#..# The Management Configuration file (in java.util.Properties format)..# will be read if one of the following system properties is set:..# -Dcom.sun.management.jmxremote.port=<port-number>..# or -Dcom.sun.management.snmp.port=<port-number>..# or -Dcom.sun.management.config.file=<this-file>..#..# The default Management Configuration file is:..#..# $JRE/lib/management/management.properties..#..# Another location for the Management Configuration File can be specified..# by the following property on the Java command line:..#..# -Dcom.sun.management.config.file=<this-file>..#..# If -Dcom.sun.management.config.file=<this-file> is set, the port..# number for the management agent can be specified in the config file..# using the following lines:..#..# ################ Management Agen

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\management\snmp.acl.template

Download File

Process:	C:\Users\Public\123.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3486
Entropy (8bit):	4.4357861198752975
Encrypted:	false
SSDEEP:	48:MlXHR6+76EX0o8KA0Esns+ek2OrRC9AUE4T7AKQi2r8BKS3GpPsDu0cpUxJAJKk3:M9HRb7l0FAEsnJKmS32X00h
MD5:	9D9EC1BB9E357BBFB72B077E4AF5F63F
SHA1:	6484B03DBE9687216429D3A6F916773C060E15CE
SHA-256:	8B02A29BC61B0F7203DF7CA94140F80D2C6A1138064E0441DFD621CF243A0339
SHA-512:	5FE39BBFCA806CE45871A6223D80FA731EFAA5D31C3B97EE055AB77EAF3833342945F39E9858335D9DD358B4B7F984FFADE741452E19B60B8E510AA74AC02C00
Malicious:	false
Preview:	# ----------------------------------------------------------------------..# Template for SNMP Access Control List File..#..# o Copy this template to snmp.acl..# o Set access control for SNMP support..# o Change the permission of snmp.acl to be read-only..# by the owner...#..# See below for the location of snmp.acl file...# ----------------------------------------------------------------------....############################################################..# SNMP Access Control List File ..############################################################..#..# Default location of this file is $JRE/lib/management/snmp.acl...# You can specify an alternate location by specifying a property in ..# the management config file $JRE/lib/management/management.properties..# or by specifying a system property (See that file for details)...#......##############################################################..# File permissions of the snmp.acl file..######################

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\meta-index

Download File

Process:	C:\Users\Public\123.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2126
Entropy (8bit):	4.970874214349507
Encrypted:	false
SSDEEP:	48:EE796OfeCiuG2M5tP5iMmC5KOAY2HQii+r4IzteKk:EnEiuGJbP5lmC5KOA3HQii+EIz8Kk
MD5:	91AA6EA7320140F30379F758D626E59D
SHA1:	3BE2FEBE28723B1033CCDAA110EAF59BBD6D1F96
SHA-256:	4AF21954CDF398D1EAE795B6886CA2581DAC9F2F1D41C98C6ED9B5DBC3E3C1D4
SHA-512:	03428803F1D644D89EB4C0DCBDEA93ACAAC366D35FC1356CCABF83473F4FEF7924EDB771E44C721103CEC22D94A179F092D1BFD1C0A62130F076EB82A826D7CB
Malicious:	false
Preview:	% VERSION 2..% WARNING: this file is auto-generated; do not edit..% UNSUPPORTED: this file and its format may change and/or..% may be removed in a future release..# charsets.jar..sun/nio..sun/awt..# jce.jar..javax/crypto..sun/security..META-INF/ORACLE_J.RSA..META-INF/ORACLE_J.SF..# jfr.jar..oracle/jrockit/..jdk/jfr..com/oracle/jrockit/..! jsse.jar..sun/security..com/sun/net/..! management-agent.jar..@ resources.jar..com/sun/java/util/jar/pack/..META-INF/services/sun.util.spi.XmlPropertiesProvider..META-INF/services/javax.print.PrintServiceLookup..com/sun/corba/..META-INF/services/javax.sound.midi.spi.SoundbankReader..sun/print..META-INF/services/javax.sound.midi.spi.MidiFileReader..META-INF/services/sun.java2d.cmm.CMMServiceProvider..javax/swing..META-INF/services/javax.sound.sampled.spi.AudioFileReader..META-INF/services/javax.sound.midi.spi.MidiDeviceProvider..sun/net..META-INF/services/javax.sound.sampled.spi.AudioFileWriter..com/sun/imageio/..META-INF/services/sun.java2d.pipe.Ren

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\net.properties

Download File

Process:	C:\Users\Public\123.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3144
Entropy (8bit):	4.858724831876285
Encrypted:	false
SSDEEP:	48:VBnTRxiW1nTbXMROXX6zcjd6vEzcoZDTzcj8L0zccfbb6wB:VBnvisPMQ6z+zPVzv0zVfvT
MD5:	1CBB261944925044B1EE119DC0563D05
SHA1:	05F2F63047F4D82F37DFA59153309E53CAA4675C
SHA-256:	5BAF75BDD504B2C80FF5B98F929A16B04E9CB06AA8AAE30C144B5B40FEBE0906
SHA-512:	C964A92BE25BACF11D20B61365930CAB28517D164D9AE4997651E2B715AA65628E45FA4BD236CCD507C65E5D85A470FD165F207F446186D22AE4BD46A04006E6
Malicious:	false
Preview:	############################################################..# .Default Networking Configuration File..#..# This file may contain default values for the networking system properties...# These values are only used when the system properties are not specified..# on the command line or set programatically...# For now, only the various proxy settings can be configured here...############################################################....# Whether or not the DefaultProxySelector will default to System Proxy..# settings when they do exist...# Set it to 'true' to enable this feature and check for platform..# specific proxy settings..# Note that the system properties that do explicitely set proxies..# (like http.proxyHost) do take precedence over the system settings..# even if java.net.useSystemProxies is set to true... ..java.net.useSystemProxies=false....#------------------------------------------------------------------------..# Proxy configuration for the various protocol handlers...# D

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\plugin.jar

Download File

Process:	C:\Users\Public\123.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	1012097
Entropy (8bit):	7.896417877823185
Encrypted:	false
SSDEEP:	24576:q7jNpf26MPAMSL/wxSz2ijt2eejo+oV3vv:6NVZEaL4xSljt2eHNV3
MD5:	54EF6C22FAAAE5850091031763078D37
SHA1:	11D40B78BB606E245CB5E17C6DDB08193A34B40E
SHA-256:	654B033B1DC315EB9806F0D35ABAF3F25064AC806292ACB2BD818F6B2DF2AD07
SHA-512:	10998B6508D5571E1ECE2001C6E561169D3DBD7580A3DE439067D1195FBE85E6BD1729A0874E306234391AF963E1B062050276E1AC0E9C9FA289711738B41B31
Malicious:	false
Preview:	PK........!..H................META-INF/....PK........ ..H...7Z...e.......META-INF/MANIFEST.MF.M..LK-...K-...R0.3..r.C.q,HL.HU...%...y...R.KRSt....L....u....4....sR......K..5y.x..PK...........H................com/PK...........H................com/sun/PK...........H................com/sun/deploy/PK...........H................com/sun/deploy/uitoolkit/PK...........H................com/sun/deploy/uitoolkit/impl/PK........!..H............"...com/sun/deploy/uitoolkit/impl/awt/PK...........H............#...com/sun/deploy/uitoolkit/impl/text/PK...........H................com/sun/deploy/uitoolkit/ui/PK...........H................com/sun/java/PK...........H................com/sun/java/browser/PK...........H................com/sun/java/browser/plugin2/PK...........H............)...com/sun/java/browser/plugin2/liveconnect/PK...........H............,...com/sun/java/browser/plugin2/liveconnect/v1/PK...........H................netscape/PK...........H................netscape/javascript/PK.........

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\psfont.properties.ja

Download File

Process:	C:\Users\Public\123.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2915
Entropy (8bit):	5.2172692442941075
Encrypted:	false
SSDEEP:	48:GgQv18IsTJvuUdEt6u7KeblbhGwQEvzZIE+i+WEi+Iq4fNSg2kv:Gb6Xha1hFGwQEvdh+5g2kv
MD5:	A38587427E422D55B012FA3E5C9436D2
SHA1:	7BD1B81B39DA78124BE045507E0681E860921DBB
SHA-256:	D2C47DE948033ED836B375CCD518CF55333FE11C4CED56BC1CE2FF62114CF546
SHA-512:	EA6CA975E9308ED2B3BBCCE91EE61142DAB0067CE8F17CB469929F6136E6B4A968BAC838141D8B38866F9EF5E15E156400859CCCC84FB114214E19556F0DC636
Malicious:	false
Preview:	#..#..# Copyright (c) 1996, 2000, Oracle and/or its affiliates. All rights reserved...# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms...#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#....#..#.Japanese PostScript printer property file..#..font.num=16..#..serif=serif..timesroman=serif..sansserif=sansserif..helvetica=sansserif..monospaced=monospaced..courier=monospaced..dialog=sansserif..dialoginput=monospaced..#..serif.latin1.plain=Times-Roman..serif.latin1.italic=Times-Italic..serif.latin1.bolditalic=Times-BoldItalic..serif.latin1.bold=Times-Bold..#..sansserif.latin1.plain=Helvetica..sansserif.latin1.italic=Helvetica-Oblique..sansserif.latin1.bolditalic=Helvetica-BoldOblique..sansserif.latin1.bold=Helvetica-Bold..#..monospaced.latin1.plain=Courier..monospaced.latin1.italic=Courier-Oblique..monospaced.latin1.bolditalic=Courier-BoldOblique..monospaced.latin1.bold=Courier-Bold..#..serif.x11jis0208.plain=Ryumin-Light-H..serif.x11jis0208.italic=Ryumin-Light-H

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\psfontj2d.properties

Download File

Process:	C:\Users\Public\123.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10716
Entropy (8bit):	5.016037435830914
Encrypted:	false
SSDEEP:	192:Jp22HdiEUEdWUcPeJ7fbdHmcbiLMWNDyZcy57ha1xh3qvfRdIdyJkW:u2HdiEUEdGY1gbD9TKdIdyJkW
MD5:	66B3E6770C291FE8CD3240FFBB00DC47
SHA1:	88CE9D723A2D4A07FD2032A8B4A742FE323EEC8F
SHA-256:	7EA6E05D3B8B51D03C3D6548E709C220541DF0F1AEE2E69B9101C9F051F7C17A
SHA-512:	D1B99AA011568AFFA415758C986B427588AE87FE5EB7FC52D519F7167AD46BBFF8B62799F14D8DBC7C55DEB6FF7259445D6E8882CC781D61206ED1B79B688745
Malicious:	false
Preview:	#..#..# Copyright (c) 1999, Oracle and/or its affiliates. All rights reserved...# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms...#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#....#..#.PostScript printer property file for Java 2D printing...#..# WARNING: This is an internal implementation file, not a public file...# Any customisation or reliance on the existence of this file and its..# contents or syntax is discouraged and unsupported...# It may be incompatibly changed or removed without any notice...#..#..font.num=35..#..# Legacy logical font family names and logical font aliases should all..# map to the primary logical font names...#..serif=serif..times=serif..timesroman=serif..sansserif=sansserif..helvetica=sansserif..dialog=sansserif..dialoginput=monospaced..monospaced=monospaced..courier=monospaced..#..# Next, physical fonts which can be safely mapped to standard postscript fonts..# These keys generally map to a value which is the same as the key, so

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\resources.jar

Download File

Process:	C:\Users\Public\123.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	3490933
Entropy (8bit):	6.067002853185717
Encrypted:	false
SSDEEP:	49152:WX4zfeUcKDQ1toKXiO3fLxqhH3YRazQwIK7XgnyRMvMtMm55HopLKbtJzUkMkOBV:GL
MD5:	9A084B91667E7437574236CD27B7C688
SHA1:	D8926CC4AA12D6FE9ABE64C8C3CB8BC0F594C5B1
SHA-256:	A1366A75454FC0F1CA5A14EA03B4927BB8584D6D5B402DFA453122AE16DBF22D
SHA-512:	D603AA29E1F6EEFFF4B15C7EBC8A0FA18E090D2E1147D56FD80581C7404EE1CB9D6972FCF2BD0CB24926B3AF4DFC5BE9BCE1FE018681F22A38ADAA278BF22D73
Malicious:	false
Preview:	PK...........H................META-INF/....PK...........H.s0>...>.......META-INF/MANIFEST.MFManifest-Version: 1.0..Implementation-Vendor: Oracle Corporation..Implementation-Title: Java Runtime Environment..Implementation-Version: 1.8.0_101..Specification-Vendor: Oracle Corporation..Created-By: 1.7.0_07 (Oracle Corporation)..Specification-Title: Java Platform API Specification..Specification-Version: 1.8....PK...........H....$...$.......META-INF/mailcap.default#.# This is a very simple 'mailcap' file.#.image/gif;;..x-java-view=com.sun.activation.viewers.ImageViewer.image/jpeg;;..x-java-view=com.sun.activation.viewers.ImageViewer.text/;;..x-java-view=com.sun.activation.viewers.TextViewer.text/;;..x-java-edit=com.sun.activation.viewers.TextEditor.PK...........H..{~2...2.......META-INF/mimetypes.default#.# A simple, old format, mime.types file.#.text/html..html htm HTML HTM.text/plain..txt text TXT TEXT.image/gif..gif GIF.image/ief..ief.image/jpeg..jpeg jpg jpe JPG.image/tiff..tiff tif.

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\rt.jar

Download File

Process:	C:\Users\Public\123.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	63602929
Entropy (8bit):	5.963369315504544
Encrypted:	false
SSDEEP:	786432:WyfysbZyGp7g85KKwcl0HeJgyll3LTjjA:F0GZTjjA
MD5:	EDB5B5B3EF4565E4E86BFFE647FB1AA2
SHA1:	11F5B1B2D729309059B1BD1FE2922251D9451D5F
SHA-256:	D00351BD39DE7DBF9E9FDBB9EE1FD82189189F9BC82E988B58E1E950D1D4BDC8
SHA-512:	05E7F9ED915610B70664EB7CB68F3F0BBA5BD5CF208BBDB54007DA5FF6311A6DDBBF057E0DF5A346C9042333C29E5C766B2C0A686628F8655C2E75061A9179C1
Malicious:	false
Preview:	PK...........H................META-INF/....PK...........H.5.%...%.......META-INF/MANIFEST.MFManifest-Version: 1.0..Implementation-Vendor: Oracle Corporation..Implementation-Title: Java Runtime Environment..Implementation-Version: 1.8.0_101..Specification-Vendor: Oracle Corporation..Created-By: 1.7.0_07 (Oracle Corporation)..Specification-Title: Java Platform API Specification..Specification-Version: 1.8....Name: javax/swing/JCheckBoxMenuItem.class..Java-Bean: True....Name: javax/swing/JDialog.class..Java-Bean: True....Name: javax/swing/JSlider.class..Java-Bean: True....Name: javax/swing/JTextField.class..Java-Bean: True....Name: javax/swing/JTextPane.class..Java-Bean: True....Name: javax/swing/JTextArea.class..Java-Bean: True....Name: javax/swing/JList.class..Java-Bean: True....Name: javax/swing/JFormattedTextField.class..Java-Bean: True....Name: javax/swing/JApplet.class..Java-Bean: True....Name: javax/swing/JSpinner.class..Java-Bean: True....Name: javax/swing/JLabel.class..Java-Bean

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\security\US_export_policy.jar

Download File

Process:	C:\Users\Public\123.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3026
Entropy (8bit):	7.48902128028383
Encrypted:	false
SSDEEP:	48:9JJweDY2LXQ4lAAldrou1YgH767KWajaHpwrHZt0H9BRJgfHilVVt2+HZ:PCcY26Iou1YgHqK3WJGeHn8fH4VVttHZ
MD5:	EE4ED9C75A1AAA04DFD192382C57900C
SHA1:	7D69EA3B385BC067738520F1B5C549E1084BE285
SHA-256:	90012F900CF749A0E52A0775966EF575D390AD46388C49D512838983A554A870
SHA-512:	EAE6A23D2FD7002A55465844E662D7A5E3ED5A6A8BAF7317897E59A92A4B806DD26F2A19B7C05984745050B4FE3FFA30646A19C0F08451440E415F958204137C
Malicious:	false
Preview:	PK........F..C................META-INF/MANIFEST.MFe.Ao.0...;....-K....d..e.&.UM.BJ)..h)E..~..v......nXI;.wTv.7.p,.4.R..!R.6Gu.@.T.f.....1....}..l.<.....9..K.F..4L#.5.@.{Ih...L.-B8y.`..q....{.v....\|...K.l..=....]...m..........T.E...Ke.^1...2..Rwz..2.......pI...N..m..H..;..?..PK.............PK........F..C................META-INF/ORACLE_J.SFu.Ko.@...;...c...->H<.j)XDA./f.eYy,Y.-.....Mos.f.....P.!.1).A..x.5Tq(...F.f..(q..p)..Q\|n....I...Q..Y..@.FS..Y...<'........E..++..j..`N...b..P.iS.Z.e.<r.[a.....ct.............. ...Z..X...x...T..44.'.......ok...h../Z....._..Z~mK...zh.....a........w..W..G._?..h.l....';+..&w....+..;K.......PK..+.s.4.......PK........F..C................META-INF/ORACLE_J.RSA3hb...........iA....&.+L......l..m....,L...........2.....q..f&F&&&fK..v..s.,.@.....8.CY..B.a..a&gGC!....].3 1'_.1.$.P.@.$.%,.\.....\._\Y\..[....l.l.......J,KT..O+)O,JUp.OIU..L...K7.1..)b...rvE.Rpv4...5440.b3....( ...5.r.....i.I.......s@.E..E.%..y...A...GF`.27.......aK....o

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\security\blacklist

Download File

Process:	C:\Users\Public\123.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4149
Entropy (8bit):	5.816047466650347
Encrypted:	false
SSDEEP:	96:ubCHVyxwEyPEtpuVFWny6NnXjekkMDV6kiPVNXvNhtfx5e6NgyufTMBwtBsv5XHs:ubCHVyxwEyPEtpuV8ny6NnX6kkMDV6kL
MD5:	3F5DC1D941E8356CCD04454AC0A7A7D2
SHA1:	3698F9AFD870C7959E2D8A0DA0A97B4475554831
SHA-256:	C48D57D64ED98F8F174A4F6873F536AE03B41A63F67079D7C2F7140950A1C02E
SHA-512:	65319A4EF150884F7E67C6F96085A996C9B32DCF9A539C4EB7AF77B1B46CDD90F1E83446F33DA14467EA37D0628C9411323F5C3D3CEFCF03CBDFA186EEB2BD3C
Malicious:	false
Preview:	# JNLPAppletLauncher applet-launcher.jar..SHA1-Digest-Manifest: 5Bo5/eg892hQ9mgbUW56iDmsp1k=....# 7066583..SHA1-Digest-Manifest: x17xGEFzBRXY2pLtXiIbp8J7U9M=..SHA1-Digest-Manifest: ya6YNTzMCFYUO4lwhmz9OWhhIz8=..SHA1-Digest-Manifest: YwuPyF/KMcxcQhgxilzNybFM2+8=....# 7066809..SHA1-Digest-Manifest: dBKbNW1PZSjJ0lGcCeewcCrYx5g=..SHA1-Digest-Manifest: lTYCkD1wm5uDcp2G2PNPcADG/ds=..SHA1-Digest-Manifest: GKwQJtblDEuSVf3LdC1ojpUJRGg=....# 7186931..SHA1-Digest-Manifest: 0CUppG7J6IL8xHqPCnA377Koahw=..SHA1-Digest-Manifest: 3aJU1qSK6IYmt5MSh2IIIj5G1XE=..SHA1-Digest-Manifest: 8F4F0TXA4ureZbfEXWIFm76QGg4=..SHA1-Digest-Manifest: B1NaDg834Bgg+VE9Ca+tDZOd2BI=..SHA1-Digest-Manifest: bOoQga+XxC3j0HiP552+fYCdswo=..SHA1-Digest-Manifest: C4mtepHAyIKiAjjqOm6xYMo8TkM=..SHA1-Digest-Manifest: cDXEH+bR01R8QVxL+KFKYqFgsR0=..SHA1-Digest-Manifest: cO2ccW2cckTvpR0HVgQa362PyHI=..SHA1-Digest-Manifest: D/TyRle6Sl+CDuBFmdOPy03ERaw=..SHA1-Digest-Manifest: eJfWm86yHp2Oz5U8WrMKbpv6GGA=..SHA1-Digest-Manifest: g3mA5HqcRBlKa

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\security\blacklisted.certs

Download File

Process:	C:\Users\Public\123.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1273
Entropy (8bit):	4.167014768533289
Encrypted:	false
SSDEEP:	24:NPwGDO0uFVW0mSDEYMZ9HWYZj4bJCC8lCEQqkvZq1n4v3CYe:NPrDJuF4oMyYZj4h8lCENq2+e
MD5:	BBEBCF13680E71EC2EE562524DA02660
SHA1:	C5C005C29A80493F5C31CD7EB629AC1B9C752404
SHA-256:	1FBEA394E634630894CF72DE02DF1846F32F3BB2067B3CB596700E4DD923F4B5
SHA-512:	B686236EEE055C97A96F5E31A2EE7CE57EED04C2175235CEB19F9F56ABFD22DB6FDCADE8C5D4BA7B656D69E923A1C5844C06DC959A4A915E215FB0ACE377B114
Malicious:	false
Preview:	Algorithm=SHA-256..14E6D2764A4B06701C6CBC376A253775F79C782FBCB6C0EE6F99DE4BA1024ADD..31C8FD37DB9B56E708B03D1F01848B068C6DA66F36FB5D82C008C6040FA3E133..3946901F46B0071E90D78279E82FABABCA177231A704BE72C5B0E8918566EA66..450F1B421BB05C8609854884559C323319619E8B06B001EA2DCBB74A23AA3BE2..4CBBF8256BC9888A8007B2F386940A2E394378B0D903CBB3863C5A6394B889CE..4FEE0163686ECBD65DB968E7494F55D84B25486D438E9DE558D629D28CD4D176..5E83124D68D24E8E177E306DF643D5EA99C5A94D6FC34B072F7544A1CABB7C7B..76A45A496031E4DD2D7ED23E8F6FF97DBDEA980BAAC8B0BA94D7EDB551348645..8A1BD21661C60015065212CC98B1ABB50DFD14C872A208E66BAE890F25C448AF..9ED8F9B0E8E42A1656B8E1DD18F42BA42DC06FE52686173BA2FC70E756F207DC..A686FEE577C88AB664D0787ECDFFF035F4806F3DE418DC9E4D516324FFF02083..B8686723E415534BC0DBD16326F9486F85B0B0799BF6639334E61DAAE67F36CD..D24566BF315F4E597D6E381C87119FB4198F5E9E2607F5F4AB362EF7E2E7672F..D3A936E1A7775A45217C8296A1F22AC5631DCDEC45594099E78EEEBBEDCBA967..DF21016B00FC54F9FE3BC8B039911BB216E9162FAD2FD14D990AB96E9

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\security\cacerts

Download File

Process:	C:\Users\Public\123.exe
File Type:	Java KeyStore
Category:	dropped
Size (bytes):	112860
Entropy (8bit):	7.58405956263152
Encrypted:	false
SSDEEP:	1536:knYlyRHbLD1Syx011lYcdSmjbDKuaG8QlpzHok0SeHX:knYlyRHrq5dbeO9pLD0SiX
MD5:	A2C167C8E0F275B234CB2C2E943781C7
SHA1:	2A6B5FBC476EA3A5DDFB4BF1F6CDF0C4DA843BB1
SHA-256:	A9263831583DFD58BC3584AA0B13E6CDE43403FB82093329B47BB65A8C701AFB
SHA-512:	8A0C2240C603210AE963C6A126D19BF51659FDED2228503BBF2A2662CCB73B0F9E18C020C9E5E2F3449E2F4F0006D68FE15C8FD5D91DEE8A1A6B42A49183BEAA
Malicious:	false
Preview:	...........h......digicertassuredidrootca....Wa....X.509....0...0................F...`...090....H........0e1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1$0"..U....DigiCert Assured ID Root CA0...061110000000Z..311110000000Z0e1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1$0"..U....DigiCert Assured ID Root CA0.."0....H.............0.............C.\...`.q....&...... 9(X`......2a<..(........z.....yS\1....26v...<...j.!.Ra. ......d..[_.X.5.G.6.k..8>...3../..(......nD.a5...Y..vm..K.+..r.`..5.xU. ...m..I\|1.3l"..2Z......9...:r.......1u..}".?.F..(y...W..~......V.......?........_.wO......c0a0...U...........0...U.......0....0...U......E....1-Q...!..m..0...U.#..0...E....1-Q...!..m..0....H.....................rszd...rf.2.Bub.......V.....(...`\.LX..=.IEX.5i..G.V.y...g.....<..&, .=.(.._."...e....gI.]...&.x.}?+.&5m_...I[.....=%.....o...dh.-..B.....b.Pg.l....k.6...7\|.[mz..F`..'..K...gh....3f....n...c.....%ml...a...&..q......Q.+

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\security\java.policy

Download File

Process:	C:\Users\Public\123.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2515
Entropy (8bit):	4.490054643169131
Encrypted:	false
SSDEEP:	24:nWjF29ShnQUQH2Hvh4ic1mo6wv1PdOpGLSYLHoQLZQ/1rJ+fSA:n+4AQWxc1tgAFH
MD5:	EC90FD04C2890584A16EB24664050C2A
SHA1:	C7FE062EAC95909EC6A5EA93F42DDA5E023AD82C
SHA-256:	CED51E3926E6B0CFEC8ECAB3B15D296FDCFAE4D32046224814AAAB5FD0FED9C0
SHA-512:	8DA494925B3B5AAE69A30A8B5F9732E64EDBAE39C968229D112185E349C410A0F5D1B281A4E44718E0120E910820B15CA878B2ED1CF905DFC6595F1BA34B85D3
Malicious:	false
Preview:	..// Standard extensions get all permissions by default....grant codeBase "file:${{java.ext.dirs}}/*" {.. permission java.security.AllPermission;..};....// default permissions granted to all domains....grant {.. // Allows any thread to stop itself using the java.lang.Thread.stop().. // method that takes no argument... // Note that this permission is granted by default only to remain.. // backwards compatible... // It is strongly recommended that you either remove this permission.. // from this policy file or further restrict it to code sources.. // that you specify, because Thread.stop() is potentially unsafe... // See the API specification of java.lang.Thread.stop() for more.. // information... permission java.lang.RuntimePermission "stopThread";.... // allows anyone to listen on dynamic ports.. permission java.net.SocketPermission "localhost:0", "listen";.... // "standard" properies that

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\security\java.security

Download File

Process:	C:\Users\Public\123.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	27033
Entropy (8bit):	4.840685151784295
Encrypted:	false
SSDEEP:	768:rmLHAEcqrlANbwbqL1AdLAHaPw2kqUTWip+fzIz:rWQaYFqUTWip0kz
MD5:	409C132FE4EA4ABE9E5EB5A48A385B61
SHA1:	446D68298BE43EB657934552D656FA9AE240F2A2
SHA-256:	4D9E5A12B8CAC8B36ECD88468B1C4018BC83C97EB467141901F90358D146A583
SHA-512:	7FED286AC9AED03E2DAE24C3864EDBBF812B65965C7173CC56CE622179EB5F872F77116275E96E1D52D1C58D3CDEBE4E82B540B968E95D5DA656AA74AD17400D
Malicious:	false
Preview:	#..# This is the "master security properties file"...#..# An alternate java.security properties file may be specified..# from the command line via the system property..#..# -Djava.security.properties=<URL>..#..# This properties file appends to the master security properties file...# If both properties files specify values for the same key, the value..# from the command-line properties file is selected, as it is the last..# one loaded...#..# Also, if you specify..#..# -Djava.security.properties==<URL> (2 equals),..#..# then that properties file completely overrides the master security..# properties file...#..# To disable the ability to specify an additional properties file from..# the command line, set the key security.overridePropertiesFile..# to false in the master security properties file. It is set to true..# by default.....# In this file, various security properties are set for use by..# java.security classes. This is where users can statically register..# Cryptography Packag

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\security\javaws.policy

Download File

Process:	C:\Users\Public\123.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	103
Entropy (8bit):	4.802539000066613
Encrypted:	false
SSDEEP:	3:RSjGIWgjM0ePFUNaXsIGNDAPVnyzowv:RS6c2PFUsXsIrRqoa
MD5:	E0C4EF8B210C0DDFEE01126E1ACA4280
SHA1:	F1CC674F447045D668454996D5C3C188884762CD
SHA-256:	E5CD7F9FD43084674AA749BC8301F28DE85EEF6D01BD78828F72FA32377A3368
SHA-512:	4820074F15520AD099193B27A673499C31544A7279279EFCB6131D53FE997438A96E1C5B386C233385004F7A2FBB775D4CDE3C0272A196B54C0D8EE6CCEF43DF
Malicious:	false
Preview:	..grant codeBase "file:${jnlpx.home}/javaws.jar" {.. permission java.security.AllPermission;..};....

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\security\local_policy.jar

Download File

Process:	C:\Users\Public\123.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3527
Entropy (8bit):	7.521709350514316
Encrypted:	false
SSDEEP:	96:XWlvuYcIou1YgHqK3WwGjIEwtR88fH4VVKZ:sutuyOqKmw0QtRpH4VVKZ
MD5:	57AAAA3176DC28FC554EF0906D01041A
SHA1:	238B8826E110F58ACB2E1959773B0A577CD4D569
SHA-256:	B8BECC3EF2E7FF7D2165DD1A4E13B9C59FD626F20A26AF9A32277C1F4B5D5BC7
SHA-512:	8704B5E3665F28D1A0BC2A063F4BC07BA3C7CD8611E06C0D636A91D5EA55F63E85C6D2AD49E5D8ECE267D43CA3800B3CD09CF369841C94D30692EB715BB0098E
Malicious:	false
Preview:	PK........H..C................META-INF/MANIFEST.MF...o.0...;....-..N.I.._..!S..^L..v+....~....K.....9.......-.qLc,.P.N..%QG.b....n...`..m.u...Yw...ak....+to..1.............."m.i8..z}{B...^uV...1..s.>>..Z-.&..%....A..W..t..c....?z.o....A.]d0a...^..a........./..'..NQQ.%...4..l..}....N..A.f..Q[G.K^.S...o..PK.....8....h...PK........H..C................META-INF/ORACLE_J.SF..Ko.0...}.....U....A........-!....c...4..m.E..F.;.G.c..5...AH.qW.93.....-...`...#.Y.1..=.......b....0/.p...`...}...!.N..a'.....'..?eW..(b..SD.(0;*=h.W\.....w........ ........hg. y.....D...1.L'+...P..QOM..f.w...{\m...Tl.&i..!N~..Q.5...8............/.....UzY..$>.}.m..'.............g>.....D.O...o..V...o.O....4....~.2.7..'.o/....}.PK...E..\.......PK........H..C................META-INF/ORACLE_J.RSA3hb...........iA....&.+L......l..m....,L...........2.....q..f&F&&&fK..v..s.,.@.....8.CY..B.a..a&gGC!....].3 1'_.1.$.P.@.$.%,.\.....\._\Y\..[....l.l.......J,KT..O+)O,JUp.OIU..L...K7.1..)b...rvE.Rpv4

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\sound.properties

Download File

Process:	C:\Users\Public\123.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1249
Entropy (8bit):	4.735634480139973
Encrypted:	false
SSDEEP:	12:AJx/wzjJQO1YfK4pPq8Ul6GyGLCKDJ9w5lAu9aEVjEcGuc8X3A0LlmPOiMA0L9UV:w/61sppNUl6GbLCOMlmEOucA3e2s/WW
MD5:	BB63293B1207CB8608C5FBE089A1B06D
SHA1:	96A0FA723AF939C22AE25B164771319D82BC033B
SHA-256:	633015AD63728DFE7A51BF26E55B766DD3E935F1FCCCFFA8054BF6E158EA89B2
SHA-512:	0042DEBE4A77DA997A75A294A0C48D19AED258EEB3CD723FD305037DF11F0A5073A92CC54967B8B541E1AFC912F36481D0B0F68477B8156E52E15093722B7C32
Malicious:	false
Preview:	############################################################..# Sound Configuration File..############################################################..#..# This properties file is used to specify default service..# providers for javax.sound.midi.MidiSystem and..# javax.sound.sampled.AudioSystem...#..# The following keys are recognized by MidiSystem methods:..#..# javax.sound.midi.Receiver..# javax.sound.midi.Sequencer..# javax.sound.midi.Synthesizer..# javax.sound.midi.Transmitter..#..# The following keys are recognized by AudioSystem methods:..#..# javax.sound.sampled.Clip..# javax.sound.sampled.Port..# javax.sound.sampled.SourceDataLine..# javax.sound.sampled.TargetDataLine..#..# The values specify the full class name of the service..# provider, or the device name...#..# See the class descriptions for details...#..# Example 1:..# Use MyDeviceProvider as default for SourceDataLines:..# javax.sound.sampled.SourceDataLine=com.xyz.MyDeviceProvider..#..# Example 2:..# Speci

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\tzdb.dat

Download File

Process:	C:\Users\Public\123.exe
File Type:	data
Category:	dropped
Size (bytes):	103910
Entropy (8bit):	7.113278604363908
Encrypted:	false
SSDEEP:	1536:OcQWmFKJzLl2g6kpE7tdTMBB/////t97Taz69rU4y/uqmol7s2gK:Oyh3F27/qGzkrfy/uqllQ2gK
MD5:	5A7F416BD764E4A0C2DEB976B1D04B7B
SHA1:	E12754541A58D7687DEDA517CDDA14B897FF4400
SHA-256:	A636AFA5EDBA8AA0944836793537D9C5B5CA0091CCC3741FC0823EDAE8697C9D
SHA-512:	3AB2AD86832B98F8E5E1CE1C1B3FFEFA3C3D00B592EB1858E4A10FFF88D1A74DA81AD24C7EC82615C398192F976A1C15358FCE9451AA0AF9E65FB566731D6D8F
Malicious:	false
Preview:	...TZDB....2016d.S..Africa/Abidjan..Africa/Accra..Africa/Addis_Ababa..Africa/Algiers..Africa/Asmara..Africa/Asmera..Africa/Bamako..Africa/Bangui..Africa/Banjul..Africa/Bissau..Africa/Blantyre..Africa/Brazzaville..Africa/Bujumbura..Africa/Cairo..Africa/Casablanca..Africa/Ceuta..Africa/Conakry..Africa/Dakar..Africa/Dar_es_Salaam..Africa/Djibouti..Africa/Douala..Africa/El_Aaiun..Africa/Freetown..Africa/Gaborone..Africa/Harare..Africa/Johannesburg..Africa/Juba..Africa/Kampala..Africa/Khartoum..Africa/Kigali..Africa/Kinshasa..Africa/Lagos..Africa/Libreville..Africa/Lome..Africa/Luanda..Africa/Lubumbashi..Africa/Lusaka..Africa/Malabo..Africa/Maputo..Africa/Maseru..Africa/Mbabane..Africa/Mogadishu..Africa/Monrovia..Africa/Nairobi..Africa/Ndjamena..Africa/Niamey..Africa/Nouakchott..Africa/Ouagadougou..Africa/Porto-Novo..Africa/Sao_Tome..Africa/Timbuktu..Africa/Tripoli..Africa/Tunis..Africa/Windhoek..America/Adak..America/Anchorage..America/Anguilla..America/Antigua..America/Araguaina..America/

C:\Users\user\AppData\Roaming\RDBNT\jre\lib\tzmappings

Download File

Process:	C:\Users\Public\123.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8602
Entropy (8bit):	5.204166069367786
Encrypted:	false
SSDEEP:	192:j1kfcymkDvxeMmKg5GQEK2TtllXinSV29OHPQT:hhymk/QGT7YT
MD5:	B8DD8953B143685B5E91ABEB13FF24F0
SHA1:	B5CEB39061FCE39BB9D7A0176049A6E2600C419C
SHA-256:	3D49B3F2761C70F15057DA48ABE35A59B43D91FA4922BE137C0022851B1CA272
SHA-512:	C9CD0EB1BA203C170F8196CBAB1AAA067BCC86F2E52D0BAF979AAD370EDF9F773E19F430777A5A1C66EFE1EC3046F9BC82165ACCE3E3D1B8AE5879BD92F09C90
Malicious:	false
Preview:	#..# This file describes mapping information between Windows and Java..# time zones...# Format: Each line should include a colon separated fields of Windows..# time zone registry key, time zone mapID, locale (which is most..# likely used in the time zone), and Java time zone ID. Blank lines..# and lines that start with '#' are ignored. Data lines must be sorted..# by mapID (ASCII order)...#..# NOTE..# This table format is not a public interface of any Java..# platforms. No applications should depend on this file in any form...#..# This table has been generated by a program and should not be edited..# manually...#..Romance:-1,64::Europe/Paris:..Romance Standard Time:-1,64::Europe/Paris:..Warsaw:-1,65::Europe/Warsaw:..Central Europe:-1,66::Europe/Prague:..Central Europe Standard Time:-1,66::Europe/Prague:..Prague Bratislava:-1,66::Europe/Prague:..W. Central Africa Standard Time:-1,66:AO:Africa/Luanda:..FLE:-1,67:FI:Europe/Helsinki:..FLE Standard Time:-1,67:FI:E

C:\Users\user\AppData\Roaming\RDBNT\jre\release

Download File

Process:	C:\Users\Public\123.exe
File Type:	ASCII text, with very long lines (427), with CRLF line terminators
Category:	dropped
Size (bytes):	533
Entropy (8bit):	5.416086012521588
Encrypted:	false
SSDEEP:	12:GEKkc58IOlBVAQEjy2IM0oPP1RVtc8fFVKeiIdGIVIPJvq1RUbDcz:GEK7586QY/0oPtRb2TqySRUkz
MD5:	A61B1E3FE507D37F0D2F3ADD5AC691E0
SHA1:	8AE1050FF466B8F024EED5BC067B87784F19A848
SHA-256:	F9E84B54CF0D8CB0645E0D89BF47ED74C88AF98AC5BF9CCF3ACCB1A824F7DC3A
SHA-512:	3E88A839E44241AE642D0F9B7000D80BE7CF4BD003A9E2F9F04A4FEB61EC4877B2B4E76151503184F4B9978894BA1D0DE034DBC5F2E51C31B3ABB24F0EACF0C7
Malicious:	false
Preview:	JAVA_VERSION="1.8.0_101"..OS_NAME="Windows"..OS_VERSION="5.1"..OS_ARCH="i586"..SOURCE=" .:e983a19c6439 corba:2bb2aec4b3e5 deploy:2390a2618e98 hotspot:77df35b662ed hotspot/make/closed:40ee8a558775 hotspot/src/closed:710cffeb3c01 hotspot/test/closed:d6cfbcb20a1e install:68eb511e9151 jaxp:8ee36eca2124 jaxws:287f9e9d45cc jdk:827b2350d7f8 jdk/make/closed:53a5d48a69b0 jdk/src/closed:06c649fef4a8 jdk/test/closed:556c76f337b9 langtools:8dc8f71216bf nashorn:44e4e6cbe15b pubs:388b7b93b2c0 sponsors:1b72bbdb30d6"..BUILD_TYPE="commercial"..

C:\Users\user\AppData\Roaming\RDBNT\lib\asm-all.jar

Download File

Process:	C:\Users\Public\123.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	247787
Entropy (8bit):	7.915391305945515
Encrypted:	false
SSDEEP:	6144:p+30cnH7ihlQT+uRm0C/vL7cvRurEQ9oTo4/1pC:p+3VnYo+WkvsJuApo4/1k
MD5:	F5AD16C7F0338B541978B0430D51DC83
SHA1:	2EA49E08B876BBD33E0A7CE75C8F371D29E1F10A
SHA-256:	7FBFFBC1DB3422E2101689FD88DF8384B15817B52B9B2B267B9F6D2511DC198D
SHA-512:	82E6749F4A6956F5B8DD5A5596CA170A1B7FF4E551714B56A293E6B8C7B092CBEC2BEC9DC0D9503404DEB8F175CBB1DED2E856C6BC829411C8ED311C1861336A
Malicious:	false
Preview:	PK........RT.IcT..............META-INF/MANIFEST.MF.....T]o.0.}G...x.6.......L.T..X_'.\..3.....h....).}r...zF.[.6.3(.........G..LFl. .....z4....4.A@*"........5&.....=..Ah^`.I....N.3......y1#.s.r.5h...D.J7.....s..2..4.05H5.{...A..\|.,...}..C....'.tT.g.d.}..I../.....8.2&.w.........+.."..`c.y._...?..9.{........L3.0.....M...6..T.x.R.tQ..+#...`4.K..)f.L.5.^..(..22U....-.#.5Qdj.......n.e=5$..$b."...sA!..D....OO..fNg.... ui.2...=....-..R.G..E..V3..G..m.i..L...f.......8.`......^........!...`5.0V.%?...D&.Iy5.....?...V.._..m.T..B.:..-..Ng)%....}o.w._PK........RT.I................org/..PK........RT.I................org/objectweb/..PK........RT.I................org/objectweb/asm/..PK........RT.I............)...org/objectweb/asm/AnnotationVisitor.class..]O.`.....(+.....:']...`L..b...../.4M..R.~...&.%...~(.9m...3{..?...y....??....]..@E. .v.P.{b..w.'.....'.;......~....qt.^.i.....><.....}.&a..u..&l..{..u. ..........s'3..(L_.^.>.z...uU.<$(..9I.......'......'.........

C:\Users\user\AppData\Roaming\RDBNT\lib\dn-compiled-module.jar

Download File

Process:	C:\Users\Public\123.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	811449
Entropy (8bit):	7.9905835318504606
Encrypted:	true
SSDEEP:	24576:RasEsNDFHzOXXIGLWFW4b2n7YeWUhzNNcS:IsE49yHIwqqJL57
MD5:	6C4D19D8414D8C39F8F5DDFA96B424C2
SHA1:	0DB680855897FBC7464BE7E0063C592C414C658F
SHA-256:	8A17ED8AF4ECAE38A4BBC0D00806A00E37C3AE52ADEBA66A1C40085EEC08366C
SHA-512:	E300C8EE258AEB6F63DF29C0A2ADD82A9C19AFD0C3246931929703670E1C7E19DE8D64A6F32A7E10366BA18B3A72FE0465F2E77F07F89076BB15CE206A82BCD6
Malicious:	false
Preview:	PK........@..Y................META-INF/....PK........=..Yc..\...h.......META-INF/MANIFEST.MF.M..LK-...K-...R0.3..r.C.q,HL.HU...%-..y...R.KRSt.A.-......u....4....sR......K..h.r.r..PK........@..Y.................packages/PK........@..Y................action/PK........@..Y................behaviour/PK........@..Y................behaviour/custom/PK........@..Y................bundle/PK........@..Y................bundle/jurl/PK........@..Y................bundle/windows/PK........@..Y................bundle/windows/api/PK........@..Y................bundle/windows/result/PK........@..Y................bundle/zip/PK........@..Y................facade/PK........@..Y................installer/PK........@..Y................installer/forms/PK........@..Y................installer/modules/PK........@..Y................php/PK........@..Y................php/compress/PK........@..Y................php/framework/PK........@..Y................php/gui/PK........@..Y................php/gui/framework/PK.....

C:\Users\user\AppData\Roaming\RDBNT\lib\dn-php-sdk.jar

Download File

Process:	C:\Users\Public\123.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	13202
Entropy (8bit):	7.737712617961208
Encrypted:	false
SSDEEP:	192:LhR1Ygxt7I20RiT2dI03cIH8W6Bc4/kyOLZAy0ZH6AfkA8sFayhbD3D3KRe:1RNRI24AKBcW6BIyYreXf/iyhPD3KU
MD5:	3E5E8CCCFF7FF343CBFE22588E569256
SHA1:	66756DAA182672BFF27E453EED585325D8CC2A7A
SHA-256:	0F26584763EF1C5EC07D1F310F0B6504BC17732F04E37F4EB101338803BE0DC4
SHA-512:	8EA5F31E25C3C48EE21C51ABE9146EE2A270D603788EC47176C16ACAC15DAD608EEF4FA8CA0F34A1BBC6475C29E348BD62B0328E73D2E1071AAA745818867522
Malicious:	false
Preview:	PK........3.\K................META-INF/..PK........3.\K................META-INF/MANIFEST.MF.M..LK-...K-*...R0.3......PK........3.\K................JPHP-INF/..PK........3.\K................JPHP-INF/sdk/..PK........3.\K..e.....\... ...JPHP-INF/sdk/ArithmeticError.phpe..j.0...@.Ac...n]..C..+8....)Xr....t.`cI.......i.K..t.V..F..)@...l.[B...G^b.E=I.a.2J..'..%.b. ^.......z........S ........v......d.h4...1NN]..,..t...~..yo&...G.....<@A...5. .\..ET.w;.S...w.....a..61...[.O....k....PK........3.\K.J.......... ...JPHP-INF/sdk/array-functions.php.Y]o.0.}G.?..M....M[.U.j.h.=F&..q2.0.u.}Nb ....:.@7p....p...Y...\]^v;.e.)C.....z.z.G...z1.P....h...U..H...jc.O..@4..U.._..K..C....6...q;..v.t;.})q....Q..eE..5wg+.l.c..V.......T{qJ..(53.cXn..<..#.k.....RI.A..8...D$..0..0]os...\|...OR...p......]..`0.f.8.q....p...H....E..4>{...5.Xf.....5...Wms...>....LH..$,`C......T..#.#K..4".....f.-!h..MAle.m.a..2.....AZ......iT.Z.....Vu.J.a......p..4.6B..I..D9GY....}.L"Mh.....$...M.

C:\Users\user\AppData\Roaming\RDBNT\lib\gson.jar

Download File

Process:	C:\Users\Public\123.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	231952
Entropy (8bit):	7.8987047381149225
Encrypted:	false
SSDEEP:	3072:2DiL6hR+wm60gqZjJhqo2M04r7bv1XMrMxw1rl1rwj+Bmd6dYBmkW1eIjEmFdbl6:bq0jSi2Qi1B1Cay6dYBUwmPxLe3
MD5:	5134A2350F58890FFB9DB0B40047195D
SHA1:	751F548C85FA49F330CECBB1875893F971B33C4E
SHA-256:	2D43EB5EA9E133D2EE2405CC14F5EE08951B8361302FDD93494A3A997B508D32
SHA-512:	C3CDAF66A99E6336ABC80FF23374F6B62AC95AB2AE874C9075805E91D849B18E3F620CC202B4978FC92B73D98DE96089C8714B1DD096B2AE1958CFA085715F7A
Malicious:	false
Preview:	PK...........H................META-INF/PK...........H..Q?....p.......META-INF/MANIFEST.MF.R]..0.\|...`....$.8...SQ.C.....Kp... ..u>0.U..9.....Y....M..J3)2.....+A9..A..M.x.R.....q.SD].l{)w.......\..........=...N.n36..F.FM.../.b.6.A.D...l.Z].x4M'.t<.R7z..w.k}._.S@.g.z..81%E..dh.l.a.G.."'........n......Je.h6lM.(..r.{_.T&.....[....Z...N_. G.c............T6.z.z]m...N.s+..........R.Zg.`.Qg.a...a+e.J..W..%.P....7.I...$..wi.{...*...{...=.N......Q@.`v..$..G..........M./m3.....6.O.9...T.P.[X........~Lc.{Q$.QXHe=k...D.pE.nH...PK...........H................com/PK...........H................com/google/PK...........H................com/google/gson/PK...........H................com/google/gson/annotations/PK...........H................com/google/gson/internal/PK...........H................com/google/gson/internal/bind/PK...........H............#...com/google/gson/internal/bind/util/PK...........H................com/google/gson/reflect/PK...........H................com/google/g

C:\Users\user\AppData\Roaming\RDBNT\lib\jphp-app-framework.jar

Download File

Process:	C:\Users\Public\123.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	106006
Entropy (8bit):	7.823795646704166
Encrypted:	false
SSDEEP:	1536:CPj4aLCBcnn4xGrpR7H30x4VTNVNM43QHt0msLiWzO5SQJn4494m75CYl3U:ETCBmnoCptBNNVNzQ6e5SQW494mlZ2
MD5:	0C8768CDEB3E894798F80465E0219C05
SHA1:	C4DA07AC93E4E547748ECC26B633D3DB5B81CE47
SHA-256:	15F36830124FC7389E312CF228B952024A8CE8601BF5C4DF806BC395D47DB669
SHA-512:	35DB507A3918093B529547E991AB6C1643A96258FC95BA1EA7665FF762B0B8ABB1EF732B3854663A947EFFE505BE667BD2609FFCCCB6409A66DF605F971DA106
Malicious:	false
Preview:	PK........3.\K................META-INF/..PK........3.\K................META-INF/MANIFEST.MF.M..LK-...K-...R0.3......PK........3.\K.................packages/..PK........3.\KpS..v............packages/framework.pkg.W.n.8.}....}..,.:m....c3.&.(Hr;....k..V..h.sH../.\..h... w.T6j....k.o..;L.....dBR.{/.I.P.t.H.:s...X.......#...-..CPm.....lT;..u........P..o.L.j..a.h...@.@..6`J....D9..IfT..U....d.B.]..........T.<.......nfs..k....P`..,..g........T[+@.em.cY...F.k.h..T.M.1....{.eg@+Q.._a.....(O.Z..y.UPu....;.M.......8O..d$....)...MlMc/..;.\|....N.(.s.......1.c.n..... T+..._.g@R9.. ...F...../...lg..>.....W...J.6.<.VT..iY.l....}......M.J.?.........YS....H.9rG.I.;....ZK...d'\|....Ix....c.....ve._s......JOu..s....Z...)g........j.K.W.7.o .^....:!m...n...........*9Q'..8.<..3!.\.8.j...z.mn.....6.....].N/...x]..Ke....:.A.Z.......l..AaG3~..y.K8R..<#J?..P..._..k.H........ .]L8.......j......lYq..).......(.hCf...$$..l.....K...M3...Ll9....-.1.%.......v.....m...

C:\Users\user\AppData\Roaming\RDBNT\lib\jphp-core.jar

Download File

Process:	C:\Users\Public\123.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	475905
Entropy (8bit):	7.8713354167151675
Encrypted:	false
SSDEEP:	12288:pyfuv+DnikW2IfqFXKzNGNyyRmfD4vCgdiRST:pLWDnid2IfZGAyAfczdig
MD5:	7E5E3D6D352025BD7F093C2D7F9B21AB
SHA1:	AD9BFC2C3D70C574D34A752C5D0EBCC43A046C57
SHA-256:	5B37E8FF2850A4CBB02F9F02391E9F07285B4E0667F7E4B2D4515B78E699735A
SHA-512:	C19C29F8AD8B6BEB3EED40AB7DC343468A4CA75D49F1D0D4EA0B4A5CEE33F745893FBA764D35C8BD157F7842268E0716B1EB4B8B26DCF888FB3B3F4314844AAD
Malicious:	false
Preview:	PK..........[K................META-INF/..PK.........rNK................META-INF/MANIFEST.MF.M..LK-...K-...R0.3......PK..........[K................org/..PK..........[K................org/develnext/..PK..........[K................org/develnext/jphp/..PK..........[K................org/develnext/jphp/core/..PK..........[K................org/develnext/jphp/core/common/..PK..........[K0:..).......G...org/develnext/jphp/core/common/ObjectSizeCalculator$ObjectWrapper.class.RMo.@.}k;q.\....o.$....F.@.".p..'6.qp.`;.EH........%.$...q...B.V..r.....{o.....o...* ..yh8"..:..p.'u.b....pb.rk...q.g.H.K...._f.....1h..+.f[./........OH......]Y.....af..V.G#.2.M..a..Q$..h.a..u...~l.F......0..~..v........ \..)..{c.E..~.A...K;...U>J-..<.o..VkM.,..Fi...CG.....^..I%.y,..3p.gt.e...#....d(..'.J?#..q.E..jmj....\...;...Q,...]..n.qm{[{.............T..(P.G.......3.i}..*....t.xD...'..ja.6.J@.IV.?(c..\|.r.....6.~..>A-ko.Q'..(.whtlB..AS'./#..P\|J..1?... ....mRWj.S.CF7X.t.......I)[/..T...ze.k.WT..,.L.

C:\Users\user\AppData\Roaming\RDBNT\lib\jphp-desktop-ext.jar

Download File

Process:	C:\Users\Public\123.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	17374
Entropy (8bit):	7.682654493549437
Encrypted:	false
SSDEEP:	384:Paj1PXNyyQwsCxm7VXh3il27I8pdo63XNrqlY3ylWn4iczt3Z:e1/BQwsCxIVXhuF8pKaXNdXn4icz9Z
MD5:	B50E2C75F5F0E1094E997DE8A2A2D0CA
SHA1:	D789EB689C091536EA6A01764BADA387841264CB
SHA-256:	CF4068EBB5ECD47ADEC92AFBA943AEA4EB2FEE40871330D064B69770CCCB9E23
SHA-512:	57D8AC613805EDADA6AEBA7B55417FD7D41C93913C56C4C2C1A8E8A28BBB7A05AADE6E02B70A798A078DC3C747967DA242C6922B342209874F3CAF7312670CB0
Malicious:	false
Preview:	PK........3.\K................META-INF/..PK........3.\K................META-INF/MANIFEST.MF.M..LK-...K-...R0.3......PK........3.\K................org/..PK........3.\K................org/develnext/..PK........3.\K................org/develnext/jphp/..PK........3.\K................org/develnext/jphp/ext/..PK........3.\K................org/develnext/jphp/ext/gui/..PK........3.\K............#...org/develnext/jphp/ext/gui/desktop/..PK........3.\K............+...org/develnext/jphp/ext/gui/desktop/classes/..PK........3.\K.\|wk.......6...org/develnext/jphp/ext/gui/desktop/classes/Mouse.class.SmO.A.~...^O....J..P..QQ.."&M.0\|2!.c)...n..../&F.....(..-.A..}f.yff......2..0e.&.m.B!....ha..<C.#..~..P....0VZ.+T.]W....&.^.r.b.....r.\|.E....m..Z.+...R...V..k^.......<.....z_F.K. ....!\|%..{`.Q.%..[..].(..}..XeHQ........h...S.i.!.....a.i.(..F6..m.I...R...Yp.2[....C..))%.f...]..Mt7..Sm6...D.D......'.K3);i{.7..ER..5..'N'..73ip?&^.hoZ.up.....,.e.wq..}.W..`.+..g.%....\|...S...........&t.

C:\Users\user\AppData\Roaming\RDBNT\lib\jphp-gui-ext.jar

Download File

Process:	C:\Users\Public\123.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	704689
Entropy (8bit):	7.834558665203789
Encrypted:	false
SSDEEP:	12288:sSn9gd/GXLtKb+Ozu5idmEfcHOPJZ7bw1kXn0yZLJZsDDpJSWB5qSEhQ:sMw/GXUb+euCVIOxRQIZOnuK
MD5:	6696368A09C7F8FED4EA92C4E5238CEE
SHA1:	F89C282E557D1207AFD7158B82721C3D425736A7
SHA-256:	C25D7A7B8F0715729BCCB817E345F0FDD668DD4799C8DAB1A4DB3D6A37E7E3E4
SHA-512:	0AB24F07F956E3CDCD9D09C3AA4677FF60B70D7A48E7179A02E4FF9C0D2C7A1FC51624C3C8A5D892644E9F36F84F7AAF4AA6D2C9E1C291C88B3CFF7568D54F76
Malicious:	false
Preview:	PK........gt]K................META-INF/..PK........0.\K................META-INF/MANIFEST.MF.M..LK-...K-...R0.3......PK......../.\K................org/..PK......../.\K................org/develnext/..PK......../.\K................org/develnext/jphp/..PK......../.\K................org/develnext/jphp/ext/..PK........gt]K................org/develnext/jphp/ext/javafx/..PK........gt]K............#...org/develnext/jphp/ext/javafx/bind/..PK........gt]K....V.......>...org/develnext/jphp/ext/javafx/bind/BoundsMemoryOperation.class.V[W.U..N..a....B[.Z...h-.....E.h.-.j..$.Hf..$....\|...P}.k.e.k..\.33..&..b......g_f.....K.w..a.3.f..).W.0.va._(.R.....).5.......$.Z.#).V.\U.&..)S6.\|....V..$.S..0.cKAZA..s.-1.......3N.3.IX6_.....bn.h%.p.fa.t-....[e........k....K...U3[3.,;c<pv......\.),.`8..g.f...\|,.8!.......:.w%..m..K./.0..."+%..U...l,!..Vla....1gW-.....ol..f./.Y.....x".(."..^.....i.k'zc.........e.9.@..0hs.4/.\...UW..?.m.X..%..O.s...N..S..{....0.;.f).owu.....yZ...[.h....

C:\Users\user\AppData\Roaming\RDBNT\lib\jphp-json-ext.jar

Download File

Process:	C:\Users\Public\123.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	17135
Entropy (8bit):	7.7352982443766
Encrypted:	false
SSDEEP:	384:fSw3uFslDvQGOoqdoUFKgvXj9jmHo5+FejOcEDffWPvy:KwJlrQGOdoUFKgvTmn6y
MD5:	FDE38932B12FC063451AF6613D4470CC
SHA1:	BC08C114681A3AFC05FB8C0470776C3EAE2EEFEB
SHA-256:	9967EA3C3D1AEE8DB5A723F714FBA38D2FC26D8553435AB0E1D4E123CD211830
SHA-512:	0F211F81101CED5FFF466F2AAB0E6C807BB18B23BC4928FE664C60653C99FA81B34EDF5835FCC3AFFB34B0DF1FA61C73A621DF41355E4D82131F94FCC0B0E839
Malicious:	false
Preview:	PK........K.\K................META-INF/..PK.........rNK................META-INF/MANIFEST.MF.M..LK-...K-...R0.3......PK..........[K................org/..PK..........[K................org/develnext/..PK..........[K................org/develnext/jphp/..PK........K.\K................org/develnext/jphp/json/..PK........K.\K............ ...org/develnext/jphp/json/classes/..PK........K.\K........5...5...org/develnext/jphp/json/classes/JsonProcessor$1.class..[S.@.....B..E.^.A..\B.C..Uf..":.8!Y.t..$...\|.M?./:.....x...C.H3._.....nv......,6...(C"..$.R.c.........C.a.a.a.a.a.a.a.a.a.!.eXaXU.5m.?..H.1....i...r..v`.%.wt...Y...#^.t...6.9Ks]N.t..E......O-.......%..M^.G...tFA[.,....../k..{.....U..e.....d..kq.o{f....jf.......o.A..M..P.Om.r\..ns....k1..]._...c.+.;...u.,)R...u...6.!-.Q...h_.C....(,..O..!.M.r...;.... ....io.)^....5*".F!6L[..Fe.J....C..yuO....H............#.uE..}..;.W.\,..5rn=.\|&......#<...C..Z..Ok...T..r".L\).]1.a(.J.9..[.$.1E.Y/j?.^:..{4.@S`....%.o...

C:\Users\user\AppData\Roaming\RDBNT\lib\jphp-runtime.jar

Download File

Process:	C:\Users\Public\123.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1177648
Entropy (8bit):	7.91949701328009
Encrypted:	false
SSDEEP:	24576:cP4MBZrpGi4exQ9qdXVd/F/3yy7mgviLzIM:czHMi4eKCd/BzaLcM
MD5:	D5EF47C915BEF65A63D364F5CF7CD467
SHA1:	F711F3846E144DDDBFB31597C0C165BA8ADF8D6B
SHA-256:	9C287472408857301594F8F7BDA108457F6FDAE6E25C87EC88DBF3012E5A98B6
SHA-512:	04AEB956BFCD3BD23B540F9AD2D4110BB2FFD25FE899152C4B2E782DAA23A676DF9507078ECF1BFC409DDFBE2858AB4C4C324F431E45D8234E13905EB192BAE8
Malicious:	false
Preview:	PK..........\K................META-INF/..PK.........rNK................META-INF/MANIFEST.MF.M..LK-...K-...R0.3......PK..........[K................php/..PK..........\K................php/runtime/..PK..........\K................php/runtime/annotation/..PK..........\K.~..........0...php/runtime/annotation/Reflection$Abstract.class.PMK.@...W.Xm...b...s..h..%FA<m..l7!....<...Q.[D.P....y..........8h:.u.'.>..4..H.@.WE..b}>..)p...f..e.XQW..H.g..;....O...O..E...Ts6n...b..Knp....?....n.d:!....\|O.=.eB,..#...z......@'yK..'..]~..u.Ieh..9.....J.,#.....S....._&p.vv[@....{.(q-....-F.sUB..6,\|A.P.-[.a.....v...PK..........\K.RG=........+...php/runtime/annotation/Reflection$Arg.class.S[SRQ......./].L-%..X.[N..M.8........l.a....C?........p8k}.Z....?~.x...v-.-....W.`X..x...].<..o..JZ.....?...U.....6.W....=.....;P....P$.....:.-a..5..J8..N.z........1......m.e}...Z..Y.N...6...N.2..\4.CZS..Q..,........*W...i"S5.$...........Qz.r...Cf(. .fo....dZ.lH.M\.q?`.............vh

C:\Users\user\AppData\Roaming\RDBNT\lib\jphp-xml-ext.jar

Download File

Process:	C:\Users\Public\123.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	20151
Entropy (8bit):	7.765220504812666
Encrypted:	false
SSDEEP:	384:dti5BMxSo4LgAAsJilYcmwPbEM0Av7wGkJXbhS1OaVKD6U2:DqoCgqyIMZwRJLQO5eU2
MD5:	0A79304556A1289AA9E6213F574F3B08
SHA1:	7EE3BDE3B1777BF65D4F62CE33295556223A26CD
SHA-256:	434E57FFFC7DF0B725C1D95CABAFDCDB83858CCB3E5E728A74D3CF33A0CA9C79
SHA-512:	1560703D0C162D73C99CEF9E8DDC050362E45209CC8DEA6A34A49E2B6F99AAE462EAE27BA026BDB29433952B6696896BB96998A0F6AC0A3C1DBBB2F6EBC26A7E
Malicious:	false
Preview:	PK.........tVK................META-INF/..PK.........rNK................META-INF/MANIFEST.MF.M..LK-...K-...R0.3......PK........wkVK................org/..PK........wkVK................org/develnext/..PK........wkVK................org/develnext/jphp/..PK........wkVK................org/develnext/jphp/ext/..PK........wkVK................org/develnext/jphp/ext/xml/..PK........wkVK............#...org/develnext/jphp/ext/xml/classes/..PK........wkVKmw.>........@...org/develnext/jphp/ext/xml/classes/WrapDomDocument$Methods.class.R]S.@.=......R...!y!3.}..L...;".5.iS...f..O.....r.l...f$.9{..~.....'.W.q...9...}.NS.U/a...y......e.D".,.%h.pk....\|.`BOh.P>..J.\|.N...>...C..H...4./....E\.t....M.g..<...\|..yC..`...1..k;.l.Vu.u..+.P...ro....N~...g..>..#..X.%...U.........n.fB.C..yw.KQ..;.g}..4..UmW.E.d...T..P.\|....Li..g..2..........8.5.%..Ez..[dw.M.H....pv..I6..p.&A..<gypE......r...i..9.{.@?...?\|..Pw.........U.s..h...A....,..cp.K........W,...m..cp...........c<.....cK..;$x.....PK........w

C:\Users\user\AppData\Roaming\RDBNT\lib\jphp-zend-ext.jar

Download File

Process:	C:\Users\Public\123.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	97358
Entropy (8bit):	7.9345189846943915
Encrypted:	false
SSDEEP:	1536:yZwgOueuKZ4THgWvLnhgmmJFgVn+nhEA1ODIrSrUricEDMrV+LAB:yZwgwuKmTDFgmmoVn+mAUhrUicRoAB
MD5:	4BC2AEA7281E27BC91566377D0ED1897
SHA1:	D02D897E8A8ACA58E3635C009A16D595A5649D44
SHA-256:	4AEF566BBF3F0B56769A0C45275EBBF7894E9DDB54430C9DB2874124B7CEA288
SHA-512:	DA35BB2F67BCA7527DC94E5A99A162180B2701DDCA2C688D9E0BE69876ACA7C48F192D0F03D431CCD2D8EEC55E0E681322B4F15EBA4DB29EF5557316E8E51E10
Malicious:	false
Preview:	PK.........tVK................META-INF/..PK.........rNK................META-INF/MANIFEST.MF.M..LK-...K-...R0.3......PK........bkVK................org/..PK........bkVK................org/develnext/..PK........bkVK................org/develnext/jphp/..PK........bkVK................org/develnext/jphp/zend/..PK........ckVK................org/develnext/jphp/zend/ext/..PK........bkVK............!...org/develnext/jphp/zend/ext/json/..PK........bkVK.l.R........4...org/develnext/jphp/zend/ext/json/JsonConstants.class..]o.0......c]...k....!..@..u.4).[mWQ.F,S.Ti:!..K\!q...G!.M.^............;...j.2.8.O..@....dG.....A`...$......A...5..;B[.._.c.B......B`].u...[.J.D.,...f.A=.d..pv.lJ..h...t.s.cX.y...8?...b.g.[..Z.z..<...&..z....j...xiX..s...,...0J.\c..$PQ$..ym.m...x.;&.GwD....u.........".L .:.......~.@....f...tt.$.?..R6.?..I(x&f..pB...'..Ap....c...O.. .h.&q..p........O.~P.e..n..?..p....._a..E".Fi8.dh2...$...h..i..8I}.e.....C..YX....<....._F...\|E.5.....zW..@.Tx.....+..@..

C:\Users\user\AppData\Roaming\RDBNT\lib\jphp-zip-ext.jar

Download File

Process:	C:\Users\Public\123.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	13213
Entropy (8bit):	7.627776815487544
Encrypted:	false
SSDEEP:	192:yXmigootuYzXKKk6BL8UUJY0eP6nHY2AJ4qxivXRp2gFyjSonqKLRM7RbEZ:Km0WzX7k6eJB06HZYwRzFyj0uRM7RbEZ
MD5:	20F6F88989E806D23C29686B090F6190
SHA1:	1FDB9A66BB5CA587C05D3159829A8780BB66C87D
SHA-256:	9D5F06D539B91E98FD277FC01FD2F9AF6FEA58654E3B91098503B235A83ABB16
SHA-512:	2798BB1DD0AA121CD766BD5B47D256B1A528E9DB83ED61311FA685F669B7F60898118AE8C69D2A30D746AF362B810B133103CBE426E0293DD2111ACA1B41CCEA
Malicious:	false
Preview:	PK........1.\K................META-INF/..PK........1.\K................META-INF/MANIFEST.MF.M..LK-...K-...R0.3......PK........1.\K................org/..PK........1.\K................org/develnext/..PK........1.\K................org/develnext/jphp/..PK........1.\K................org/develnext/jphp/ext/..PK........1.\K................org/develnext/jphp/ext/zip/..PK........1.\K............#...org/develnext/jphp/ext/zip/classes/..PK........1.\K..tp....B...6...org/develnext/jphp/ext/zip/classes/PZipException.class.SMo.@.}...../Z.@.iC(.X.....B....U.....6[.k.vL......B.:.JPER.ffg.}3+....'.....5k....l.f^k..7.W.n.D.7...P&....84.2i.=....4.b..._.Z...R;<T.9W.....T.ok.E7......d)......cq.2..u...{...:../.D%b...:...R.........I....../TMx7a..b..\|.Y..m.u8.~.G/.......P...cO...v.{fu.V...].hV..0...8x.......Qq{.%..,.G..i.FVP....w;h..,"....S..pf.1....Q....2f..'<..#.....6....fD.CBs:...K.B.OD..".?.+..l.>ms...y...;.[........YT8Z..8.5.qP.*..,..h./.-.K.....i..S....{...8Z....wpo...-.X..4p

C:\Users\user\AppData\Roaming\RDBNT\lib\slf4j-api.jar

Download File

Process:	C:\Users\Public\123.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	41203
Entropy (8bit):	7.855219741633254
Encrypted:	false
SSDEEP:	768:CkwPhOR4PpSvw6vob5IJ9eoYUx7eBr9HDhzCZ+8ylnm1fjiUNcS5cXeK/7DaeR7g:CRPhOR4B0reWJYURuHN4ylnaeSI4
MD5:	CAAFE376AFB7086DCBEE79F780394CA3
SHA1:	DA76CA59F6A57EE3102F8F9BD9CEE742973EFA8A
SHA-256:	18C4A0095D5C1DA6B817592E767BB23D29DD2F560AD74DF75FF3961DBDE25B79
SHA-512:	5DD6271FD5B34579D8E66271BAB75C89BACA8B2EBEAA9966DE391284BD08F2D720083C6E0E1EDDA106ECF8A04E9A32116DE6873F0F88C19C049C0FE27E5D820B
Malicious:	false
Preview:	PK..........pJ................META-INF/PK..........pJ..w0?...........META-INF/MANIFEST.MF}._O.0....;.....J2....a..F.o.v..tm.....&c..q.w.9'..Q..Y...q%..%.........x.`.g..\|ol.ZH......l.hF...7...............Gw..2..'.1..<..F&../4.O..V......4..R....k....<.Un..h....ZR...B..Kn..u.L5o..~.kl{.........xJ......d.L...~D..O.Y.w..$..X.r...FI.3@Q/.q.>.ke,.S....C...\|.:.C]...L...{.....K.....m.D.&..Cx.qk...j...PK........J.pJ................org/PK..........pJ................org/slf4j/PK..........pJ................org/slf4j/event/PK..........pJ................org/slf4j/helpers/PK..........pJ................org/slf4j/spi/PK..........pJ...^]...+...$...org/slf4j/event/EventConstants.class}.MO.@...........=.x...!!%i......6i../O&....(.l.../.y.wvf..........8..$..C...C}..F...P..^(LOLL7.Ir4.r.-].5...k....].=._...#.....CkM.q.[...0U..l.......N.27..[.d.\|......4p<.E/..F..r..g.;1.G.RL.g'd....VC..z......q.S.dP.?.f..H[.........'....Ck.g..i-..P8".\|..6.p...+dp..........5..+k.A\X."..........e

C:\Users\user\AppData\Roaming\RDBNT\lib\slf4j-simple.jar

Download File

Process:	C:\Users\Public\123.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	15257
Entropy (8bit):	7.804568217256536
Encrypted:	false
SSDEEP:	192:wyBOIrDL/vJ0RWNML2NyWKr362ByOikGnqO5Vyb3Uab+UtJIdgihtqSXs:wyBnxxMLg7KrqU7Gnqrb3lhtuF/qS8
MD5:	722BB90689AECC523E3FE317E1F0984B
SHA1:	8DACF9514F0C707CBBCDD6FD699E8940D42FB54E
SHA-256:	0966E86FFFA5BE52D3D9E7B89DD674D98A03EED0A454FBAF7C1BD9493BD9D874
SHA-512:	D5EFFBFA105BCD615E56EF983075C9EF0F52BCFDBEFA3CE8CEA9550F25B859E48B32F2EC9AA7A305C6611A3BE5E0CDE0D269588D9C2897CA987359B77213331D
Malicious:	false
Preview:	PK..........pJ................META-INF/PK..........pJ.T..N...........META-INF/MANIFEST.MFuR]O.0.}_....`. ........%...L...............{>.97...6..^..L..u........e<..5:..3V@..xt..0#t.hF...3..7..U........Ww`.".'..b.)wDo.~.".f......f6.....XZ......?.X..;J#.+.8..Z..Z...i@-.%3.\|.....u..N4;.....%g...g..R7....D,.......u..3..b.-I.j...{......))l....(.e.`.Ie...I.NR%^.fC<.U.......w....6.:.=[..........$.*..2.Yjsu....PK........K.pJ................org/PK........K.pJ................org/slf4j/PK........K.pJ................org/slf4j/impl/PK........K.pJ.._.........#...org/slf4j/impl/OutputChoice$1.class..mO.P...w+.6+..4yP.....t........f. 1. ]w..v.Z.O.k51..>.o.F.s..$(.I.?.wn.97.......@..,.c&.,f3.....qC.M!.Bn..-cQ.........5(.A.0t.T...`...Q8..Z.wl~.Z...!..`H?.].s.g..bi.A...Z.2..oE.m....K.....k....`..c.3.......\|3.{u...=....C.....uG$L.....^.g....<.....2.........`UA.....[)./>..y .!V..i(Z<.M.E;1.........Z.!.2....v..!...E.V.jqz...P..r#.R,...)G....~s..P>w..t..r..o.....&k.....?.q3..0

C:\Users\user\AppData\Roaming\RDBNT\lib\zt-zip.jar

Download File

Process:	C:\Users\Public\123.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	105007
Entropy (8bit):	7.8886535210991395
Encrypted:	false
SSDEEP:	1536:Dxpeuv7xOoWmvqcQurq8vGDTRAi5yRdPPl/CJqM9ggS3OIrBTH6x0:Fguv7cfmJrUOiYRbXMbS3Ooox0
MD5:	0FD8BC4F0F2E37FEB1EFC474D037AF55
SHA1:	ADD8FFACE4C1936787EB4BFFE4EA944A13467D53
SHA-256:	1E31EF3145D1E30B31107B7AFC4A61011EBCA99550DCE65F945C2EA4CCAC714B
SHA-512:	29DE5832DB5B43FDC99BB7EA32A7359441D6CF5C05561DD0A6960B33078471E4740EE08FFBD97A5CED4B7DD9CC98FAD6ADD43EDB4418BF719F90F83C58188149
Malicious:	false
Preview:	PK.........E?J................META-INF/PK.........E?J&.x~i...........META-INF/MANIFEST.MF.M..LK-...K-...R0.3..r,J..,K-B...V..+.$x...R.KRSt.......3R.\|..R.x..J3sJ..%.....E...]..l...z.....\.\.PK.........E?J................org/PK.........E?J................org/zeroturnaround/PK.........E?J................org/zeroturnaround/zip/PK.........E?J................org/zeroturnaround/zip/commons/PK.........E?J................org/zeroturnaround/zip/extra/PK.........E?J............"...org/zeroturnaround/zip/timestamps/PK.........E?J............!...org/zeroturnaround/zip/transform/PK.........E?J............'...org/zeroturnaround/zip/ByteSource.class.U.W.U..6.l..B.7...`H..`.-.. ..g[(.b.%....q...../..G_.9.<rN.Oz...?.77.4=.;s....\|w....}..2.60.....#..........!.,.X....$r".x ...?.....-x(bU.#...X...@..u\|b...8...4..D.....#...d...Z.w..V.`.......&4D7.\|..!.>IG..5h..^..%......`...&.9..y....N..oj.L...>9.J.)w.X..N.^..n...Q.%.7o.V-.y`l...fqq..........hyn....wJ.If..V...........r..]..Z....1..5...

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.999514492216182
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	123.sfx.exe
File size:	50'480'444 bytes
MD5:	b38dfb77e2bf795ee75f3e20f493d493
SHA1:	fb1259948701297f235557764b7448cc7f34828b
SHA256:	3bf7cf40c4a493fc826fca2c74adcf4858423089dd94ba5a8352e00aa8987028
SHA512:	cd1d6bf8388c98b0d881d5df1f074e8e6f361eefa7ee5af9a1ee3bb25e23062171ab9e6fbde56afca545f575601d8b16bd779e9972eef945c5470628c84e048f
SSDEEP:	1572864:N+lgusZA3phJr0hwNCIapBqZxu4swBixuir5On:N+lPdX0CHapBIw2ixuC5On
TLSH:	DDB7335BF2C04FADDABEA4385D47DB65E2FBB42D0717C0AF3240B55A5B2325A3869301
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$.2.`.\.`.\.`.\..y..h.\..y....\..y..m.\.....b.\...X.r.\..._.j.\...Y.Y.\.i...i.\.i...b.\.i...g.\.`.].C.\...Y.R.\...\.a.\.....a.\

File Icon


Icon Hash:	1515d4d4442f2d2d

Static PE Info

General

Entrypoint:	0x140032ee0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x66409723 [Sun May 12 10:17:07 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	b1c5b1beabd90d9fdabd1df0779ea832

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FC68D1EAFA8h
dec eax
add esp, 28h
jmp 00007FC68D1EA93Fh
int3
int3
dec eax
mov eax, esp
dec eax
mov dword ptr [eax+08h], ebx
dec eax
mov dword ptr [eax+10h], ebp
dec eax
mov dword ptr [eax+18h], esi
dec eax
mov dword ptr [eax+20h], edi
inc ecx
push esi
dec eax
sub esp, 20h
dec ebp
mov edx, dword ptr [ecx+38h]
dec eax
mov esi, edx
dec ebp
mov esi, eax
dec eax
mov ebp, ecx
dec ecx
mov edx, ecx
dec eax
mov ecx, esi
dec ecx
mov edi, ecx
inc ecx
mov ebx, dword ptr [edx]
dec eax
shl ebx, 04h
dec ecx
add ebx, edx
dec esp
lea eax, dword ptr [ebx+04h]
call 00007FC68D1E9DC3h
mov eax, dword ptr [ebp+04h]
and al, 66h
neg al
mov eax, 00000001h
sbb edx, edx
neg edx
add edx, eax
test dword ptr [ebx+04h], edx
je 00007FC68D1EAAD3h
dec esp
mov ecx, edi
dec ebp
mov eax, esi
dec eax
mov edx, esi
dec eax
mov ecx, ebp
call 00007FC68D1ECAE7h
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov ebp, dword ptr [esp+38h]
dec eax
mov esi, dword ptr [esp+40h]
dec eax
mov edi, dword ptr [esp+48h]
dec eax
add esp, 20h
inc ecx
pop esi
ret
int3
int3
int3
dec eax
sub esp, 48h
dec eax
lea ecx, dword ptr [esp+20h]
call 00007FC68D1D9353h
dec eax
lea edx, dword ptr [00025747h]
dec eax
lea ecx, dword ptr [esp+20h]
call 00007FC68D1EBBA2h
int3
jmp 00007FC68D1F1D84h
int3
int3
int3
int3
int3
int3

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x597a0	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x597d4	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x70000	0xe3bc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x6a000	0x306c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7f000	0x970	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x536c0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x53780	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x4b3f0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x48000	0x508	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x588bc	0x120	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4676e	0x46800	f06bb06e02377ae8b223122e53be35c2	False	0.5372340425531915	data	6.47079645411382	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x48000	0x128c4	0x12a00	2de06d4a6920a6911e64ff20000ea72f	False	0.4499003775167785	data	5.273999097784603	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x5b000	0xe75c	0x1a00	0dbdb901a7d477980097e42e511a94fb	False	0.28275240384615385	data	3.2571023907881185	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x6a000	0x306c	0x3200	b0ce0f057741ad2a4ef4717079fa34e9	False	0.483359375	data	5.501810413666288	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.didat	0x6e000	0x360	0x400	1fcc7b1d7a02443319f8fcc2be4ca936	False	0.2578125	data	3.0459938492946015	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
_RDATA	0x6f000	0x15c	0x200	3f331ec50f09ba861beaf955b33712d5	False	0.408203125	data	3.3356393424384843	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x70000	0xe3bc	0xe400	1b279dad3e3d77fcdfb269a130bf474b	False	0.6334121436403509	data	6.778407783727912	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7f000	0x970	0xa00	77a9ddfc47a5650d6eebbcc823e39532	False	0.52421875	data	5.336289720085303	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
PNG	0x70674	0xb45	PNG image data, 93 x 302, 8-bit/color RGB, non-interlaced	1.0027729636048528
PNG	0x711bc	0x15a9	PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced	0.9363390441839495
RT_ICON	0x72768	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, resolution 2834 x 2834 px/m, 256 important colors	0.47832369942196534
RT_ICON	0x72cd0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, resolution 2834 x 2834 px/m, 256 important colors	0.5410649819494585
RT_ICON	0x73578	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, resolution 2834 x 2834 px/m, 256 important colors	0.4933368869936034
RT_ICON	0x74420	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2834 x 2834 px/m	0.5390070921985816
RT_ICON	0x74888	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2834 x 2834 px/m	0.41393058161350843
RT_ICON	0x75930	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2834 x 2834 px/m	0.3479253112033195
RT_ICON	0x77ed8	0x3d71	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9809269502193401
RT_DIALOG	0x7bc4c	0x2ba	data	0.5286532951289399
RT_DIALOG	0x7bf08	0x13a	data	0.6560509554140127
RT_DIALOG	0x7c044	0xf2	data	0.71900826446281
RT_DIALOG	0x7c138	0x14a	data	0.6
RT_DIALOG	0x7c284	0x314	data	0.47588832487309646
RT_DIALOG	0x7c598	0x24a	data	0.6279863481228669
RT_STRING	0x7c7e4	0x1fc	data	0.421259842519685
RT_STRING	0x7c9e0	0x246	data	0.41924398625429554
RT_STRING	0x7cc28	0x1a6	data	0.514218009478673
RT_STRING	0x7cdd0	0xdc	data	0.65
RT_STRING	0x7ceac	0x470	data	0.3873239436619718
RT_STRING	0x7d31c	0x164	data	0.5056179775280899
RT_STRING	0x7d480	0x110	data	0.5772058823529411
RT_STRING	0x7d590	0x158	data	0.4563953488372093
RT_STRING	0x7d6e8	0xe8	data	0.5948275862068966
RT_STRING	0x7d7d0	0x1c6	data	0.5242290748898678
RT_STRING	0x7d998	0x268	data	0.4837662337662338
RT_GROUP_ICON	0x7dc00	0x68	data	0.7019230769230769
RT_MANIFEST	0x7dc68	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	0.3957333333333333

Imports

DLL	Import
KERNEL32.dll	LocalFree, GetLastError, SetLastError, FormatMessageW, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, GetCurrentProcessId, CreateDirectoryW, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, GetVersionExW, GetModuleFileNameW, SetCurrentDirectoryW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, ExpandEnvironmentStringsW, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, GlobalMemoryStatusEx, LoadResource, SizeofResource, GetTimeFormatW, GetDateFormatW, GetExitCodeProcess, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetNumberFormatW, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetOEMCP, IsValidCodePage, FindNextFileA, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, InitializeCriticalSectionAndSpinCount, WaitForSingleObjectEx, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlPcToFileHeader, RtlUnwindEx, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, GetStringTypeW, HeapReAlloc, LCMapStringW, FindFirstFileExA
OLEAUT32.dll	SysAllocString, SysFreeString, VariantClear
gdiplus.dll	GdipCloneImage, GdipFree, GdipDisposeImage, GdipCreateBitmapFromStream, GdipCreateHBITMAPFromBitmap, GdiplusStartup, GdiplusShutdown, GdipAlloc

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 18, 2024 18:27:21.212874889 CEST	49708	443	192.168.2.5	104.20.3.235
Sep 18, 2024 18:27:21.212928057 CEST	443	49708	104.20.3.235	192.168.2.5
Sep 18, 2024 18:27:21.213012934 CEST	49708	443	192.168.2.5	104.20.3.235
Sep 18, 2024 18:27:21.229847908 CEST	49708	443	192.168.2.5	104.20.3.235
Sep 18, 2024 18:27:21.229873896 CEST	443	49708	104.20.3.235	192.168.2.5
Sep 18, 2024 18:27:21.727811098 CEST	443	49708	104.20.3.235	192.168.2.5
Sep 18, 2024 18:27:21.727894068 CEST	49708	443	192.168.2.5	104.20.3.235
Sep 18, 2024 18:27:21.790515900 CEST	49708	443	192.168.2.5	104.20.3.235
Sep 18, 2024 18:27:21.790549040 CEST	443	49708	104.20.3.235	192.168.2.5
Sep 18, 2024 18:27:21.790862083 CEST	443	49708	104.20.3.235	192.168.2.5
Sep 18, 2024 18:27:21.790955067 CEST	49708	443	192.168.2.5	104.20.3.235
Sep 18, 2024 18:27:21.790963888 CEST	443	49708	104.20.3.235	192.168.2.5
Sep 18, 2024 18:27:21.790990114 CEST	49708	443	192.168.2.5	104.20.3.235
Sep 18, 2024 18:27:21.832623005 CEST	49709	80	192.168.2.5	142.250.185.238
Sep 18, 2024 18:27:21.837600946 CEST	80	49709	142.250.185.238	192.168.2.5
Sep 18, 2024 18:27:21.837706089 CEST	49709	80	192.168.2.5	142.250.185.238
Sep 18, 2024 18:27:21.838429928 CEST	49709	80	192.168.2.5	142.250.185.238
Sep 18, 2024 18:27:21.843494892 CEST	80	49709	142.250.185.238	192.168.2.5
Sep 18, 2024 18:27:21.843693972 CEST	49709	80	192.168.2.5	142.250.185.238
Sep 18, 2024 18:27:21.878302097 CEST	49710	443	192.168.2.5	104.20.3.235
Sep 18, 2024 18:27:21.878379107 CEST	443	49710	104.20.3.235	192.168.2.5
Sep 18, 2024 18:27:21.878664017 CEST	49710	443	192.168.2.5	104.20.3.235
Sep 18, 2024 18:27:21.879628897 CEST	49710	443	192.168.2.5	104.20.3.235
Sep 18, 2024 18:27:21.879662991 CEST	443	49710	104.20.3.235	192.168.2.5
Sep 18, 2024 18:27:22.341552019 CEST	443	49710	104.20.3.235	192.168.2.5
Sep 18, 2024 18:27:22.341639042 CEST	49710	443	192.168.2.5	104.20.3.235
Sep 18, 2024 18:27:22.343673944 CEST	49710	443	192.168.2.5	104.20.3.235
Sep 18, 2024 18:27:22.343691111 CEST	443	49710	104.20.3.235	192.168.2.5
Sep 18, 2024 18:27:22.343813896 CEST	49710	443	192.168.2.5	104.20.3.235
Sep 18, 2024 18:27:22.343841076 CEST	443	49710	104.20.3.235	192.168.2.5
Sep 18, 2024 18:27:22.343945026 CEST	49710	443	192.168.2.5	104.20.3.235

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 18, 2024 18:27:21.204427958 CEST	56839	53	192.168.2.5	1.1.1.1
Sep 18, 2024 18:27:21.211338997 CEST	53	56839	1.1.1.1	192.168.2.5
Sep 18, 2024 18:27:21.821960926 CEST	59495	53	192.168.2.5	1.1.1.1
Sep 18, 2024 18:27:21.831228971 CEST	53	59495	1.1.1.1	192.168.2.5
Sep 18, 2024 18:27:35.407743931 CEST	59977	53	192.168.2.5	1.1.1.1
Sep 18, 2024 18:27:35.414832115 CEST	53	59977	1.1.1.1	192.168.2.5
Sep 18, 2024 18:27:36.409849882 CEST	53	64812	162.159.36.2	192.168.2.5
Sep 18, 2024 18:27:36.873608112 CEST	59522	53	192.168.2.5	1.1.1.1
Sep 18, 2024 18:27:36.881218910 CEST	53	59522	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 18, 2024 18:27:21.204427958 CEST	192.168.2.5	1.1.1.1	0xccc	Standard query (0)	pastebin.com	A (IP address)	IN (0x0001)	false
Sep 18, 2024 18:27:21.821960926 CEST	192.168.2.5	1.1.1.1	0x212f	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Sep 18, 2024 18:27:35.407743931 CEST	192.168.2.5	1.1.1.1	0xe820	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Sep 18, 2024 18:27:36.873608112 CEST	192.168.2.5	1.1.1.1	0xf0d	Standard query (0)	15.164.165.52.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 18, 2024 18:27:21.211338997 CEST	1.1.1.1	192.168.2.5	0xccc	No error (0)	pastebin.com		104.20.3.235	A (IP address)	IN (0x0001)	false
Sep 18, 2024 18:27:21.211338997 CEST	1.1.1.1	192.168.2.5	0xccc	No error (0)	pastebin.com		172.67.19.24	A (IP address)	IN (0x0001)	false
Sep 18, 2024 18:27:21.211338997 CEST	1.1.1.1	192.168.2.5	0xccc	No error (0)	pastebin.com		104.20.4.235	A (IP address)	IN (0x0001)	false
Sep 18, 2024 18:27:21.831228971 CEST	1.1.1.1	192.168.2.5	0x212f	No error (0)	google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Sep 18, 2024 18:27:35.414832115 CEST	1.1.1.1	192.168.2.5	0xe820	No error (0)	google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Sep 18, 2024 18:27:36.881218910 CEST	1.1.1.1	192.168.2.5	0xf0d	Name error (3)	15.164.165.52.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

Target ID:	0
Start time:	12:27:03
Start date:	18/09/2024
Path:	C:\Users\user\Desktop\123.sfx.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\123.sfx.exe"
Imagebase:	0x7ff704a80000
File size:	50'480'444 bytes
MD5 hash:	B38DFB77E2BF795EE75F3E20F493D493
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:27:09
Start date:	18/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c C:\users\public\123.exe
Imagebase:	0x7ff711900000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:27:09
Start date:	18/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:27:10
Start date:	18/09/2024
Path:	C:\Users\Public\123.exe
Wow64 process (32bit):	true
Commandline:	C:\users\public\123.exe
Imagebase:	0x400000
File size:	161'739'843 bytes
MD5 hash:	8A5D3B7370D1B880AD305C1691CDBE77
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:27:17
Start date:	18/09/2024
Path:	C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe" -Duser.language=en -Duser.country=US -Dfile.encoding=UTF-8 -classpath "lib\.;lib\..;lib\asm-all.jar;lib\dn-compiled-module.jar;lib\dn-php-sdk.jar;lib\gson.jar;lib\jphp-app-framework.jar;lib\jphp-core.jar;lib\jphp-desktop-ext.jar;lib\jphp-gui-ext.jar;lib\jphp-json-ext.jar;lib\jphp-runtime.jar;lib\jphp-xml-ext.jar;lib\jphp-zend-ext.jar;lib\jphp-zip-ext.jar;lib\slf4j-api.jar;lib\slf4j-simple.jar;lib\zt-zip.jar" org.develnext.jphp.ext.javafx.FXLauncher
Imagebase:	0x20000
File size:	191'552 bytes
MD5 hash:	48C96771106DBDD5D42BBA3772E4B414
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:27:21
Start date:	18/09/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall set domainprofile state off
Imagebase:	0x1080000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:27:21
Start date:	18/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	12.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	26.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	26

Executed Functions

Function 00007FF704AAB190 Relevance: 123.9, APIs: 60, Strings: 10, Instructions: 1421windowfilesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF704A8255C: GetDlgItem.USER32 ref: 00007FF704A825AC
Part of subcall function 00007FF704A8255C: SetWindowTextW.USER32 ref: 00007FF704A825C8

EndDialog.USER32 ref: 00007FF704AAB2D0
SetDlgItemTextW.USER32 ref: 00007FF704AAB320
GetMessageW.USER32 ref: 00007FF704AAB350
IsDialogMessageW.USER32 ref: 00007FF704AAB369
TranslateMessage.USER32 ref: 00007FF704AAB37B
DispatchMessageW.USER32 ref: 00007FF704AAB389
EndDialog.USER32 ref: 00007FF704AAB3D3
GetDlgItem.USER32 ref: 00007FF704AAB410
SendMessageW.USER32 ref: 00007FF704AAB431
SendMessageW.USER32 ref: 00007FF704AAB449
SetFocus.USER32 ref: 00007FF704AAB452
GetLastError.KERNEL32 ref: 00007FF704AAB634
GetLastError.KERNEL32 ref: 00007FF704AAB665
GetTickCount.KERNEL32 ref: 00007FF704AAB68B
GetLastError.KERNEL32 ref: 00007FF704AAB6F5
GetCommandLineW.KERNEL32 ref: 00007FF704AAB841
CreateFileMappingW.KERNEL32 ref: 00007FF704AAB900
MapViewOfFile.KERNEL32 ref: 00007FF704AAB923
Sleep.KERNEL32 ref: 00007FF704AAB9B6
UnmapViewOfFile.KERNEL32 ref: 00007FF704AAB9DF
CloseHandle.KERNEL32 ref: 00007FF704AAB9E8
SetDlgItemTextW.USER32 ref: 00007FF704AABCDE
DialogBoxParamW.USER32 ref: 00007FF704AAC0D7
EndDialog.USER32 ref: 00007FF704AAC0EF
EnableWindow.USER32 ref: 00007FF704AAC2A6
SendMessageW.USER32 ref: 00007FF704AAC2F8
ShellExecuteExW.SHELL32 ref: 00007FF704AAB95B

Part of subcall function 00007FF704A9AAE0: LoadStringW.USER32 ref: 00007FF704A9AB67
Part of subcall function 00007FF704A9AAE0: LoadStringW.USER32 ref: 00007FF704A9AB80

SendMessageW.USER32 ref: 00007FF704AABEC3
SendDlgItemMessageW.USER32 ref: 00007FF704AABEEA
GetDlgItem.USER32 ref: 00007FF704AABEF8
SendMessageW.USER32 ref: 00007FF704AABF12
GetDlgItem.USER32 ref: 00007FF704AABF4F
SetDlgItemTextW.USER32 ref: 00007FF704AABFEC
SetDlgItemTextW.USER32 ref: 00007FF704AAC004
SetDlgItemTextW.USER32 ref: 00007FF704AAC321
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AAC363
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AAC369
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AAC36F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AAC375
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AAC37B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AAC381
SendDlgItemMessageW.USER32 ref: 00007FF704AAC449
EndDialog.USER32 ref: 00007FF704AAC463
GetDlgItem.USER32 ref: 00007FF704AAC491
SetFocus.USER32 ref: 00007FF704AAC49A
SendDlgItemMessageW.USER32 ref: 00007FF704AAC53E
FindFirstFileW.KERNEL32 ref: 00007FF704AAC562
FindClose.KERNEL32 ref: 00007FF704AAC68A
SendDlgItemMessageW.USER32 ref: 00007FF704AAC7AF

Part of subcall function 00007FF704A8129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF704A81396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AACAA9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AACAAF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AACAB5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AACABB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AACAC1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AACAC7

Strings

@, xrefs: 00007FF704AAB7B6
winrarsfxmappingfile.tmp, xrefs: 00007FF704AAB8E0
REPLACEFILEDLG, xrefs: 00007FF704AAC3D3
STARTDLG, xrefs: 00007FF704AAB1CA
runas, xrefs: 00007FF704AAB7C9
LICENSEDLG, xrefs: 00007FF704AAC0C9
-el -s2 "-d%s" "-sp%s", xrefs: 00007FF704AAB799
__tmp_rar_sfx_access_check_, xrefs: 00007FF704AAB6A9
p, xrefs: 00007FF704AAB7AB
%s %s, xrefs: 00007FF704AAC6D9, 00007FF704AAC946

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: Item$Message$_invalid_parameter_noinfo_noreturn$Send$DialogText$File$ErrorLast$CloseFindFocusLoadStringViewWindow$CommandConcurrency::cancel_current_taskCountCreateDispatchEnableExecuteFirstHandleLineMappingParamShellSleepTickTranslateUnmap
String ID: %s %s$-el -s2 "-d%s" "-sp%s"$@$LICENSEDLG$REPLACEFILEDLG$STARTDLG$__tmp_rar_sfx_access_check_$p$runas$winrarsfxmappingfile.tmp
API String ID: 255727823-2702805183
Opcode ID: 6f53b02eb7464d83d42a93208eec5b4be614a98b9f353964e001bbae5b26f983
Instruction ID: 26d351f88a6495b9efe540dbc0f8b3ef233b7190ccbc24c22af1006904f8f62f
Opcode Fuzzy Hash: 6f53b02eb7464d83d42a93208eec5b4be614a98b9f353964e001bbae5b26f983
Instruction Fuzzy Hash: 61D2C5A2A0868241FA20FF27ECC4AF9E351EF85794FE04136DA5D066A6DF3CE554C760

Function 00007FF704AACE88 Relevance: 65.0, APIs: 26, Strings: 10, Instructions: 1963windowfileCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF704AAD5F3
SendMessageW.USER32 ref: 00007FF704AAD626
SendMessageW.USER32 ref: 00007FF704AAD655
MoveFileW.KERNEL32 ref: 00007FF704AADB4B
MoveFileExW.KERNEL32 ref: 00007FF704AADB69
GetTempPathW.KERNEL32 ref: 00007FF704AADC49

Part of subcall function 00007FF704A81FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A81FFB

EndDialog.USER32 ref: 00007FF704AADFCA
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF704AAEEE3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AAEEEF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AAEF07
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AAEF0D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AAEF13
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AAEF19
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AAEF1F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AAEF25
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AAEF2B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AAEF31
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AAEF37
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AAEF3D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AAEF43
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AAEF49
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AAEF4F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AAEF55
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AAEF5B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF704AAEF67
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF704AAEF73

Strings

.lnk, xrefs: 00007FF704AAE406, 00007FF704AAE415
MAX, xrefs: 00007FF704AAEA82, 00007FF704AAEA91
lnk, xrefs: 00007FF704AAE3CA, 00007FF704AAE3D9
MIN, xrefs: 00007FF704AAEAE5, 00007FF704AAEAF4
.tmp, xrefs: 00007FF704AADA85
Software\Microsoft\Windows\CurrentVersion, xrefs: 00007FF704AAD501
HIDE, xrefs: 00007FF704AAE9E5, 00007FF704AAE9F4
ProgramFilesDir, xrefs: 00007FF704AAD4F0
@set:user, xrefs: 00007FF704AADD96, 00007FF704AADDA5
<br>, xrefs: 00007FF704AAD6DA, 00007FF704AAD6E9

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task$FileMessageMoveSend$DialogItemPathTemp
String ID: .lnk$.tmp$<br>$@set:user$HIDE$MAX$MIN$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion$lnk
API String ID: 3007431893-3916287355
Opcode ID: 31b0b718fa814e184653d6f2130b1fd389ebb481cc2203161add382f4dedccaa
Instruction ID: 70c02f6cc52c2d470a0bbbc36ce9d85dd0972a0a7f4ecfd8554d3ec38f123be8
Opcode Fuzzy Hash: 31b0b718fa814e184653d6f2130b1fd389ebb481cc2203161add382f4dedccaa
Instruction Fuzzy Hash: A213B0B3A0478285EB10EF66DCC0AED67A1EF40398FA00536DA5D17AD9DF38D595C3A0

Function 00007FF704AB0754 Relevance: 45.9, APIs: 21, Strings: 5, Instructions: 380
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF704A9DFD0: GetModuleHandleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF704A9E018
Part of subcall function 00007FF704A9DFD0: GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF704A9E030
Part of subcall function 00007FF704A9DFD0: GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF704A9E05D

Part of subcall function 00007FF704A962DC: GetCurrentDirectoryW.KERNEL32 ref: 00007FF704A962F2
Part of subcall function 00007FF704A962DC: GetCurrentDirectoryW.KERNEL32 ref: 00007FF704A9632C

Part of subcall function 00007FF704AA946C: OleInitialize.OLE32 ref: 00007FF704AA9486
Part of subcall function 00007FF704AA946C: SHGetMalloc.SHELL32 ref: 00007FF704AA94D4

GetCommandLineW.KERNEL32 ref: 00007FF704AB096E
OpenFileMappingW.KERNEL32 ref: 00007FF704AB0A07
MapViewOfFile.KERNEL32 ref: 00007FF704AB0A30
UnmapViewOfFile.KERNEL32 ref: 00007FF704AB0A46
MapViewOfFile.KERNEL32 ref: 00007FF704AB0A63
UnmapViewOfFile.KERNEL32 ref: 00007FF704AB0ACA
CloseHandle.KERNEL32 ref: 00007FF704AB0AD3
SetEnvironmentVariableW.KERNEL32 ref: 00007FF704AB0BAD
GetLocalTime.KERNEL32 ref: 00007FF704AB0BB8
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF704AB0C13
SetEnvironmentVariableW.KERNEL32 ref: 00007FF704AB0C26
GetModuleHandleW.KERNEL32 ref: 00007FF704AB0C2E
LoadIconW.USER32 ref: 00007FF704AB0C4D
DialogBoxParamW.USER32 ref: 00007FF704AB0CB6
Sleep.KERNEL32 ref: 00007FF704AB0CE6
DeleteObject.GDI32 ref: 00007FF704AB0D0D
DeleteObject.GDI32 ref: 00007FF704AB0D1F
CloseHandle.KERNEL32 ref: 00007FF704AB0D67
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AB0DD7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AB0DDD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AB0DE3

Part of subcall function 00007FF704AAFD0C: SetEnvironmentVariableW.KERNEL32 ref: 00007FF704AAFD43
Part of subcall function 00007FF704AAFD0C: SetEnvironmentVariableW.KERNEL32 ref: 00007FF704AAFDBC

Strings

winrarsfxmappingfile.tmp, xrefs: 00007FF704AB09F9
sfxstime, xrefs: 00007FF704AB0C1F
sfxname, xrefs: 00007FF704AB0B9B
STARTDLG, xrefs: 00007FF704AB0CA5
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 00007FF704AB0C02

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: File$EnvironmentHandleVariableView$_invalid_parameter_noinfo_noreturn$AddressCloseCurrentDeleteDirectoryModuleObjectProcUnmap$CommandDialogIconInitializeLineLoadLocalMallocMappingOpenParamSleepTimeswprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 1048086575-3710569615
Opcode ID: c329a48066309f809b0ed759e5440bf592438963a56de83793cfb2c4d91a7b0a
Instruction ID: 2d3d6297782f0cd3928e842955fbae92f86eb6a19cd72473b420f2b68f52e876
Opcode Fuzzy Hash: c329a48066309f809b0ed759e5440bf592438963a56de83793cfb2c4d91a7b0a
Instruction Fuzzy Hash: 6F128AA1A1878285EB10BF27ECC56B9E361FF84784FE04235DA9D46A96DF3CE150C760

Function 00007FF704A9A4AC Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 250
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF704A9A504

Part of subcall function 00007FF704AA0F68: WideCharToMultiByte.KERNEL32 ref: 00007FF704AA0F99

SetDlgItemTextW.USER32 ref: 00007FF704A9A573
GetWindowRect.USER32 ref: 00007FF704A9A5AD
GetClientRect.USER32 ref: 00007FF704A9A5BB
GetWindowLongPtrW.USER32 ref: 00007FF704A9A66C
GetWindowRect.USER32 ref: 00007FF704A9A6B2
SetWindowTextW.USER32 ref: 00007FF704A9A6EC
GetSystemMetrics.USER32 ref: 00007FF704A9A6F7
GetWindow.USER32 ref: 00007FF704A9A708
GetWindowRect.USER32 ref: 00007FF704A9A746
GetWindow.USER32 ref: 00007FF704A9A808

Strings

CAPTION, xrefs: 00007FF704A9A6CF
$%s:, xrefs: 00007FF704A9A4EF

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWideswprintf
String ID: $%s:$CAPTION
API String ID: 2100155373-404845831
Opcode ID: 1224945cd41bf140f0dcf37f1b002595631e4f701a4b658f84a72e9da714e3d9
Instruction ID: 9675d140b705c56b3875b648a800a113b8330e12a5e6b845f7d2909eda73f1fe
Opcode Fuzzy Hash: 1224945cd41bf140f0dcf37f1b002595631e4f701a4b658f84a72e9da714e3d9
Instruction Fuzzy Hash: 0091F972B1864186EB54EF2AAC40A6AF7A1FF84784F905535EE4D47B59CF3CE805CB10

Function 00007FF704AA8624 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 101
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceExW.KERNELBASE ref: 00007FF704AA863D
SizeofResource.KERNEL32 ref: 00007FF704AA8659
LoadResource.KERNEL32 ref: 00007FF704AA8673
LockResource.KERNEL32 ref: 00007FF704AA8685
GlobalAlloc.KERNELBASE ref: 00007FF704AA86A6
GlobalLock.KERNEL32 ref: 00007FF704AA86BB
CreateStreamOnHGlobal.COMBASE ref: 00007FF704AA86E8
GdipAlloc.GDIPLUS ref: 00007FF704AA86FE
GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 00007FF704AA8769
GlobalUnlock.KERNEL32 ref: 00007FF704AA878C
GlobalFree.KERNEL32 ref: 00007FF704AA8795

Strings

PNG, xrefs: 00007FF704AA862F

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: Global$Resource$AllocCreateGdipLock$BitmapFindFreeFromLoadSizeofStreamUnlock
String ID: PNG
API String ID: 211097158-364855578
Opcode ID: c8606208415c3a11eb94d5df8c8f8595ea54109f2541637b646828bce78d4013
Instruction ID: cd4c3dc26ed25abe8ef2f493dc938272e4987847a7c4bb61f9f17bb6aa2a707b
Opcode Fuzzy Hash: c8606208415c3a11eb94d5df8c8f8595ea54109f2541637b646828bce78d4013
Instruction Fuzzy Hash: A64130A6A09B0681EE54BF57DC84B79E3A0BF88B95FA44439CE1D47364EF7CE4448360

Function 00007FF704A8F930 Relevance: 17.2, APIs: 8, Strings: 1, Instructions: 1417COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A91239
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A9123F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A91245
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A9124B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A91251
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A91257
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A9125D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A91263

Strings

__tmp_reference_source_, xrefs: 00007FF704A8FCCF, 00007FF704A8FCDE

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: __tmp_reference_source_
API String ID: 3668304517-685763994
Opcode ID: 7e088de4b94aaccf94bd5879c844e6984537f535aefd07da26bfa6e916f89134
Instruction ID: 44959b996d26a15045e02bd940ad307354920eda5c054d181b79a5b24e3e2dbc
Opcode Fuzzy Hash: 7e088de4b94aaccf94bd5879c844e6984537f535aefd07da26bfa6e916f89134
Instruction Fuzzy Hash: D5E297A2A0C6C295EA64AF26DC807BEE761FF81784FA04136DB9D076A5CF3CE455C710

Function 00007FF704A84840 Relevance: 12.1, APIs: 5, Strings: 1, Instructions: 1624COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A8511E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A85124
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A8512A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A85E16
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A85E1C

Strings

CMT, xrefs: 00007FF704A859B2

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: CMT
API String ID: 3668304517-2756464174
Opcode ID: 62028e1e7948fae5946deb5f61571c4559f74175e386f169438dbf835b9dcef5
Instruction ID: fadc64abdd2f902744d7ea8ef14339a4addd672be94741ad616d4d3eb8916dcc
Opcode Fuzzy Hash: 62028e1e7948fae5946deb5f61571c4559f74175e386f169438dbf835b9dcef5
Instruction Fuzzy Hash: 13E205A2B0868296EB14EF62DC90AFDA7A1FF45784FA00039DA5E47796DF3CE454C310

Function 00007FF704A940BC Relevance: 10.7, APIs: 7, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE ref: 00007FF704A9410B
FindFirstFileW.KERNELBASE ref: 00007FF704A9415E
GetLastError.KERNEL32 ref: 00007FF704A941AF
FindNextFileW.KERNEL32 ref: 00007FF704A941D7
GetLastError.KERNEL32 ref: 00007FF704A941E5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A9430F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A94315

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: FileFind$ErrorFirstLast_invalid_parameter_noinfo_noreturn$Next
String ID:
API String ID: 474548282-0
Opcode ID: 302a779ab95c7aaca0ba1f13af6e7309770b234b011da9b93882c2eb88fdf2be
Instruction ID: ed5ed561f0bd5b4e007339c7820de198ea9534897bab4290dd08badc318e650a
Opcode Fuzzy Hash: 302a779ab95c7aaca0ba1f13af6e7309770b234b011da9b93882c2eb88fdf2be
Instruction Fuzzy Hash: C561B9A2A0964281EA10AF16ECC067DA361FF897A4FA04331EABD477D9DF3CD945C710

Function 00007FF704A85E24 Relevance: 7.6, APIs: 3, Strings: 1, Instructions: 586
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CMT, xrefs: 00007FF704A859B2, 00007FF704A8675B

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID:
String ID: CMT
API String ID: 0-2756464174
Opcode ID: 920946c3a46788dbc14b960d280913d1087d646ed99960bedbc598b6726ca41f
Instruction ID: ce34b1810488f252844c73c8134d5aa9ef788b9fbaa368ecff45f819603cee16
Opcode Fuzzy Hash: 920946c3a46788dbc14b960d280913d1087d646ed99960bedbc598b6726ca41f
Instruction Fuzzy Hash: 4B42B0A2B0868196FB18EF76C9906FDB7A0EF55344FA0013ADB5E53696DF38E518C310

Function 00007FF704AA1F20 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9760fb6421b16e0e583802a284a649d5527ae7ea6cefd943f702fc6b6a5a6041
Instruction ID: fc67309a37aae420e428ef4000a60211f97158cf698e90cd28da80995c68e6ef
Opcode Fuzzy Hash: 9760fb6421b16e0e583802a284a649d5527ae7ea6cefd943f702fc6b6a5a6041
Instruction Fuzzy Hash: 99E129B3A082C24AEB60EF2AA88467DB790FF48748FA44135EB4E47745DF7CE5618354

Function 00007FF704AA3484 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bca6f1c51f28919b1ed0d44622ea5b19d03515415c361c6bf899ecd233d7ad4e
Instruction ID: 2c70fde676f7448a54f5915f680a39a93aa679700bf5d055e297a003e59af6a0
Opcode Fuzzy Hash: bca6f1c51f28919b1ed0d44622ea5b19d03515415c361c6bf899ecd233d7ad4e
Instruction Fuzzy Hash: 5AB1CFE3B04AC992DE58EE66D948AE9A391BB09FC4F988036DE0D07741DF3CE165C350

Function 00007FF704A94928 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID:
API String ID: 3340455307-0
Opcode ID: f6454b2c1b1e68d014e1640965d37ec1740da2d9ebd20a94f833f325a54cd594
Instruction ID: 5fad0a3b62d1c6e4c979bfec4433a92723de5c630c02c9bc0230ec4a0c2520ac
Opcode Fuzzy Hash: f6454b2c1b1e68d014e1640965d37ec1740da2d9ebd20a94f833f325a54cd594
Instruction Fuzzy Hash: CA411962B1965686FB64EF13AD90B6AA252FFC8784FA44034DE0D07B95CF3CE8438754

Function 00007FF704A9DFD0 Relevance: 143.9, APIs: 16, Strings: 66, Instructions: 440
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF704A9E018
GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF704A9E030
GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF704A9E05D
CreateFileW.KERNEL32 ref: 00007FF704A9E3F0
SetFilePointer.KERNEL32 ref: 00007FF704A9E40E
ReadFile.KERNEL32 ref: 00007FF704A9E436

Part of subcall function 00007FF704A9DFD0: GetSystemDirectoryW.KERNEL32 ref: 00007FF704A9DDDF

CompareStringW.KERNELBASE ref: 00007FF704A9E559
CloseHandle.KERNEL32 ref: 00007FF704A9E4F3

Part of subcall function 00007FF704A81FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A81FFB

Part of subcall function 00007FF704A951A4: GetVersionExW.KERNEL32 ref: 00007FF704A951D5

Part of subcall function 00007FF704A9DFD0: LoadLibraryExW.KERNELBASE ref: 00007FF704A9DEFF
Part of subcall function 00007FF704A9DFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A9DFB5
Part of subcall function 00007FF704A9DFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A9DFBB
Part of subcall function 00007FF704A9DFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A9DFC1
Part of subcall function 00007FF704A9DFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A9DFC7

AllocConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF704A9E74B
GetCurrentProcessId.KERNEL32(?,?,?,00000000,?), ref: 00007FF704A9E755
AttachConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF704A9E75D
GetStdHandle.KERNEL32(?,?,?,00000000,?), ref: 00007FF704A9E780
WriteConsoleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF704A9E799
Sleep.KERNEL32(?,?,?,00000000,?), ref: 00007FF704A9E7A4
FreeConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF704A9E7AA
ExitProcess.KERNEL32 ref: 00007FF704A9E7BB

Strings

Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00007FF704A9E73B
netapi32.dll, xrefs: 00007FF704A9E16B
SetDllDirectoryW, xrefs: 00007FF704A9E026
slc.dll, xrefs: 00007FF704A9E23D
psapi.dll, xrefs: 00007FF704A9E115
aclui.dll, xrefs: 00007FF704A9E371
ws2_32.dll, xrefs: 00007FF704A9E0FF
msasn1.dll, xrefs: 00007FF704A9E195
comres.dll, xrefs: 00007FF704A9E0F4
cryptui.dll, xrefs: 00007FF704A9E1A3
setupapi.dll, xrefs: 00007FF704A9E141
ntmarta.dll, xrefs: 00007FF704A9E1F7
cryptbase.dll, xrefs: 00007FF704A9E0C8
cabinet.dll, xrefs: 00007FF704A9E1DB
rasadhlp.dll, xrefs: 00007FF704A9E30F
RpcRtRemote.dll, xrefs: 00007FF704A9E363
ws2help.dll, xrefs: 00007FF704A9E10A
apphelp.dll, xrefs: 00007FF704A9E14F
usp10.dll, xrefs: 00007FF704A9E0DE
profapi.dll, xrefs: 00007FF704A9E205
WINNSI.DLL, xrefs: 00007FF704A9E275
atl.dll, xrefs: 00007FF704A9E136
mlang.dll, xrefs: 00007FF704A9E2BB
devrtl.dll, xrefs: 00007FF704A9E29F
dnsapi.DLL, xrefs: 00007FF704A9E259
wintrust.dll, xrefs: 00007FF704A9E1B1
srvcli.dll, xrefs: 00007FF704A9E221
DXGIDebug.dll, xrefs: 00007FF704A9E086, 00007FF704A9E5B6
rsaenh.dll, xrefs: 00007FF704A9E0A7
samlib.dll, xrefs: 00007FF704A9E2D7
imageres.dll, xrefs: 00007FF704A9E24B
sfc_os.dll, xrefs: 00007FF704A9E091
lpk.dll, xrefs: 00007FF704A9E0D3
propsys.dll, xrefs: 00007FF704A9E2AD
samcli.dll, xrefs: 00007FF704A9E2C9
netutils.dll, xrefs: 00007FF704A9E283
iphlpapi.DLL, xrefs: 00007FF704A9E267
secur32.dll, xrefs: 00007FF704A9E1CD
version.dll, xrefs: 00007FF704A9E07B
clbcatq.dll, xrefs: 00007FF704A9E0E9
dfscli.dll, xrefs: 00007FF704A9E2F3
dhcpcsvc6.dll, xrefs: 00007FF704A9E31D
dhcpcsvc.dll, xrefs: 00007FF704A9E32B
XmlLite.dll, xrefs: 00007FF704A9E339
kernel32, xrefs: 00007FF704A9E011
shell32.dll, xrefs: 00007FF704A9E1BF
SetDefaultDllDirectories, xrefs: 00007FF704A9E053
oleaccrc.dll, xrefs: 00007FF704A9E1E9
wkscli.dll, xrefs: 00007FF704A9E2E5
uxtheme.dll, xrefs: 00007FF704A9E66D
cscapi.dll, xrefs: 00007FF704A9E22F
SSPICLI.DLL, xrefs: 00007FF704A9E09C
UXTheme.dll, xrefs: 00007FF704A9E0B2
WindowsCodecs.dll, xrefs: 00007FF704A9E213
dsrole.dll, xrefs: 00007FF704A9E37F
peerdist.dll, xrefs: 00007FF704A9E38D
browcli.dll, xrefs: 00007FF704A9E301
linkinfo.dll, xrefs: 00007FF704A9E347
dwmapi.dll, xrefs: 00007FF704A9E0BD, 00007FF704A9E661
userenv.dll, xrefs: 00007FF704A9E15D
crypt32.dll, xrefs: 00007FF704A9E187
ntshrui.dll, xrefs: 00007FF704A9E12B
ieframe.dll, xrefs: 00007FF704A9E120
shdocvw.dll, xrefs: 00007FF704A9E179
mpr.dll, xrefs: 00007FF704A9E291
cryptsp.dll, xrefs: 00007FF704A9E355

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Console$FileHandle$AddressProcProcess$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadModulePointerReadSleepStringSystemVersionWrite
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$RpcRtRemote.dll$SSPICLI.DLL$SetDefaultDllDirectories$SetDllDirectoryW$UXTheme.dll$WINNSI.DLL$WindowsCodecs.dll$XmlLite.dll$aclui.dll$apphelp.dll$atl.dll$browcli.dll$cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$cryptbase.dll$cryptsp.dll$cryptui.dll$cscapi.dll$devrtl.dll$dfscli.dll$dhcpcsvc.dll$dhcpcsvc6.dll$dnsapi.DLL$dsrole.dll$dwmapi.dll$ieframe.dll$imageres.dll$iphlpapi.DLL$kernel32$linkinfo.dll$lpk.dll$mlang.dll$mpr.dll$msasn1.dll$netapi32.dll$netutils.dll$ntmarta.dll$ntshrui.dll$oleaccrc.dll$peerdist.dll$profapi.dll$propsys.dll$psapi.dll$rasadhlp.dll$rsaenh.dll$samcli.dll$samlib.dll$secur32.dll$setupapi.dll$sfc_os.dll$shdocvw.dll$shell32.dll$slc.dll$srvcli.dll$userenv.dll$usp10.dll$uxtheme.dll$version.dll$wintrust.dll$wkscli.dll$ws2_32.dll$ws2help.dll
API String ID: 1496594111-2013832382
Opcode ID: f7f2a11762ce96c0b678dc2ee5f4093b28e28463b6618f01c06ebafbf4af03a3
Instruction ID: 9917d3ac34fa113e956cfda3e76397c36241e3ef8a4f978a85a1c919f013f49b
Opcode Fuzzy Hash: f7f2a11762ce96c0b678dc2ee5f4093b28e28463b6618f01c06ebafbf4af03a3
Instruction Fuzzy Hash: 5D3231B1A09B8195EB61AF62EC809EAB3A8FF44354FE00136DA4D077A5EF3CD655C350

Function 00007FF704A998DC Relevance: 25.2, APIs: 3, Strings: 11, Instructions: 702COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF704A98E58: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF704A98F8D

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF704A99F75
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A9A42F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A9A435

Part of subcall function 00007FF704AA0BBC: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF704AA0B44), ref: 00007FF704AA0BE9

Strings

*messages***, xrefs: 00007FF704A99BC6
@%s:, xrefs: 00007FF704A99F57
DIALOG, xrefs: 00007FF704A99DCD
, xrefs: 00007FF704A99DF9
DIRECTION, xrefs: 00007FF704A99DE5
RTL, xrefs: 00007FF704A99F2E
*messages***, xrefs: 00007FF704A99C04
STRINGS, xrefs: 00007FF704A99DC1
,, xrefs: 00007FF704A99FAA
$%s:, xrefs: 00007FF704A99F50
MENU, xrefs: 00007FF704A99DD9

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ByteCharConcurrency::cancel_current_taskMultiWide_snwprintf
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$DIALOG$DIRECTION$MENU$RTL$STRINGS
API String ID: 3629253777-3268106645
Opcode ID: f8d2576f2d3b58c8de45b6f33364cb60e7b4664a3fbb63d368bfc9699b226bdf
Instruction ID: 39af13f69fce6782998cfc593e05c981d82b346858703904652de5cb920f472c
Opcode Fuzzy Hash: f8d2576f2d3b58c8de45b6f33364cb60e7b4664a3fbb63d368bfc9699b226bdf
Instruction Fuzzy Hash: 1362AEA2A1968295EB10EF26DCC4ABEA365FF40784FE04136DA4D47795EF3CE944C360

Function 00007FF704AB1900 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 195
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF704AB1558: DloadProtectSection.DELAYIMP ref: 00007FF704AB15C9

RaiseException.KERNEL32 ref: 00007FF704AB19A7
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FF704AB1993

Part of subcall function 00007FF704AB1868: DloadProtectSection.DELAYIMP ref: 00007FF704AB18C7

LoadLibraryExA.KERNELBASE ref: 00007FF704AB1A46
GetLastError.KERNEL32 ref: 00007FF704AB1A54
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FF704AB1A86
RaiseException.KERNEL32 ref: 00007FF704AB1A9A

Strings

H, xrefs: 00007FF704AB1974

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: DloadSection$AccessExceptionProtectRaiseReleaseWrite$ErrorLastLibraryLoad
String ID: H
API String ID: 3432403771-2852464175
Opcode ID: cf3fc932a6b7fb7fc9ef8320b4dd67bfc8d7ec91281715f792326570f1d4a57f
Instruction ID: 78512ea54d84dae8065f739093a9b2ff31970f4f27629f7e694a5b56631e45e7
Opcode Fuzzy Hash: cf3fc932a6b7fb7fc9ef8320b4dd67bfc8d7ec91281715f792326570f1d4a57f
Instruction Fuzzy Hash: 3F916EB2A05B5186EB50EF66DC90AA8B3B0FF08B94FA44539CE0D17745EF38E445C360

Function 00007FF704AAF4E0 Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 285
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32 ref: 00007FF704AAF747
ShowWindow.USER32 ref: 00007FF704AAF786
GetExitCodeProcess.KERNEL32 ref: 00007FF704AAF7BD
CloseHandle.KERNEL32 ref: 00007FF704AAF7E7
ShowWindow.USER32 ref: 00007FF704AAF83F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AAF8FB

Strings

.exe, xrefs: 00007FF704AAF7F2
p, xrefs: 00007FF704AAF529
Install, xrefs: 00007FF704AAF684
.inf, xrefs: 00007FF704AAF675

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: ShowWindow$CloseCodeExecuteExitHandleProcessShell_invalid_parameter_noinfo_noreturn
String ID: .exe$.inf$Install$p
API String ID: 1054546013-3607691742
Opcode ID: f5c8b309920baf1e38cfe499d4066692b9784065f97d1b9ba7782783299fb154
Instruction ID: e0ed9c64c54df8e145fddb430064d8eb1083130e2052d0dbe173274fd799e13d
Opcode Fuzzy Hash: f5c8b309920baf1e38cfe499d4066692b9784065f97d1b9ba7782783299fb154
Instruction Fuzzy Hash: 51C193A2F0860299FA54EF27DDC0A79A371AF88784FA44035DA4D477A5DF3CE46183A4

Function 00007FF704AAF0A4 Relevance: 16.6, APIs: 11, Instructions: 102
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF704AAAE1C: PeekMessageW.USER32 ref: 00007FF704AAAE32
Part of subcall function 00007FF704AAAE1C: GetMessageW.USER32 ref: 00007FF704AAAE49
Part of subcall function 00007FF704AAAE1C: IsDialogMessageW.USER32 ref: 00007FF704AAAE60
Part of subcall function 00007FF704AAAE1C: TranslateMessage.USER32 ref: 00007FF704AAAE6F
Part of subcall function 00007FF704AAAE1C: DispatchMessageW.USER32 ref: 00007FF704AAAE7A

GetDlgItem.USER32 ref: 00007FF704AAF0E3
ShowWindow.USER32 ref: 00007FF704AAF109
SendMessageW.USER32 ref: 00007FF704AAF11E
SendMessageW.USER32 ref: 00007FF704AAF136
SendMessageW.USER32 ref: 00007FF704AAF157
SendMessageW.USER32 ref: 00007FF704AAF173
SendMessageW.USER32 ref: 00007FF704AAF1B6
SendMessageW.USER32 ref: 00007FF704AAF1D4
SendMessageW.USER32 ref: 00007FF704AAF1E8
SendMessageW.USER32 ref: 00007FF704AAF212
SendMessageW.USER32 ref: 00007FF704AAF22A

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID:
API String ID: 3569833718-0
Opcode ID: c58ef51af4c11ae469b78d40ba7290d4e9656f32b0895ce54e4debee0d1a06d9
Instruction ID: 857680ef488964ddead4326770d841c1653b1d2709ad2fcc88e8a0475d1d120e
Opcode Fuzzy Hash: c58ef51af4c11ae469b78d40ba7290d4e9656f32b0895ce54e4debee0d1a06d9
Instruction Fuzzy Hash: 9141C0A2B1464286F710AF63EC54FAA6360EF85B8CFA40135DD1E07B95CF3DE4458768

Function 00007FF704A96A0C Relevance: 16.2, APIs: 6, Strings: 3, Instructions: 444
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A970A6

Part of subcall function 00007FF704A82004: std::_Xinvalid_argument.LIBCPMT ref: 00007FF704A8200F

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A970B2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A970B8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A970C4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A970D6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A970DC

Strings

\\?\, xrefs: 00007FF704A96A57, 00007FF704A96A66
UNC, xrefs: 00007FF704A96BBF
DXGIDebug.dll, xrefs: 00007FF704A96A18

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Xinvalid_argumentstd::_
String ID: DXGIDebug.dll$UNC$\\?\
API String ID: 4097890229-4048004291
Opcode ID: 578fd2387317544cd648c907e913c9b970bf7a6567f04bf42065129e2c891f4e
Instruction ID: 7e5c5bd7ca0935a1f5b9393320e1dd1822152fb9da53500700e1491d0ca8755e
Opcode Fuzzy Hash: 578fd2387317544cd648c907e913c9b970bf7a6567f04bf42065129e2c891f4e
Instruction Fuzzy Hash: 4E12A2A2B18A4284EB10EF66DC845BDA371EF81B98FA04135DA5D07BE9DF3CD945C360

Function 00007FF704A8EF10 Relevance: 11.0, APIs: 7, Instructions: 453COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A8F542
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A8F548
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A8F554
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A8F55A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A8F560
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A8F56C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A8F572

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 2cdda2d44f2f3f9bb0a3e7cdc727b5379f904c783244e4c9adda47cb215496cb
Instruction ID: eb50d2ab116f5ea522145c7d84b9ec7f22104eb5a8770213016ca560a3838a93
Opcode Fuzzy Hash: 2cdda2d44f2f3f9bb0a3e7cdc727b5379f904c783244e4c9adda47cb215496cb
Instruction Fuzzy Hash: B612C5A2F1874284EB10EF66D8846BDA371EF45798FA0023AEA5C17AD6DF3CD585C350

Function 00007FF704A924C0 Relevance: 9.2, APIs: 6, Instructions: 164
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FF704A9259B
GetLastError.KERNEL32 ref: 00007FF704A925AE
CreateFileW.KERNEL32 ref: 00007FF704A9260E
GetLastError.KERNEL32 ref: 00007FF704A92617
SetFileTime.KERNEL32 ref: 00007FF704A926C9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A92736

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: File$CreateErrorLast$Time_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3536497005-0
Opcode ID: 33f6b48159d5b7d750ef9f2960fa93fa1ced6f4fdcb3bbf877704cc21e72eec3
Instruction ID: df60252e9be6fdd1a25f3d0abf9865961102933b1fe0a33ff2d9f57901c89874
Opcode Fuzzy Hash: 33f6b48159d5b7d750ef9f2960fa93fa1ced6f4fdcb3bbf877704cc21e72eec3
Instruction Fuzzy Hash: 9F61E5A6A1864185E720AF2AEC8076EA7B1FF847A8F601734DFAD03AD4DF3DD4548750

Function 00007FF704AAB014 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadBitmapW.USER32 ref: 00007FF704AAB02A
GetObjectW.GDI32 ref: 00007FF704AAB05B
DeleteObject.GDI32 ref: 00007FF704AAB095
DeleteObject.GDI32 ref: 00007FF704AAB0C5

Part of subcall function 00007FF704AA8624: FindResourceExW.KERNELBASE ref: 00007FF704AA863D
Part of subcall function 00007FF704AA8624: SizeofResource.KERNEL32 ref: 00007FF704AA8659
Part of subcall function 00007FF704AA8624: LoadResource.KERNEL32 ref: 00007FF704AA8673
Part of subcall function 00007FF704AA8624: LockResource.KERNEL32 ref: 00007FF704AA8685
Part of subcall function 00007FF704AA8624: GlobalAlloc.KERNELBASE ref: 00007FF704AA86A6
Part of subcall function 00007FF704AA8624: GlobalLock.KERNEL32 ref: 00007FF704AA86BB
Part of subcall function 00007FF704AA8624: CreateStreamOnHGlobal.COMBASE ref: 00007FF704AA86E8
Part of subcall function 00007FF704AA8624: GdipAlloc.GDIPLUS ref: 00007FF704AA86FE
Part of subcall function 00007FF704AA8624: GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 00007FF704AA8769
Part of subcall function 00007FF704AA8624: GlobalUnlock.KERNEL32 ref: 00007FF704AA878C
Part of subcall function 00007FF704AA8624: GlobalFree.KERNEL32 ref: 00007FF704AA8795

Strings

], xrefs: 00007FF704AAB063

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: Global$Resource$Object$AllocBitmapCreateDeleteGdipLoadLock$FindFreeFromSizeofStreamUnlock
String ID: ]
API String ID: 3561356813-3352871620
Opcode ID: 2f79d63664e457f963bfbd157e1c525b341384e02eb8e860e1f42d2dee528bbf
Instruction ID: 22ce4622ccfe49511a67223a770821506eebed06f328ade19dacf29cb9f41629
Opcode Fuzzy Hash: 2f79d63664e457f963bfbd157e1c525b341384e02eb8e860e1f42d2dee528bbf
Instruction Fuzzy Hash: 73119AA2B0D64246FA64FF139994B79D291AF88BC4FA80034DA1D07B95DF2DF8148660

Function 00007FF704AAAE1C Relevance: 7.5, APIs: 5, Instructions: 27
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32 ref: 00007FF704AAAE32
GetMessageW.USER32 ref: 00007FF704AAAE49
IsDialogMessageW.USER32 ref: 00007FF704AAAE60
TranslateMessage.USER32 ref: 00007FF704AAAE6F
DispatchMessageW.USER32 ref: 00007FF704AAAE7A

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 8f901ab8bb575df3ccfb48a5cb3294f091b017f84468599a2020223c8e70b7dc
Instruction ID: a5bf564dca4a4ab93b002a29a3b351c07d843b7215b32fb5a997c3b706e99200
Opcode Fuzzy Hash: 8f901ab8bb575df3ccfb48a5cb3294f091b017f84468599a2020223c8e70b7dc
Instruction Fuzzy Hash: 40F08C72A3855282FB60AF22ECD4E36A360BFE0709FD01431E60E81854CF3DD108CB14

Function 00007FF704AA91E8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32 ref: 00007FF704AA9211
SHAutoComplete.SHLWAPI ref: 00007FF704AA9255

Part of subcall function 00007FF704AA13C4: CompareStringW.KERNEL32 ref: 00007FF704AA13E3

FindWindowExW.USER32 ref: 00007FF704AA923F

Strings

EDIT, xrefs: 00007FF704AA921B, 00007FF704AA9233

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: 5198dd27efd6ef2cfe81d4e1a42d30dc263c523227a297f5f4c02164b2b5e029
Instruction ID: 917adad4b820a27f33130fb9f418a81549baa4e2c54f07094c692b42660f567f
Opcode Fuzzy Hash: 5198dd27efd6ef2cfe81d4e1a42d30dc263c523227a297f5f4c02164b2b5e029
Instruction Fuzzy Hash: C80162E2B19A4781FA60AF23EC94BF6A394BF98744FE40031C95D0A655DF2CE14DC660

Function 00007FF704A92CE0 Relevance: 6.1, APIs: 4, Instructions: 136
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(00007FF704A98C9A), ref: 00007FF704A92D22
WriteFile.KERNEL32 ref: 00007FF704A92D6C
WriteFile.KERNELBASE ref: 00007FF704A92D9A

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 0e24b38da4911ce84cd1995b05bc76a48cdbb6549566894b7731c3bd6f5b2069
Instruction ID: a7a7b73f7844e6e0482dd7757a6441b0065a3a5bd8757dae08c66ffd02557642
Opcode Fuzzy Hash: 0e24b38da4911ce84cd1995b05bc76a48cdbb6549566894b7731c3bd6f5b2069
Instruction Fuzzy Hash: 0851D6A3A1964252FA60EF26DCC4B7AA350FF44794FA40535EA0D07AD5DF7CE885C320

Function 00007FF704AB03E0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32 ref: 00007FF704AB0556
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AB05C1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AB05C7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AB05CD

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$TextWindow
String ID:
API String ID: 2912839123-0
Opcode ID: 1b20f76afdfd22dd2e77bc3aa1a8b97bb92d7033175fc9363e55deaf7abb2eb9
Instruction ID: 08f4d63d37cce496cec88ed589f27d8aa9cf999602d6f6f4da57f6a00a1348dc
Opcode Fuzzy Hash: 1b20f76afdfd22dd2e77bc3aa1a8b97bb92d7033175fc9363e55deaf7abb2eb9
Instruction Fuzzy Hash: 065183A2F1865184FB00AFA6DC857AD6322BF45794FE08636DA1C16BD6DF6CD440C360

Function 00007FF704AB2D6C Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF704AB2D7B

Part of subcall function 00007FF704AB27FC: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF704AB281E

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF704AB2D90
__scrt_release_startup_lock.LIBCMT ref: 00007FF704AB2DFE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF704AB2E51

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: f380b52e8f95e6a0f24ce785192d8cb773bc143ddf3d62aee805abe4fb8ed354
Instruction ID: c814730fdb65db4b93dd90359e04c20934c0a04b0f52e1cf266ef88c70fe7514
Opcode Fuzzy Hash: f380b52e8f95e6a0f24ce785192d8cb773bc143ddf3d62aee805abe4fb8ed354
Instruction Fuzzy Hash: 8A314DA2E0D10341FA64BF679CD9FBA9791AF45344FE4047AE90E0B2D3DF2CA44482B0

Function 00007FF704A93684 Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?,?,?,?,?,?,00000000,?,00007FF704A9309D), ref: 00007FF704A936CE
CreateDirectoryW.KERNEL32 ref: 00007FF704A93733
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,00007FF704A9309D), ref: 00007FF704A93791
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A937CE

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2359106489-0
Opcode ID: c692564d5d1c2d87129f870fd8c4aa882645ff23391cbc0b7309d447f995f5b9
Instruction ID: fdc7e08dc953e7734b81ad896fab18ea7ccabd8a7e5ff7a11a1da97265f1a9e8
Opcode Fuzzy Hash: c692564d5d1c2d87129f870fd8c4aa882645ff23391cbc0b7309d447f995f5b9
Instruction Fuzzy Hash: 8A3186E6A1C64241EE60FF269CC467AE361BF89790FA40231EE9D46795DF3CD8458720

Function 00007FF704A92320 Relevance: 6.1, APIs: 4, Instructions: 58fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(?,?,?,?,00000000,00007FF704A92927,?,00100000,?,00000001,00000000,00000000,?,00007FF704A914C1), ref: 00007FF704A92348
ReadFile.KERNELBASE ref: 00007FF704A92367
GetLastError.KERNEL32 ref: 00007FF704A9239B
GetLastError.KERNEL32 ref: 00007FF704A923BA

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 5dece825d5be91adec6864fa12bb564f4e3b5809c08bfde6ef0babe01e3581d0
Instruction ID: 85e9171a9971d095d806ae8d761f9c73f6bd3bd24fff80543d7552cd4e39c84d
Opcode Fuzzy Hash: 5dece825d5be91adec6864fa12bb564f4e3b5809c08bfde6ef0babe01e3581d0
Instruction Fuzzy Hash: A8217162A0854291EA60BF12AC80B7AF3A0BF85B94FB44974DA5D46784CF7CDC858772

Function 00007FF704A9E948 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF704A9ECD8: ResetEvent.KERNEL32 ref: 00007FF704A9ECF1
Part of subcall function 00007FF704A9ECD8: ReleaseSemaphore.KERNEL32 ref: 00007FF704A9ED07

ReleaseSemaphore.KERNEL32 ref: 00007FF704A9E974
CloseHandle.KERNELBASE ref: 00007FF704A9E993
DeleteCriticalSection.KERNEL32 ref: 00007FF704A9E9AA
CloseHandle.KERNEL32 ref: 00007FF704A9E9B7

Part of subcall function 00007FF704A9EA5C: WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,00007FF704A9E95F,?,?,?,00007FF704A9463A,?,?,?), ref: 00007FF704A9EA63
Part of subcall function 00007FF704A9EA5C: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF704A9E95F,?,?,?,00007FF704A9463A,?,?,?), ref: 00007FF704A9EA6E

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: CloseHandleReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 502429940-0
Opcode ID: 7c4c69b688bb09167c3d8ec6f4195a818a409db0987586a56ae23aa503e7e0cd
Instruction ID: 4af53a274b5e4bf1d98527a5637bf0e3d4ad02168e46fb1349af0330d50c31a1
Opcode Fuzzy Hash: 7c4c69b688bb09167c3d8ec6f4195a818a409db0987586a56ae23aa503e7e0cd
Instruction Fuzzy Hash: 7A016D72A14A91A2E298FF22ED84A6DE360FF84B81F500035DB5D03665CF39E4B48750

Function 00007FF704A9EAA4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 00007FF704A9EAE0
SetThreadPriority.KERNEL32 ref: 00007FF704A9EB36

Strings

CreateThread failed, xrefs: 00007FF704A9EAEE

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: Thread$CreatePriority
String ID: CreateThread failed
API String ID: 2610526550-3849766595
Opcode ID: cf4f3858e1c5421656891f758a667cd72a6f2059ba57d4f8d940dbc9b5e0f540
Instruction ID: ab40447c341d5c3d41c69b4003129073c428f8348b73e88de5739400febc669a
Opcode Fuzzy Hash: cf4f3858e1c5421656891f758a667cd72a6f2059ba57d4f8d940dbc9b5e0f540
Instruction Fuzzy Hash: 3D1182B1A09A4281E710FF12ECC19AAF360FF94784FE48135E64D02669EF7CE946C764

Function 00007FF704AA946C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26comCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF704A9DFD0: GetSystemDirectoryW.KERNEL32 ref: 00007FF704A9DDDF

OleInitialize.OLE32 ref: 00007FF704AA9486
SHGetMalloc.SHELL32 ref: 00007FF704AA94D4

Strings

riched20.dll, xrefs: 00007FF704AA9475

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: DirectoryInitializeMallocSystem
String ID: riched20.dll
API String ID: 174490985-3360196438
Opcode ID: 0d85db053d286d1bd0fa19ead2840fc3f5149c6ee0f027e6ed6c33eb2c824e37
Instruction ID: f911c8a12a00202dd9b2125ba3ce9390de32f430c4feacc62c692eaeb3de3747
Opcode Fuzzy Hash: 0d85db053d286d1bd0fa19ead2840fc3f5149c6ee0f027e6ed6c33eb2c824e37
Instruction Fuzzy Hash: 35F0AFB1618A4182EB00AF62FC84AAAF3A0FF88358F900131E99D42B54DF7CD588CB10

Function 00007FF704AA095C Relevance: 4.7, APIs: 3, Instructions: 152windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF704AA853C: GlobalMemoryStatusEx.KERNEL32 ref: 00007FF704AA856C

Part of subcall function 00007FF704A9AAE0: LoadStringW.USER32 ref: 00007FF704A9AB67
Part of subcall function 00007FF704A9AAE0: LoadStringW.USER32 ref: 00007FF704A9AB80

Part of subcall function 00007FF704A81FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A81FFB

Part of subcall function 00007FF704A8129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF704A81396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AB01BB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AB01C1
SendDlgItemMessageW.USER32 ref: 00007FF704AB01F2

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$LoadString$Concurrency::cancel_current_taskGlobalItemMemoryMessageSendStatus
String ID:
API String ID: 3106221260-0
Opcode ID: 0ba9d7466e2ed286356a428e3ab9ecfacbc224ee868a2430a0277f0c3a9d5fdb
Instruction ID: 50ef8f4b566b58eb3b22ba99dda068aaca66104aaf7c3660fb8ae51bdd37ebad
Opcode Fuzzy Hash: 0ba9d7466e2ed286356a428e3ab9ecfacbc224ee868a2430a0277f0c3a9d5fdb
Instruction Fuzzy Hash: 3051B3A2F0564246FB10BFA2DC856FDA362AF85788FA00236DA1D577D6DF2CD501C3A0

Function 00007FF704A81744 Relevance: 4.6, APIs: 3, Instructions: 118COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A8189C
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF704A818A8
__std_exception_copy.LIBVCRUNTIME ref: 00007FF704A818D4

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: Concurrency::cancel_current_task__std_exception_copy_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2371198981-0
Opcode ID: b58c3ba223658e9cb1a3b6c82220b5fab691779d7047793570d88e2901c0ef41
Instruction ID: e58db104d14db0a811ab0690044f69414fd54d8d922b45a4769363c7511d1e95
Opcode Fuzzy Hash: b58c3ba223658e9cb1a3b6c82220b5fab691779d7047793570d88e2901c0ef41
Instruction Fuzzy Hash: 7341F5B1B0864985EA04EF13E984A79E355EF04BE0FA44639DE6C07BD5EF7CE0928314

Function 00007FF704A92134 Relevance: 4.6, APIs: 3, Instructions: 114fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 00007FF704A921CF
CreateFileW.KERNEL32 ref: 00007FF704A9223C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A922D8

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: CreateFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2272807158-0
Opcode ID: c0a24921bb432fc979f0151b166e22e2d4d2ab91ccee52ff8beeeb5fa3cca71f
Instruction ID: 6bcc2f24523baf7a4f8ea6528bb757c568a0883fb35870e32beca4391602f57f
Opcode Fuzzy Hash: c0a24921bb432fc979f0151b166e22e2d4d2ab91ccee52ff8beeeb5fa3cca71f
Instruction Fuzzy Hash: 1C41C5B360478192EB14AF16EC84B69A3A0FF847B4F604B35DBAD07AD5CF3CD8908610

Function 00007FF704A823F8 Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32 ref: 00007FF704A8243E
GetWindowTextW.USER32 ref: 00007FF704A82476
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A82505

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: TextWindow$Length_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2176759853-0
Opcode ID: 41410b057bf1bfc832f9111b5635005432e9644e209f963b7c0d07f0c95fee55
Instruction ID: 95da0aa8491356022e9b2bb854f47c763717c9a3c121d78e18528540645f2342
Opcode Fuzzy Hash: 41410b057bf1bfc832f9111b5635005432e9644e209f963b7c0d07f0c95fee55
Instruction Fuzzy Hash: 1D21A4B3A18B8181EA10AF66A88057AB364FF89BD0F644235EBDD03B95DF3CD141C740

Function 00007FF704AA1F94 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF704AA205B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF704AA2077
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF704AA2093

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: std::bad_alloc::bad_alloc
String ID:
API String ID: 1875163511-0
Opcode ID: 5d5f35b7d0b1a8ec44982466ed86c266d3277025963138b758b7e20b27780546
Instruction ID: f9c96fa8b546b0a801cec22c94e30e37d09fc3079b509e17b9affee593e42f27
Opcode Fuzzy Hash: 5d5f35b7d0b1a8ec44982466ed86c266d3277025963138b758b7e20b27780546
Instruction Fuzzy Hash: C83196A3A0C68651FB24BF16EC847B9E3A0FF54B84FA44431D24C06AAADF7CD965C351

Function 00007FF704A93D34 Relevance: 4.6, APIs: 3, Instructions: 62COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,?,?,?,?,?,00000000,00000001,?,00007FF704AA07E1), ref: 00007FF704A93D5E
SetFileAttributesW.KERNEL32 ref: 00007FF704A93DB0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A93E1A

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: AttributesFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1203560049-0
Opcode ID: a1f7dc1dbaba3642fc9690cddce522cfa30acb7a6fd15afbd6a0ae69969149b0
Instruction ID: 15cd0bdf8dd5ceaa76833aff25c9f6ce7b901a4636ede6e4f3dba143c0f2b72b
Opcode Fuzzy Hash: a1f7dc1dbaba3642fc9690cddce522cfa30acb7a6fd15afbd6a0ae69969149b0
Instruction Fuzzy Hash: 6321D862A1868141FE20AF26ECD566DA360FF88794FA44230EE9D47695DF2CD540C710

Function 00007FF704A931BC Relevance: 4.6, APIs: 3, Instructions: 59fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,?,?,?,?,?,?,00000000,00007FF704AA0822), ref: 00007FF704A931E7
DeleteFileW.KERNEL32 ref: 00007FF704A93237
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A932A1

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: DeleteFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3118131910-0
Opcode ID: 69d2c27007a20e930861445e234d5951a1cf09c7b93575dd70fe51422861bc3e
Instruction ID: 2d50d5c4f7703cbd5e01547ac2e4dacedb69c3b4b983d11b5c184cdbe24fe70b
Opcode Fuzzy Hash: 69d2c27007a20e930861445e234d5951a1cf09c7b93575dd70fe51422861bc3e
Instruction Fuzzy Hash: 3A21CDA2A1878181EE10AF26FC8466EA370FF98B94FA01235EE9E47795DF3CD540C750

Function 00007FF704A932BC Relevance: 4.6, APIs: 3, Instructions: 57COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,?,00007FF704A9E5B1,?,?,?,00000000,?), ref: 00007FF704A932E7
GetFileAttributesW.KERNELBASE ref: 00007FF704A93334
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A93399

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: AttributesFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1203560049-0
Opcode ID: 07782a0afab47d92a22bff3076416a7edfcd43da74ab10a948eda14518e6746e
Instruction ID: 6bab4e027af26489a6f6583c3e0b3a2c3da1dce18ffd463bb27df626ded83ee4
Opcode Fuzzy Hash: 07782a0afab47d92a22bff3076416a7edfcd43da74ab10a948eda14518e6746e
Instruction Fuzzy Hash: C32177A2A1878181EE10AF2AEC8456AA371FFC97A4FA00231EA9D47BD5DF3CD540C750

Function 00007FF704ABBF64 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF704ABBF48), ref: 00007FF704ABBF8C
TerminateProcess.KERNEL32(?,?,?,00007FF704ABBF48), ref: 00007FF704ABBF97
ExitProcess.KERNEL32 ref: 00007FF704ABBFA6

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 44b3a526fe0d15710854bc957cc7a82f9edee4cc7420f0560de4bec5ea2a17a0
Instruction ID: e6a884f0cc1fa280dd3fa0686eb8159aa323966d80fe7ac5824e3720f1f47d91
Opcode Fuzzy Hash: 44b3a526fe0d15710854bc957cc7a82f9edee4cc7420f0560de4bec5ea2a17a0
Instruction Fuzzy Hash: 9EE01AA4A043058AEAA47F329CD5B79A3526F88B42F60543CD84A02397CF3DE40986B0

Function 00007FF704A8F578 Relevance: 3.2, APIs: 2, Instructions: 193COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A8F895
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A8F89B

Part of subcall function 00007FF704A93EC8: FindClose.KERNELBASE(?,?,00000000,00007FF704AA0811), ref: 00007FF704A93EFD

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseFind
String ID:
API String ID: 3587649625-0
Opcode ID: ff05a0ad3b9c4f4235e1478b2c69edca0b6840efc482a2fd304b53339564797e
Instruction ID: 44ef4e9f33fe97da83371949a8e7060e0d185799e10245bfface205589c9fc88
Opcode Fuzzy Hash: ff05a0ad3b9c4f4235e1478b2c69edca0b6840efc482a2fd304b53339564797e
Instruction Fuzzy Hash: F591B3B3B1868294EB10EF26DC846ADA361FF84798FE04139EA4C07AD9DF78D545C350

Function 00007FF704A83904 Relevance: 3.1, APIs: 2, Instructions: 124COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A83AB3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A83AB9

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: e528197958c249f96fae0a8177de4e8d77b9f71d72b6948629aa37281091aefa
Instruction ID: 0b1d3a3851047db3b14a73672b25c6e18cf72a9f8fa714190a308f528187a733
Opcode Fuzzy Hash: e528197958c249f96fae0a8177de4e8d77b9f71d72b6948629aa37281091aefa
Instruction Fuzzy Hash: 2441B3A2F1565184FF00EFB2D890AFDA320EF44B98FA45139DE1D27ADADF7994428350

Function 00007FF704A815B8 Relevance: 3.1, APIs: 2, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A81731
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF704A8173D

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: b9a010b26f48187301c14e27f7b591ab3f639a50221d778f31cdfa0ab4da68dc
Instruction ID: ac0bc4819ead6d46947810b1b79122777fae2bef49970ebfbf3df5d1e960a351
Opcode Fuzzy Hash: b9a010b26f48187301c14e27f7b591ab3f639a50221d778f31cdfa0ab4da68dc
Instruction Fuzzy Hash: 9141B2B2B0464691EE10AF17A984ABAE351EF04BE0FE80635DE6D47BD6DF7CD4428350

Function 00007FF704A92778 Relevance: 3.1, APIs: 2, Instructions: 100COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000002,?,00000F99,?,00007FF704A9274D), ref: 00007FF704A928A9
GetLastError.KERNEL32(?,00007FF704A9274D), ref: 00007FF704A928B8

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 043a82e8aff847b2e282b78885e55c7214a93c585b530bdf19c19deffc600893
Instruction ID: 13c92782b5c965fcaf5acfb71033240d81138244229b9eef3561d82da7f8c4cc
Opcode Fuzzy Hash: 043a82e8aff847b2e282b78885e55c7214a93c585b530bdf19c19deffc600893
Instruction Fuzzy Hash: E431D4A3B19A5692EE606F2BDDC0BB8A350AF04BD4FA44571DE1D17790DF3CE8418360

Function 00007FF704A822BC Relevance: 3.1, APIs: 2, Instructions: 83COMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF704A822F1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A823F0

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: Item_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1746051919-0
Opcode ID: 8d40ccc84b580f33f3dafee36447434fcdf79cb76bf08fc935a239d44bb79c76
Instruction ID: 5e90b9e092228152830701994eba104bd6edb71b66ea9d5b5b2081198d11ea3a
Opcode Fuzzy Hash: 8d40ccc84b580f33f3dafee36447434fcdf79cb76bf08fc935a239d44bb79c76
Instruction Fuzzy Hash: 6431A3B2A1874541EA20AF16E8957BAF360EF84790FA44235EA9C07B96DF3CE5408754

Function 00007FF704A92AD0 Relevance: 3.1, APIs: 2, Instructions: 76timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32 ref: 00007FF704A92AFE
SetFileTime.KERNELBASE ref: 00007FF704A92B9B

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 1f7bfd0f82637a6abdcd08aef8b442a865f6f50d97ba3a1fa7ef62b0e093425a
Instruction ID: 9ab49e86672db79a2ba828c2c947d3741ac51ebca2609d45512dbcc1f4f11e5e
Opcode Fuzzy Hash: 1f7bfd0f82637a6abdcd08aef8b442a865f6f50d97ba3a1fa7ef62b0e093425a
Instruction Fuzzy Hash: 6C21B5A3E09B42A1EA61AE13DC84BB697D0AF11795FA54471DE4C06295EF3CDD46C220

Function 00007FF704A9AAE0 Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF704A9AB67
LoadStringW.USER32 ref: 00007FF704A9AB80

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: efc1550bd5bba1d5ac9face2304fa075ed5e4cb94ffc19493764f318ca00d951
Instruction ID: 73664433f9bae8a533d3e1d935252f1f51762b565a67817740addba5ca0654f5
Opcode Fuzzy Hash: efc1550bd5bba1d5ac9face2304fa075ed5e4cb94ffc19493764f318ca00d951
Instruction Fuzzy Hash: 5E118EF0B0865186EA00AF1BAC80829F7A1BF98FC4FE44435CA2D93721DF7CE9418358

Function 00007FF704A92BB0 Relevance: 3.0, APIs: 2, Instructions: 47COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE ref: 00007FF704A92C11
GetLastError.KERNEL32 ref: 00007FF704A92C1E

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 5eda2cbf1ce6837a88d649c872729f31e823bc49095d59e5e9b193bf7b9166cd
Instruction ID: 582f122aa6ecec3960c297aabfa5d9ee97a49667d4c66bd89ae9c7cdec201e8f
Opcode Fuzzy Hash: 5eda2cbf1ce6837a88d649c872729f31e823bc49095d59e5e9b193bf7b9166cd
Instruction Fuzzy Hash: 79119366A0864291FB60AF26ECC0A69A260FF447A4FA40731DA7D122D5CF3CD982C310

Function 00007FF704A8255C Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF704A9A4AC: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF704A9A504
Part of subcall function 00007FF704A9A4AC: SetDlgItemTextW.USER32 ref: 00007FF704A9A573
Part of subcall function 00007FF704A9A4AC: GetWindowRect.USER32 ref: 00007FF704A9A5AD
Part of subcall function 00007FF704A9A4AC: GetClientRect.USER32 ref: 00007FF704A9A5BB

GetDlgItem.USER32 ref: 00007FF704A825AC
SetWindowTextW.USER32 ref: 00007FF704A825C8

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: ItemRectTextWindow$Clientswprintf
String ID:
API String ID: 3322643685-0
Opcode ID: ad94589889145b650e3461eb84003e845283bd92425fc2a9221c8100a4e27e71
Instruction ID: 512c13b8aa7d344b89d04723f485bf630ac760f5f0316acf71dd58e51d14034f
Opcode Fuzzy Hash: ad94589889145b650e3461eb84003e845283bd92425fc2a9221c8100a4e27e71
Instruction Fuzzy Hash: 9A01B9A1A0D24641FF597F53ACD4B79D7519F89744FA40079C91D062DADF2CE884C320

Function 00007FF704A9EB58 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,00007FF704A9EBAD,?,?,?,?,00007FF704A95752,?,?,?,00007FF704A956DE), ref: 00007FF704A9EB5C
GetProcessAffinityMask.KERNEL32 ref: 00007FF704A9EB6F

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 444071b75e142e51b736d9fa504759652bc9944b894df1f8101a797a07211085
Instruction ID: ba82e66fff0fcb5bbeac2d09bb2c1334b8333557202cd8b0df7d7e2920449dce
Opcode Fuzzy Hash: 444071b75e142e51b736d9fa504759652bc9944b894df1f8101a797a07211085
Instruction Fuzzy Hash: 73E0E5A1B1458646DB58AF56CC809AAA392BF88B40FD48035D60B83614DF2CE5458B10

Function 00007FF704AB21D0 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF704AB2200

Part of subcall function 00007FF704AB2F7C: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF704AB2F85

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF704AB2206

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: c507040392a2377e4895e65205c3b95c5fe2146e3485fc393c80d7c2ffdcaf26
Instruction ID: 8f3667cf2d8455e1a55e9efb34299a211a19aa41d73d7dbe40844669dfadaf55
Opcode Fuzzy Hash: c507040392a2377e4895e65205c3b95c5fe2146e3485fc393c80d7c2ffdcaf26
Instruction Fuzzy Hash: 5AE0ECD2E0B10745FD183AB72CA9AB580404F29370EF85B71DA3E086D7AF1CA5A281B0

Function 00007FF704ABD90C Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL ref: 00007FF704ABD922
GetLastError.KERNEL32 ref: 00007FF704ABD934

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 7829e02dcbd74b51c5e196648e5aad52518f68633834b7095f7e5950a32ae739
Instruction ID: 8c3ba6bcda04f2b8ec42b0d3c30b5e66e7d7d8809b3c8c6dc2f2d3b6a83453e4
Opcode Fuzzy Hash: 7829e02dcbd74b51c5e196648e5aad52518f68633834b7095f7e5950a32ae739
Instruction Fuzzy Hash: 37E08CE0E0960342FF28BFB39CD59B8A2906F98B51FA44034C90D86353EF3CA48586B0

Function 00007FF704A833E4 Relevance: 1.8, APIs: 1, Instructions: 328COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A8388C

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 33f84bb692d5293623e3afab48e0196588e748b5593b514a14a7011791a52734
Instruction ID: 8e766cea844c2381792ba6f6efefcad20e235889dcc3d9f4f700b733d84e09c9
Opcode Fuzzy Hash: 33f84bb692d5293623e3afab48e0196588e748b5593b514a14a7011791a52734
Instruction Fuzzy Hash: 1CD185E2B0868555EF68AF2799806B9B7A1FF05F84FA40039CE5D077A5CF39E4618720

Function 00007FF704A95294 Relevance: 1.7, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A9551B

Part of subcall function 00007FF704AA13F4: CompareStringW.KERNEL32 ref: 00007FF704AA145A

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: CompareString_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1017591355-0
Opcode ID: d592eabcbe9af83a373b8b16b8cc449c2e49e9c4d9704c8b20a1f27e4dd7bd8a
Instruction ID: a3edb805c59d5513232335b462bdc31eb7296a724567edb17ee4093771a1c468
Opcode Fuzzy Hash: d592eabcbe9af83a373b8b16b8cc449c2e49e9c4d9704c8b20a1f27e4dd7bd8a
Instruction Fuzzy Hash: 0D61D692E0C65791F9A6BE175C969BAD3919F807D0FF44131DE4D06AC5EF6CEC404230

Function 00007FF704AA1870 Relevance: 1.7, APIs: 1, Instructions: 172COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF704A9E948: ReleaseSemaphore.KERNEL32 ref: 00007FF704A9E974
Part of subcall function 00007FF704A9E948: CloseHandle.KERNELBASE ref: 00007FF704A9E993
Part of subcall function 00007FF704A9E948: DeleteCriticalSection.KERNEL32 ref: 00007FF704A9E9AA
Part of subcall function 00007FF704A9E948: CloseHandle.KERNEL32 ref: 00007FF704A9E9B7

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AA1ACB

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: CloseHandle$CriticalDeleteReleaseSectionSemaphore_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 904680172-0
Opcode ID: 385a02acb57b8c59120be0c34ea2f347caf4614f8b231966af7ef80d9636563d
Instruction ID: 9124dc4b92688e144841e72eb6f7c5edcb119f51584b0b22b91245989fdce402
Opcode Fuzzy Hash: 385a02acb57b8c59120be0c34ea2f347caf4614f8b231966af7ef80d9636563d
Instruction Fuzzy Hash: 0161C2B3715685A1EE08EF66D9945BCB364FF40B90FA44632D72D0BAC6CF28E4718390

Function 00007FF704A8EC9C Relevance: 1.6, APIs: 1, Instructions: 145COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A8EEB8

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: af1c5978b98fda9a8b2c18bb3354693c366be56127f8703ff8eb31aec807914d
Instruction ID: da3ca1861a10d016078ff7da41801f35a512845002346d92bb8cbffb705e8809
Opcode Fuzzy Hash: af1c5978b98fda9a8b2c18bb3354693c366be56127f8703ff8eb31aec807914d
Instruction Fuzzy Hash: 185196E2A0864290EA14BF179C84BAAA751FF85BC4FA4013ADE5D47396DF3DE485C360

Function 00007FF704A8E7A8 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF704A93EC8: FindClose.KERNELBASE(?,?,00000000,00007FF704AA0811), ref: 00007FF704A93EFD

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A8E993

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: CloseFind_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1011579015-0
Opcode ID: 1ed87b38f53b3cf50e1c2200cac218cce737f4e527dde5fbd83d50be022e59e1
Instruction ID: 0d7b9b2d9a38e35f21ee62dc3637bb19940319d983d0cc5a87e052960d0f885c
Opcode Fuzzy Hash: 1ed87b38f53b3cf50e1c2200cac218cce737f4e527dde5fbd83d50be022e59e1
Instruction Fuzzy Hash: 785185A2A0868681FF60AF26D8C577EB351FF84B84FA4013ADA9D477A5DF2CD441C320

Function 00007FF704A91794 Relevance: 1.6, APIs: 1, Instructions: 115COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A9187D

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 21d3448974cb6f656698ab284dce21aa375e6d8eca53aed82b2546dc5fa40d58
Instruction ID: b49d418c33d212229315acdf7811880818bac180be5b55cdce505ab546efe5df
Opcode Fuzzy Hash: 21d3448974cb6f656698ab284dce21aa375e6d8eca53aed82b2546dc5fa40d58
Instruction Fuzzy Hash: 0C41C6B2B1869241FA14AE17AE84779E251EF44FC0F948536EE4C47F5ADF7CD8518340

Function 00007FF704A92F58 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A930C8

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 56fb8cc9aabd16c687145b8809587fd2b26f3257f780f8e7ed96006f2e57f286
Instruction ID: f983f88b1bc1d8031a9f06e1617ca75c4bda1a997989cd473bad80509dc5d92c
Opcode Fuzzy Hash: 56fb8cc9aabd16c687145b8809587fd2b26f3257f780f8e7ed96006f2e57f286
Instruction Fuzzy Hash: DE41D7A2A1870180FE14AF16ED85779A361EF89BD8FA41135EE4D077D9DF3DE8408760

Function 00007FF704ABBDF8 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF704ABBE20

Part of subcall function 00007FF704ABBFB0: GetModuleHandleExW.KERNEL32 ref: 00007FF704ABBFD0
Part of subcall function 00007FF704ABBFB0: GetProcAddress.KERNEL32 ref: 00007FF704ABBFE6
Part of subcall function 00007FF704ABBFB0: FreeLibrary.KERNEL32 ref: 00007FF704ABC00B

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 5b4d6432c9ab27f48bf344f41163fa66ca8822e5b5ed34cf2c0174bd429b5c6d
Instruction ID: 05fc0877af76b4dc5987690b52135438144703347dc6c966667b45dee345f078
Opcode Fuzzy Hash: 5b4d6432c9ab27f48bf344f41163fa66ca8822e5b5ed34cf2c0174bd429b5c6d
Instruction Fuzzy Hash: BD41B7A1A1861282FA64BF179CD09789251BF54B44FE4443ADA0E47AE2DF3DF840C7B0

Function 00007FF704A8129C Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF704A81396

Part of subcall function 00007FF704A81F80: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF704A81F89

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: Concurrency::cancel_current_taskstd::bad_alloc::bad_alloc
String ID:
API String ID: 680105476-0
Opcode ID: 5f70ec598a32dba177b48fd583f3b862a0aa537e2dc8d8b66d599bca5bf88280
Instruction ID: 39b1ca26cc18d076bb09aa7e5b04df017ae39c84c5b735caf15f7aacfdcacd62
Opcode Fuzzy Hash: 5f70ec598a32dba177b48fd583f3b862a0aa537e2dc8d8b66d599bca5bf88280
Instruction Fuzzy Hash: EC21A3B2A0825185EA14AF53A8806B9A250FF05BF0FB80B35DE7D0BBC1DF7CE4528350

Function 00007FF704AC124C Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF704AC1280

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 9dd5a9e84c18447e56e2265fa04046f11d37b96b7f5b774ce3305aa6458b3f00
Instruction ID: 971d37bdfcdeda511514bbbf1fd65ca079908a7efec549f2f046a2445582c39d
Opcode Fuzzy Hash: 9dd5a9e84c18447e56e2265fa04046f11d37b96b7f5b774ce3305aa6458b3f00
Instruction Fuzzy Hash: 90113DB6A1C74286F660AF529CC0979A294FF40384FE40535E69D9B797DF2CE4008B64

Function 00007FF704A83AD8 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A83B6C

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 58579bce4bc1021bb98a03ef504395245509186ce5efb4717343b6b5f18682a3
Instruction ID: bce022d043195fcd5cc00deeb7cc4771f1fd7204daa67a88c0de1e4188ebb860
Opcode Fuzzy Hash: 58579bce4bc1021bb98a03ef504395245509186ce5efb4717343b6b5f18682a3
Instruction Fuzzy Hash: CF0108E2E1878541EE11BF26E885669B361FFC4B90FE04235EA9C077A5DF2DD0408714

Function 00007FF704AB1558 Relevance: 1.5, APIs: 1, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF704AB1604: GetModuleHandleW.KERNEL32(?,?,?,00007FF704AB1573,?,?,?,00007FF704AB192A), ref: 00007FF704AB162B

DloadProtectSection.DELAYIMP ref: 00007FF704AB15C9

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: DloadHandleModuleProtectSection
String ID:
API String ID: 2883838935-0
Opcode ID: 908f49ac33541a8240f4269ada82e733cc5c0c647bda27ab8868a2cee9a60ef3
Instruction ID: 3de082c5ab1b75a33eee09092712fd221aadbcc1dcc9bb96f46cb263559da01e
Opcode Fuzzy Hash: 908f49ac33541a8240f4269ada82e733cc5c0c647bda27ab8868a2cee9a60ef3
Instruction Fuzzy Hash: 1911ACF0D4860681FB60BF07ACD5B709350AF1C789FB44538C91E472A2EF3CA89586B4

Function 00007FF704A93EC8 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF704A940BC: FindFirstFileW.KERNELBASE ref: 00007FF704A9410B
Part of subcall function 00007FF704A940BC: FindFirstFileW.KERNELBASE ref: 00007FF704A9415E
Part of subcall function 00007FF704A940BC: GetLastError.KERNEL32 ref: 00007FF704A941AF

FindClose.KERNELBASE(?,?,00000000,00007FF704AA0811), ref: 00007FF704A93EFD

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: 18fe74ab7ca813274cb64c08179860cc48efc587ad39327f0b25563dc18ddab5
Instruction ID: 281fc39f79acdf5b576f1bbf8bee2965d9e71cb310b546d87dd22026e32caf22
Opcode Fuzzy Hash: 18fe74ab7ca813274cb64c08179860cc48efc587ad39327f0b25563dc18ddab5
Instruction Fuzzy Hash: 6FF081A250824185EE50BF76AD805B977709F19BB4F645339EE3D0B2CBCF28D8448764

Function 00007FF704A81FA0 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A81FFB

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 6331896312cb8e4c1d169fe77c3e8d30130163df7be40750d77952921d5cf396
Instruction ID: 5fcd8d8fa694c79847ae8a019a25ce3f87d6a9a2669d4fda6eeac9f37e576a4e
Opcode Fuzzy Hash: 6331896312cb8e4c1d169fe77c3e8d30130163df7be40750d77952921d5cf396
Instruction Fuzzy Hash: 72F054F171068980EE18AF6AD48876C5362EF44B88FA44436D74C4B656DF6DD891C354

Function 00007FF704A9273C Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE ref: 00007FF704A92755

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: 182d9e1e92039184aab4081fafd09b1cf385b4bd914a3c272b872952a66d9790
Instruction ID: a2de57f62274278270e237bdfd7a40809ed5585e14ec533f1cadbd0b8400eaf8
Opcode Fuzzy Hash: 182d9e1e92039184aab4081fafd09b1cf385b4bd914a3c272b872952a66d9790
Instruction Fuzzy Hash: D5E08C92A2052582EF60BF2BCC82A689320AF8CB85B981070CE0D07321CF2CC8818A60

Function 00007FF704A92490 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 00007FF704A924A2

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: df9a28314c6b6fddfb177ebf539387614dcb0363737e1ba4f38fe55c4f903e1a
Instruction ID: 5c3d30437defa6f77ac7aa2463317111e3c86623ef8c44143c553eb6470f8552
Opcode Fuzzy Hash: df9a28314c6b6fddfb177ebf539387614dcb0363737e1ba4f38fe55c4f903e1a
Instruction Fuzzy Hash: 40D0C95290945192E950AA369C9153C6250AF92736FF40B70D63E816E1CB1D9896A321

Function 00007FF704A97FC4 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE ref: 00007FF704A97FD2

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 176ab68ebee512dad0278907058cd855c5c44f8615b79807412a7d406b36e525
Instruction ID: d8fd425f61a813e65dcb9df44a3d695453ac9c7213dee966f1cfa6147f64a520
Opcode Fuzzy Hash: 176ab68ebee512dad0278907058cd855c5c44f8615b79807412a7d406b36e525
Instruction Fuzzy Hash: F1C08C20F15502C1EE08BF27CCC941813A4BF40B05FB04038C10C81260CF2CC8EAD365

Function 00007FF704ABFA04 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF704ABFA59

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: c4d23aaef5024e3722ccbb242168b3e22d65bf63548bcaacbbf61b8d0a3ba7a1
Instruction ID: 1afec6f72eff4c8c902313c2ef85cc74de8d7b173d6520f45cbba7b1f5f6e583
Opcode Fuzzy Hash: c4d23aaef5024e3722ccbb242168b3e22d65bf63548bcaacbbf61b8d0a3ba7a1
Instruction Fuzzy Hash: 09F049D4B0930749FE587E639D91AB5D2805F59B80FEC5438D90E8B3C3EF2CA68142B0

Function 00007FF704A920D0 Relevance: 1.3, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,00000001,00007FF704A9207E), ref: 00007FF704A920F6

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: ccbd9008d2c4ce7168f8d058ff2f34620ae6bf54bfe45a0cbca9d6a6f1a7c065
Instruction ID: 372222b7a1fdf13f4e52b0f6d097adfa2f46671d7e2124beefac14efab66e33d
Opcode Fuzzy Hash: ccbd9008d2c4ce7168f8d058ff2f34620ae6bf54bfe45a0cbca9d6a6f1a7c065
Instruction Fuzzy Hash: A8F0A972A4954255FB249F62DC81779A660EF14B78FB84374D73D011D4CF28D8A58320

Function 00007FF704ABD94C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF704ABD98A

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 5fa632deebd8181b9f3ea37834cf4eccbda839d7d0d6f948310c23224b4a93e7
Instruction ID: 1c048b9847be521e50638bfb3843fe563abffe693d788999f4417a7fd03f95a9
Opcode Fuzzy Hash: 5fa632deebd8181b9f3ea37834cf4eccbda839d7d0d6f948310c23224b4a93e7
Instruction Fuzzy Hash: 27F058D0B0924745FF647EB35DD1EB592905F847A0FE81630D92E86AC3DF2CA48082B0

Non-executed Functions

Function 00007FF704A8C2F0 Relevance: 49.8, APIs: 24, Strings: 4, Instructions: 754fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF704A8DE04: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF704A8CF4B), ref: 00007FF704A8DE27
Part of subcall function 00007FF704A8DE04: GetLastError.KERNEL32 ref: 00007FF704A8DE88
Part of subcall function 00007FF704A8DE04: CloseHandle.KERNEL32 ref: 00007FF704A8DE9B

wcscpy.LIBCMT ref: 00007FF704A8CBC8
wcscpy.LIBCMT ref: 00007FF704A8CBFE
CreateFileW.KERNEL32 ref: 00007FF704A8CC38
DeviceIoControl.KERNEL32 ref: 00007FF704A8CD01
CloseHandle.KERNEL32 ref: 00007FF704A8CD12
GetLastError.KERNEL32 ref: 00007FF704A8CD2E
RemoveDirectoryW.KERNEL32 ref: 00007FF704A8CD7D
DeleteFileW.KERNEL32 ref: 00007FF704A8CD88
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A8CE89
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A8CE8F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A8CE9B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A8CEA1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A8CEAD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A8CEB3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A8CEB9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A8CEBF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A8CEC5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A8CECB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A8CED1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A8CED7

Strings

UNC\, xrefs: 00007FF704A8C53F, 00007FF704A8C55D
SeCreateSymbolicLinkPrivilege, xrefs: 00007FF704A8C34F
\??\, xrefs: 00007FF704A8C392, 00007FF704A8C3B8
SeRestorePrivilege, xrefs: 00007FF704A8C343

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseErrorFileHandleLastwcscpy$ControlCreateCurrentDeleteDeviceDirectoryProcessRemove
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 2659423929-3508440684
Opcode ID: 5e44b816d37aa15c8bc93fb647ff289bd59fc38e1ab6cc2ff94f4b8665b3db8a
Instruction ID: 77bc554b1a3f2b6231ec710cd0d6ee6efb9d50ee8bb080869c8317994963e7ee
Opcode Fuzzy Hash: 5e44b816d37aa15c8bc93fb647ff289bd59fc38e1ab6cc2ff94f4b8665b3db8a
Instruction Fuzzy Hash: 7762C6A2F0864285FB00AF76DC84ABDA361EF857A4FA04235DA6C576D6DF3CD545C320

Function 00007FF704A9F180 Relevance: 43.2, APIs: 22, Strings: 2, Instructions: 1205COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF704AA0528

Part of subcall function 00007FF704A9AAE0: LoadStringW.USER32 ref: 00007FF704A9AB67
Part of subcall function 00007FF704A9AAE0: LoadStringW.USER32 ref: 00007FF704A9AB80

Part of subcall function 00007FF704AAB0DC: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF704AA0429), ref: 00007FF704AAB110
Part of subcall function 00007FF704AAB0DC: SetLastError.KERNEL32 ref: 00007FF704AAB153

Part of subcall function 00007FF704A8129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF704A81396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AA0490
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AA0496
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AA049C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AA04A2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AA04A8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AA04AE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AA04B4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AA04BA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AA04C0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AA04C6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AA04CC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AA04D2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AA04D8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AA04DE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AA04E4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AA04EA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AA04F0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AA04F6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AA0532
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AA0538

Strings

%s: %s, xrefs: 00007FF704A9FC11
%ls, xrefs: 00007FF704A9F3AC, 00007FF704A9F3FF

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ErrorLastLoadString$Concurrency::cancel_current_taskInit_thread_footer
String ID: %ls$%s: %s
API String ID: 2539828978-2259941744
Opcode ID: 6e6934fffba85a003559e3c9f5bf0afe7ce15bc57e9d0b94c360e8deda467df6
Instruction ID: 45d73ab409cb5fbc3e79ea87d9251879270e66886059126e2df17c8ceedf330c
Opcode Fuzzy Hash: 6e6934fffba85a003559e3c9f5bf0afe7ce15bc57e9d0b94c360e8deda467df6
Instruction Fuzzy Hash: 60B277A3A1868242EA10BF27DCD49BAE311FFD5790FA04236E69D47AD6EF6CD540C350

Function 00007FF704AC2550 Relevance: 22.3, APIs: 8, Strings: 4, Instructions: 1310COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF704AC2C12
memcpy_s.LIBCMT ref: 00007FF704AC35BF
memcpy_s.LIBCMT ref: 00007FF704AC3666

Part of subcall function 00007FF704AC38BC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF704AC38EE

memcpy_s.LIBCMT ref: 00007FF704AC372F

Part of subcall function 00007FF704ABD008: _invalid_parameter_noinfo.LIBCMT ref: 00007FF704ABD02D

Strings

1#QNAN, xrefs: 00007FF704AC37E8
1#IND, xrefs: 00007FF704AC37AA
1#INF, xrefs: 00007FF704AC3807
1#SNAN, xrefs: 00007FF704AC37C9

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: _invalid_parameter_noinfomemcpy_s
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 1759834784-2761157908
Opcode ID: c1568b5568d689d261f1f0b975b9c1104ab10acfc5286cd5346a40821ab4f9bc
Instruction ID: e62754c6433c9bc8dc855ea5454c16901b1f4a5d961a845bcd5a0d0549c4451a
Opcode Fuzzy Hash: c1568b5568d689d261f1f0b975b9c1104ab10acfc5286cd5346a40821ab4f9bc
Instruction Fuzzy Hash: 74B2DAB3E081828AEBB5AE66DC80BF9B791FF54788FA05135DE0957B84DF38E5048750

Function 00007FF704A91A48 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 375fileCOMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32 ref: 00007FF704A91A97
GetLongPathNameW.KERNEL32 ref: 00007FF704A91AE0
GetShortPathNameW.KERNEL32 ref: 00007FF704A91B21
GetShortPathNameW.KERNEL32 ref: 00007FF704A91B6A

Part of subcall function 00007FF704AA13C4: CompareStringW.KERNEL32 ref: 00007FF704AA13E3

MoveFileW.KERNEL32 ref: 00007FF704A91DFE
MoveFileW.KERNEL32 ref: 00007FF704A91E65

Part of subcall function 00007FF704A92134: CreateFileW.KERNEL32 ref: 00007FF704A9223C

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A91FE1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A91FE7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A91FED

Strings

rtmp, xrefs: 00007FF704A91CF4, 00007FF704A91D03

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: NamePath$File_invalid_parameter_noinfo_noreturn$LongMoveShort$CompareCreateString
String ID: rtmp
API String ID: 3587137053-870060881
Opcode ID: 1ffb243e08b8fb519680c97ae3cffafb4c96412676108627d27e6b4ac5b9e215
Instruction ID: 7618500a003a89d08a498384baafbddbe307007140b4331e6ef50fc94eb6b07b
Opcode Fuzzy Hash: 1ffb243e08b8fb519680c97ae3cffafb4c96412676108627d27e6b4ac5b9e215
Instruction Fuzzy Hash: B6F1B4B2B08A4291FA10EF66DCC05BDA761FF85784FA00136EA4D47AA9DF3CD985C750

Function 00007FF704A95B60 Relevance: 12.3, APIs: 8, Instructions: 256COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 00007FF704A95BC2
GetFullPathNameW.KERNEL32 ref: 00007FF704A95C0E
GetFullPathNameW.KERNEL32 ref: 00007FF704A95D2B
GetFullPathNameW.KERNEL32 ref: 00007FF704A95D70
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A95EE0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A95EE6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A95EEC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A95EF2

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: FullNamePath_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1693479884-0
Opcode ID: 1e7c5ac9d18d4859634b67c516166c1ae8f0dcc4e332a300e03a2fc1b19988e3
Instruction ID: 2b0eb5bb97d38c2b64c589775f5bc8156ae25db42d5effdaad03841eae38f90a
Opcode Fuzzy Hash: 1e7c5ac9d18d4859634b67c516166c1ae8f0dcc4e332a300e03a2fc1b19988e3
Instruction Fuzzy Hash: F4A1C6A3F14A5254FF11AF7B8C859BDA361AF44BA4BA44235DE2D17BC9DF3CE4418210

Function 00007FF704AB3170 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF704AB318C
RtlCaptureContext.KERNEL32 ref: 00007FF704AB31B9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF704AB31D3
RtlVirtualUnwind.KERNEL32 ref: 00007FF704AB3214
IsDebuggerPresent.KERNEL32 ref: 00007FF704AB3268
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF704AB3289
UnhandledExceptionFilter.KERNEL32 ref: 00007FF704AB3294

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: eb4060bcbbf6947450414bc0ac192b8da1feec02df413969c5a674799d26ef14
Instruction ID: b685df9740c917e7a4a0a2a1fa84b6eee5d7715ff0771df3e92cc385f49f5a71
Opcode Fuzzy Hash: eb4060bcbbf6947450414bc0ac192b8da1feec02df413969c5a674799d26ef14
Instruction Fuzzy Hash: B0315CB2609B818AEB60AF61EC907EDB364FB84744F94503ADA4D47B89DF3CD548C760

Function 00007FF704AB76D8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF704AB7751
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF704AB7769
RtlVirtualUnwind.KERNEL32 ref: 00007FF704AB77A4
IsDebuggerPresent.KERNEL32 ref: 00007FF704AB77DD
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF704AB77E7
UnhandledExceptionFilter.KERNEL32 ref: 00007FF704AB77F2

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 5940ef1d6d2c32beaf7af9e8e0892e721e3d30544378453b8f42f9f5775f8da8
Instruction ID: cf4d3954468849462cff271eecea1d1a6896a06f6a926dbafaf410ec4fac0619
Opcode Fuzzy Hash: 5940ef1d6d2c32beaf7af9e8e0892e721e3d30544378453b8f42f9f5775f8da8
Instruction Fuzzy Hash: 21316F76608B8185DB60AF66EC806EEB3A4FB84754FA00136EE8D43B99DF3CD155C750

Function 00007FF704A81AA4 Relevance: 6.3, APIs: 4, Instructions: 285COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A81EA9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A81EAF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A81EB5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A81EBB

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 00c65ffcf60346d337f61221e85b83ea90a30423c350e1db36569143759fd9a8
Instruction ID: 7d678c5ef36a0e6df06035d481ed973ec8734ca360ee9bf675e119e75cb7725b
Opcode Fuzzy Hash: 00c65ffcf60346d337f61221e85b83ea90a30423c350e1db36569143759fd9a8
Instruction Fuzzy Hash: 6AB1C2B2A1468645EB10AF66DC846FDA361FF85788FA01239EA5C07BDADF3CD541C310

Function 00007FF704ABFA94 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF704ABFAC4

Part of subcall function 00007FF704AB7934: GetCurrentProcess.KERNEL32(00007FF704AC0CCD), ref: 00007FF704AB7961

Strings

., xrefs: 00007FF704ABFEE4
*?, xrefs: 00007FF704ABFAEB

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: CurrentProcess_invalid_parameter_noinfo
String ID: *?$.
API String ID: 2518042432-3972193922
Opcode ID: f96344909874f118cd7fc652812aee2de17a0b901a5c412331694f6fbd6e8fc4
Instruction ID: 7362fc4cc0258be638e1f151268d66a6f71643b10c2f79e7bb7a205e802b1b78
Opcode Fuzzy Hash: f96344909874f118cd7fc652812aee2de17a0b901a5c412331694f6fbd6e8fc4
Instruction Fuzzy Hash: 085119A2B1575549EF11EFA39C908B8A3A0FF58BD8BA84531EE1D57B86DF3CD0418350

Function 00007FF704AC2080 Relevance: 4.8, APIs: 3, Instructions: 340COMMONLIBRARYCODE

Download Yara Rule

APIs

memcpy_s.LIBCMT ref: 00007FF704AC210B

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: b531b63a04a12e36dec63d06dc2411054f876835da8b044adf2bb9f605172619
Instruction ID: dcf5a1b1e2c50f6fbd90117e3bc8eeccb6715bd09a0b048971be4818c0bc3d89
Opcode Fuzzy Hash: b531b63a04a12e36dec63d06dc2411054f876835da8b044adf2bb9f605172619
Instruction Fuzzy Hash: 2ED1A273B1828687DB74DF16A584BAAB7A1FB98784F648134CB4E57B44DB3CE841CB00

Function 00007FF704A8B6D8 Relevance: 4.5, APIs: 3, Instructions: 36windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF704A8BA9D), ref: 00007FF704A8B6E5
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,00007FF704A8BA9D), ref: 00007FF704A8B719
LocalFree.KERNEL32(?,?,?,?,?,?,?,00007FF704A8BA9D), ref: 00007FF704A8B743

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID:
API String ID: 1365068426-0
Opcode ID: c27e05edbcf0c556cf9f4b9f4aa6354f64d9dc72ff0f252d3a2ededa039666af
Instruction ID: f61977b1d1c3373b6859c1d61e20a01fe17c73b851ba4745e18d442abcd49753
Opcode Fuzzy Hash: c27e05edbcf0c556cf9f4b9f4aa6354f64d9dc72ff0f252d3a2ededa039666af
Instruction Fuzzy Hash: 6601F4B560C74182E760AF13BC9057AA395FF897C1F944038EA8E47B45CF3CE5058760

Function 00007FF704ABFCA0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

., xrefs: 00007FF704ABFEE4

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 7c9d8364e7b62915daf92aecf888b4814fe01b6aae5fc02ec6e7aa2f3019df5b
Instruction ID: 8ab5c885188205a29713f19e8d2b999c7a57067fab54fdde7ea48fbcfaf070de
Opcode Fuzzy Hash: 7c9d8364e7b62915daf92aecf888b4814fe01b6aae5fc02ec6e7aa2f3019df5b
Instruction Fuzzy Hash: A8311C61B0469149E760AE379C44BB9A651BF45BE4FA88235EE5C47BC6CF3CD5018340

Function 00007FF704AC5AF8 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF704AC5D45
RaiseException.KERNEL32 ref: 00007FF704AC5D56

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 131550a8e914c8a4384a7255cc8ec53066b4dff0b7ecc1394be8dfb6b4310eca
Instruction ID: 51f84558b551ee85b9f00b1e1ea4b65bacb519b5939e930c51bd7b9f83ceb8a9
Opcode Fuzzy Hash: 131550a8e914c8a4384a7255cc8ec53066b4dff0b7ecc1394be8dfb6b4310eca
Instruction Fuzzy Hash: F5B18173A04B948BE765DF2AC88536C7BE0FB44B48F648931EA5D877A4CB39E451C710

Function 00007FF704AA8DF4 Relevance: 3.2, APIs: 2, Instructions: 186COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF704AA85E0: GetDC.USER32 ref: 00007FF704AA85EC
Part of subcall function 00007FF704AA85E0: GetDeviceCaps.GDI32 ref: 00007FF704AA85FD
Part of subcall function 00007FF704AA85E0: ReleaseDC.USER32 ref: 00007FF704AA860A

GetObjectW.GDI32 ref: 00007FF704AA8E48

Part of subcall function 00007FF704AA90B0: GetDC.USER32 ref: 00007FF704AA90D9
Part of subcall function 00007FF704AA90B0: GetObjectW.GDI32 ref: 00007FF704AA9107
Part of subcall function 00007FF704AA90B0: ReleaseDC.USER32 ref: 00007FF704AA91BB

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID:
API String ID: 1061551593-0
Opcode ID: 68dbe16693602acb82a0a9c061fd0d735b77194d41f4ab9e90264308bb487059
Instruction ID: 16b46d612fd4688a7353e8792cefd9e300eb6642015f9d08d860185cd0716b8e
Opcode Fuzzy Hash: 68dbe16693602acb82a0a9c061fd0d735b77194d41f4ab9e90264308bb487059
Instruction Fuzzy Hash: 70813BB6B08A1586EB20EF6AD880AADB771FB88B88F504136DE0D57724DF3DD545C390

Function 00007FF704AAA2CC Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 00007FF704AAA315
GetNumberFormatW.KERNEL32 ref: 00007FF704AAA371

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: a0c8fcaef59427837b2a7c7753e3d717a8442860a15e47712294eddcbb527c28
Instruction ID: 94f89f0efcb17b5e5108996d5e3e71d19667dcef38f25633ff459aa4f9b69409
Opcode Fuzzy Hash: a0c8fcaef59427837b2a7c7753e3d717a8442860a15e47712294eddcbb527c28
Instruction Fuzzy Hash: BA115CB6A08B8195E761AF12E880BE9B360FF88B44FD44135DA8D03754DF3CE155CB68

Function 00007FF704A9126C Relevance: 1.7, APIs: 1, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF704A924C0: CreateFileW.KERNELBASE ref: 00007FF704A9259B
Part of subcall function 00007FF704A924C0: GetLastError.KERNEL32 ref: 00007FF704A925AE
Part of subcall function 00007FF704A924C0: CreateFileW.KERNEL32 ref: 00007FF704A9260E
Part of subcall function 00007FF704A924C0: GetLastError.KERNEL32 ref: 00007FF704A92617

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A915D0

Part of subcall function 00007FF704A93980: MoveFileW.KERNEL32 ref: 00007FF704A939BD
Part of subcall function 00007FF704A93980: MoveFileW.KERNEL32 ref: 00007FF704A93A34

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: File$CreateErrorLastMove$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 34527147-0
Opcode ID: f4ba19db134fffdb72e5179b0e3b1489712cd3e3a676d213efa016387a492e8d
Instruction ID: 748eedabe21696780ffd3def076dbafb897179b44a7eea65e3249df99edf4370
Opcode Fuzzy Hash: f4ba19db134fffdb72e5179b0e3b1489712cd3e3a676d213efa016387a492e8d
Instruction Fuzzy Hash: 7091B2B2B1864681EA50EF67DC84AAEA360FF84BC4FA04036EE4D47B95DF38D945C350

Function 00007FF704A951A4 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32 ref: 00007FF704A951D5

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 6220f8f0736b52f52a4f9f0684f7fcd1da0b773ba531a70ae5974f71c0de4052
Instruction ID: 2da20e62e00e5c9047a673f6d481df51793f1d0522ba66873db65aeb12617a57
Opcode Fuzzy Hash: 6220f8f0736b52f52a4f9f0684f7fcd1da0b773ba531a70ae5974f71c0de4052
Instruction Fuzzy Hash: 3701DBB2D0954286F664AF12EC91B75B2A1FF98314FA00235D66D46794DB3CE4058A20

Function 00007FF704AB8C1C Relevance: 1.5, Strings: 1, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF704AB8DD3

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 0fbd957179d89af9e1d3453d65279f22830f04fe064c784c04e338e6c7bf3646
Instruction ID: 678c1c277b449945714abac9fc1159524c994fba3df1d4a1713156b6af812413
Opcode Fuzzy Hash: 0fbd957179d89af9e1d3453d65279f22830f04fe064c784c04e338e6c7bf3646
Instruction Fuzzy Hash: 4C8106E1A1814242EAA4BE1B8CC0E7DA398EF51B44FF4153ADD0987697CF3DE845C7A0

Function 00007FF704AB89A0 Relevance: 1.4, Strings: 1, Instructions: 199COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF704AB8B3A

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: a261a21fa45f21d734edfefcd2ffe271b1157111beaf653bc061adca1a26389c
Instruction ID: 6ec384e870e7dbf903d7711f48d231cfd1a0f0488b459bb4377131e69d99ddd6
Opcode Fuzzy Hash: a261a21fa45f21d734edfefcd2ffe271b1157111beaf653bc061adca1a26389c
Instruction Fuzzy Hash: 057106E1A0C28246EA64BE2F88C0A7DE7989F41744FF4153DCD0997687CF2DE84687E1

Function 00007FF704A9C96C Relevance: 1.4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

gj, xrefs: 00007FF704A9C97B

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: 226aa63bfce789330e15763d8953fb7d553c3450d9c1aa6f260de1088bdface5
Instruction ID: a36d132c165e3f453224d59175afd120393089b79609fa1ff3bab951e5a855a9
Opcode Fuzzy Hash: 226aa63bfce789330e15763d8953fb7d553c3450d9c1aa6f260de1088bdface5
Instruction Fuzzy Hash: 8151B1777286908BD724CF26E840A9EB3A5F388758F445126EF4A83B05CB39E945CF40

Function 00007FF704ABC838 Relevance: 1.4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

@, xrefs: 00007FF704ABC874

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 49e7fa989fc271adaa8e130b28d1cae0d9f82f392019a5f874cdac11a507a941
Instruction ID: 121d574643f4038bf016de039a5e99ba5f218a0a844a011384d2ea7cf73296a8
Opcode Fuzzy Hash: 49e7fa989fc271adaa8e130b28d1cae0d9f82f392019a5f874cdac11a507a941
Instruction Fuzzy Hash: 5D41DFA2714A4486EF04DF2BD894AA9B3A1AB48FD0B999036DE1D8B755DF3CD041C350

Function 00007FF704AC0D20 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF704AC0D24

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 4ce929ddb23f73c0a8458b43b9ad49d4d7e2a2f746430c3d48bba7e89996d797
Instruction ID: ccee81f6f71bfa12e487aae729ddcd6e4e0595204a84b70771877ac474d1a12e
Opcode Fuzzy Hash: 4ce929ddb23f73c0a8458b43b9ad49d4d7e2a2f746430c3d48bba7e89996d797
Instruction Fuzzy Hash: C6B092A0E17B02C2EA483F176CD269462A8BF48701FE4A038C10C41320DF3C20AA4720

Function 00007FF704AA3964 Relevance: .9, Instructions: 931COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93e830777a8553980f5fe243353a36f6d8d27a5fc8052bc9569f2c684e316ecf
Instruction ID: f17088a7660f814942622a0750445c6b60f0476f57ad59e439dc01170f8530c9
Opcode Fuzzy Hash: 93e830777a8553980f5fe243353a36f6d8d27a5fc8052bc9569f2c684e316ecf
Instruction Fuzzy Hash: 1B8249B3A096C186DB04DF26D884ABCBB61EB55B88F68C136DE4E07385DB3DD855C360

Function 00007FF704A876C0 Relevance: .9, Instructions: 893COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb6bb4a62616f0bcd3e2e2126cd32946fe2ad160a7c0dbd4e5bd03ed1428d6a6
Instruction ID: 4a595864c2976b6801f1e7a75dada21d83c51881a1615aa93f6176a51266e091
Opcode Fuzzy Hash: fb6bb4a62616f0bcd3e2e2126cd32946fe2ad160a7c0dbd4e5bd03ed1428d6a6
Instruction Fuzzy Hash: 62627D9AD3AF9A1EE303A53954131D2E35C0EF74C9551E31BFCE431E66EB92A6832314

Function 00007FF704AA53F0 Relevance: .9, Instructions: 891COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 569adc29ececf777b1726fc3f5cd67d4b9927b4b604ee9515eb09b13eba64041
Instruction ID: 5a799ff5899cd6befe03927afabccf6e34a1cde44be6439c29694f5905877459
Opcode Fuzzy Hash: 569adc29ececf777b1726fc3f5cd67d4b9927b4b604ee9515eb09b13eba64041
Instruction Fuzzy Hash: 708232B3A092C09AD724DF25D884AFCBBA1FB55B48F688136CA4D07785CB3CD495C764

Function 00007FF704A9BB90 Relevance: .6, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffdf8f5a64276e3eb417e3b9ae5b43350349d41efb04db03fca9f8ba9e24336f
Instruction ID: 66859775b1ddea647642dd69bf2155fe054ce83d584aaf4e3ccd939602087d9e
Opcode Fuzzy Hash: ffdf8f5a64276e3eb417e3b9ae5b43350349d41efb04db03fca9f8ba9e24336f
Instruction Fuzzy Hash: 5E22C2B3B246508BD728CF25DC9AE5E3766F798744B4B8228DB0ACB785DB38D505CB40

Function 00007FF704AA4B98 Relevance: .6, Instructions: 578COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21143e83615dcc23e36b64f0d60848ac948cba63854c17a605a1a3ec217f9251
Instruction ID: bc9a679f270244e80beedbdf64b63ef37c169a973824749032cb41c6476e4e9b
Opcode Fuzzy Hash: 21143e83615dcc23e36b64f0d60848ac948cba63854c17a605a1a3ec217f9251
Instruction Fuzzy Hash: 783202B3A041819BE71CDF25D990ABCB7A1FB54B08F518139DB4A87B84DB3CE865C790

Function 00007FF704A87288 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 063370d9e2e9571dc593e8358d008e0ec5385ad0435e9f2f5019d46da215c13b
Instruction ID: 5122f8f555a22d934a06613aafce9ec275fc2d1aa452a582277922b28f9c2fe7
Opcode Fuzzy Hash: 063370d9e2e9571dc593e8358d008e0ec5385ad0435e9f2f5019d46da215c13b
Instruction Fuzzy Hash: 8CC1BDB7B281908FE350CF7AE440A9D7BB1F39878CB519125EF59A3B09D639E605CB40

Function 00007FF704AA2D58 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 602477e063b5c1ca901f2159ae3c7fc010244aaa433e93e1960e83d539d05e76
Instruction ID: 0ad6dcdd7a162d0778ce2e9fdbc710c7c03ed3844ac4e5f27e768a4f9068a6bf
Opcode Fuzzy Hash: 602477e063b5c1ca901f2159ae3c7fc010244aaa433e93e1960e83d539d05e76
Instruction Fuzzy Hash: CCA138B3A0818146EB25EE26DC84BFDA791EF94744FA54175DE4907786CF3CE8A1C3A0

Function 00007FF704A9AF18 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3f156a61251d3696a660eff3e2c5499dd818c979554cbf7ea7c30eccab92618
Instruction ID: ea6a6b3eac989b864a36b451a1f79f5a902e5b61b7fccc602ecae345c1d14931
Opcode Fuzzy Hash: e3f156a61251d3696a660eff3e2c5499dd818c979554cbf7ea7c30eccab92618
Instruction Fuzzy Hash: E6C10673A291E04DE302CBB6A8648FD3FB1F71D34DB464152EF9656B4AD6285201DF70

Function 00007FF704A8A310 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: ba0d91b71a6ba36ace61fab0c0f7d4922daa1e3f8d028e3e8b3457ff5b2a4fa0
Instruction ID: 92965990d145267a70b84f3498fe2d51d2037b1d1677ae78ec28e5bfabbf969e
Opcode Fuzzy Hash: ba0d91b71a6ba36ace61fab0c0f7d4922daa1e3f8d028e3e8b3457ff5b2a4fa0
Instruction Fuzzy Hash: F09107A2B1858196EB11EF2ADC91AFDA721FF95788F941031EF4E07649EF38E645C310

Function 00007FF704A9B534 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfd80b8924012b3a81ce264cde7180753b201b1e387c519ebd9873ce58afa85e
Instruction ID: f4f7b74c08181f5eadf390a5ec88a6c560ecbd0ae219193ff3e5d7f5b7e3d1ee
Opcode Fuzzy Hash: cfd80b8924012b3a81ce264cde7180753b201b1e387c519ebd9873ce58afa85e
Instruction Fuzzy Hash: 496104A2F191D149EB01DF769D808FDBBA1BB49784B958032CF9A57646CB38F905CB30

Function 00007FF704AA21D0 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8137a9b05b05aada6fbcd6bbdda66db02b1ef4637fe403d2df7c72722ebbdea5
Instruction ID: 81d0dcf41e80a2705f3bc0aa7165148aa894dd2bfb2e8536d286acd4b59c04aa
Opcode Fuzzy Hash: 8137a9b05b05aada6fbcd6bbdda66db02b1ef4637fe403d2df7c72722ebbdea5
Instruction Fuzzy Hash: 425141B3B181514BE7289F2AD844BADB751FB90B48FA44130DB094B789DF3DE564CBA0

Function 00007FF704AA2AB0 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 525267a7f117e2089c634eae81b531c40420bccc1aa688f1dd99d62513960580
Instruction ID: 3f5d671eeb2fef1251c43667a32d91f29a451104fc30167f99106dceebf32366
Opcode Fuzzy Hash: 525267a7f117e2089c634eae81b531c40420bccc1aa688f1dd99d62513960580
Instruction Fuzzy Hash: EF31D2F3A086814BD718EE269D906BEB790BB54344F548139DF4A87B41DB3CE466C750

Function 00007FF704AC58E0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20052d42666034676028b01d15d2cffdefdd266dec7e2dd0f98b8d8f07818195
Instruction ID: 5c64f1dfe6fafb9f7fc2bb22146cea60f2f51ef68ee795f409296f06934f7a70
Opcode Fuzzy Hash: 20052d42666034676028b01d15d2cffdefdd266dec7e2dd0f98b8d8f07818195
Instruction Fuzzy Hash: 3FF068F1B183558BDBA4DF2AA882A2A77D4FB08384F948039D59D83B04D73C94508F14

Function 00007FF704AB3354 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e57e15d0ab639cfe726454a8769b7378f2b682ff734fe90589bfb13db1bf513a
Instruction ID: f5bcd53ebaac931973bd7984241ef70b3df307a6593124c25b1eb8ddf1fde89d
Opcode Fuzzy Hash: e57e15d0ab639cfe726454a8769b7378f2b682ff734fe90589bfb13db1bf513a
Instruction Fuzzy Hash: AFA001A1908942D0EA94AF12ACA08B1A220BF50301BA02035E40D412A69F3CA40183A4

Function 00007FF704A8D7D0 Relevance: 26.3, APIs: 1, Strings: 14, Instructions: 98COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A8D964

Strings

:$I30:$INDEX_ALLOCATION, xrefs: 00007FF704A8D849
::$INDEX_ALLOCATION, xrefs: 00007FF704A8D83E
::$OBJECT_ID, xrefs: 00007FF704A8D880
::$REPARSE_POINT, xrefs: 00007FF704A8D88B
:$TXF_DATA:$LOGGED_UTILITY_STREAM, xrefs: 00007FF704A8D875
::$BITMAP, xrefs: 00007FF704A8D807
::$EA, xrefs: 00007FF704A8D81D
::$EA_INFORMATION, xrefs: 00007FF704A8D828
:$EFS:$LOGGED_UTILITY_STREAM, xrefs: 00007FF704A8D86A
::$DATA, xrefs: 00007FF704A8D812
::$ATTRIBUTE_LIST, xrefs: 00007FF704A8D7FC
::$LOGGED_UTILITY_STREAM, xrefs: 00007FF704A8D85F
::$INDEX_ROOT, xrefs: 00007FF704A8D854
::$FILE_NAME, xrefs: 00007FF704A8D833

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: :$EFS:$LOGGED_UTILITY_STREAM$:$I30:$INDEX_ALLOCATION$:$TXF_DATA:$LOGGED_UTILITY_STREAM$::$ATTRIBUTE_LIST$::$BITMAP$::$DATA$::$EA$::$EA_INFORMATION$::$FILE_NAME$::$INDEX_ALLOCATION$::$INDEX_ROOT$::$LOGGED_UTILITY_STREAM$::$OBJECT_ID$::$REPARSE_POINT
API String ID: 3668304517-727060406
Opcode ID: fc44dbfd106e66ad26630d810067bee7702886ae7b68d41755c36eb4d41d7e9a
Instruction ID: 574b64205e692f4d73f061762bbf88bb21cd828542144a276edccf8c6a9fd633
Opcode Fuzzy Hash: fc44dbfd106e66ad26630d810067bee7702886ae7b68d41755c36eb4d41d7e9a
Instruction Fuzzy Hash: 0341F8B6A05B0199EB50AF62D8807ED73A5FF48798FA0013ADA5C13B95EF3CD155C390

Function 00007FF704AB2A10 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF704AB2A26
GetModuleHandleW.KERNEL32 ref: 00007FF704AB2A33
GetModuleHandleW.KERNEL32 ref: 00007FF704AB2A48
GetProcAddress.KERNEL32 ref: 00007FF704AB2A60
GetProcAddress.KERNEL32 ref: 00007FF704AB2A73
CreateEventW.KERNEL32 ref: 00007FF704AB2A9F
DeleteCriticalSection.KERNEL32 ref: 00007FF704AB2AEB
CloseHandle.KERNEL32 ref: 00007FF704AB2AFD

Strings

api-ms-win-core-synch-l1-2-0.dll, xrefs: 00007FF704AB2A2C
WakeAllConditionVariable, xrefs: 00007FF704AB2A66
SleepConditionVariableCS, xrefs: 00007FF704AB2A56
kernel32.dll, xrefs: 00007FF704AB2A41

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 6e1e709f092c3aabc6fb1c9db3d7c09c3ef1a4a7bf2af41e7ac9402dec2f511f
Instruction ID: e3dc5e7cc0bc6cf14ee00ded10c6cf2dd3d08b4d92bde09697829a6fb850a529
Opcode Fuzzy Hash: 6e1e709f092c3aabc6fb1c9db3d7c09c3ef1a4a7bf2af41e7ac9402dec2f511f
Instruction Fuzzy Hash: 1A2110E1E1AA0381FA64BF53ECD9A78A3A0BF54785FE40479C91E027A1DF3CA4458370

Function 00007FF704AAA440 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 257COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF704A8129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF704A81396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AAA72F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AAA735
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AAA73B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AAA741
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AAA747
EndDialog.USER32 ref: 00007FF704AAA7BA

Strings

GETPASSWORD1, xrefs: 00007FF704AAA773
Software\WinRAR SFX, xrefs: 00007FF704AAA52B, 00007FF704AAA53A

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskDialog
String ID: GETPASSWORD1$Software\WinRAR SFX
API String ID: 431506467-1315819833
Opcode ID: d20c2f114c9109beee27ce5cf2a2d2fb90c2edf5e9b936924732424cb653f975
Instruction ID: 54d28bcfad4b34b5ab1a9df0bf9442996789585475a0edba3a20c3df4e779ef6
Opcode Fuzzy Hash: d20c2f114c9109beee27ce5cf2a2d2fb90c2edf5e9b936924732424cb653f975
Instruction Fuzzy Hash: 61B1C3E3F1874285FB00AF66D884BBD63A1AF45394FA04235DA1C26AD9DF3CE455C394

Function 00007FF704AA6E80 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF704AA7E9B), ref: 00007FF704AA7080
CreateStreamOnHGlobal.COMBASE ref: 00007FF704AA70B1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AA717B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AA7181
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AA7187

Strings

<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00007FF704AA6F2C, 00007FF704AA6F3B
<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>, xrefs: 00007FF704AA6ED5, 00007FF704AA6EE4
</html>, xrefs: 00007FF704AA6F72, 00007FF704AA6F81
<html>, xrefs: 00007FF704AA6F13

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Global$AllocCreateStream
String ID: </html>$<html>$<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 2868844859-1533471033
Opcode ID: 2898a28f977da2e8be164ceb19746454dfb341212ef238b9de87e8b4e4f89fde
Instruction ID: e69da31580b481f76a49bf7cdd1fba5714591ab875e8a6c9324e95552c33ddf6
Opcode Fuzzy Hash: 2898a28f977da2e8be164ceb19746454dfb341212ef238b9de87e8b4e4f89fde
Instruction Fuzzy Hash: C78192A3B18A0295FB10EFA6DC849EDA371AF44784FA04135CE1D176DAEF38D516C3A0

Function 00007FF704ABE650 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF704ABE7CD

Strings

INF, xrefs: 00007FF704ABE6C3
nan(snan), xrefs: 00007FF704ABE6F0
NAN(SNAN), xrefs: 00007FF704ABE6E5
nan, xrefs: 00007FF704ABE6B8
nan(ind), xrefs: 00007FF704ABE706
NAN, xrefs: 00007FF704ABE6B1
NAN(IND), xrefs: 00007FF704ABE6FB
inf, xrefs: 00007FF704ABE6D6

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
API String ID: 3215553584-2617248754
Opcode ID: ca8329083cbd7a022b2adefca7a3bb58d0ae1dff90efa4c28dbe4d3f14657870
Instruction ID: 377eb4141bc2ca505ff0dc0579c1ef07c842ea761dfb21102ec4dea0f5fa4b9c
Opcode Fuzzy Hash: ca8329083cbd7a022b2adefca7a3bb58d0ae1dff90efa4c28dbe4d3f14657870
Instruction Fuzzy Hash: 8E41ACB2A09B4589EB50DF26E881BE973A4EF18394FA14136EE4C03B55DF3CD065C394

Function 00007FF704AAF390 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32 ref: 00007FF704AAF3CF
GetClassNameW.USER32 ref: 00007FF704AAF3FC
GetWindowLongPtrW.USER32 ref: 00007FF704AAF41D
SendMessageW.USER32 ref: 00007FF704AAF437
GetObjectW.GDI32 ref: 00007FF704AAF452
SendMessageW.USER32 ref: 00007FF704AAF487
DeleteObject.GDI32 ref: 00007FF704AAF490
GetWindow.USER32 ref: 00007FF704AAF49E

Strings

STATIC, xrefs: 00007FF704AAF402

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassDeleteLongName
String ID: STATIC
API String ID: 2845197485-1882779555
Opcode ID: 028936735c5caa7e1c5955390d3996a5d13f8d6e72d7f98742e6e6c768b0ab82
Instruction ID: 6455185e90ee6b716a838479acc71d8d265f2a79251607e5aacff6aacde1d132
Opcode Fuzzy Hash: 028936735c5caa7e1c5955390d3996a5d13f8d6e72d7f98742e6e6c768b0ab82
Instruction Fuzzy Hash: 4F319462B0864246FA64FF13AD94BBAA391BF88BC4FA04030DD5D07B56DF3CD41587A0

Function 00007FF704AAAE90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

LICENSEDLG, xrefs: 00007FF704AAAEAE

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: ItemTextWindow
String ID: LICENSEDLG
API String ID: 2478532303-2177901306
Opcode ID: 35fefc179f922e98870b8a3b257cf5e504c5ed53f195972dc606f5139ed8380b
Instruction ID: 3a325aa76b59ecdcf23861f32ef7187ddc77298db73db6c0eb2e405cfb184cc1
Opcode Fuzzy Hash: 35fefc179f922e98870b8a3b257cf5e504c5ed53f195972dc606f5139ed8380b
Instruction Fuzzy Hash: FC4192A6A0865282FB54AF13ECD4F79A3A0AF84F84FA44035DA1E03B94CF3DE555C364

Function 00007FF704A9B9B4 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF704A9BA12
GetProcAddress.KERNEL32 ref: 00007FF704A9BA2D
GetCurrentProcessId.KERNEL32 ref: 00007FF704A9BACA

Part of subcall function 00007FF704A9DFD0: GetSystemDirectoryW.KERNEL32 ref: 00007FF704A9DDDF

Strings

CryptProtectMemory failed, xrefs: 00007FF704A9BA80
CryptUnprotectMemory failed, xrefs: 00007FF704A9BAC1
Crypt32.dll, xrefs: 00007FF704A9B9F0
CryptProtectMemory, xrefs: 00007FF704A9BA08
CryptUnprotectMemory, xrefs: 00007FF704A9BA1F

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: AddressProc$CurrentDirectoryProcessSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptProtectMemory failed$CryptUnprotectMemory$CryptUnprotectMemory failed
API String ID: 2915667086-2207617598
Opcode ID: d2e93635ec338890dfe438c4789fcaf7e26687fbfe6c7ce53d5981307f2d6baa
Instruction ID: 5e7ddcba1e4b83f57c3be86ddfee50616c0f65009faf3dd694615737781a829b
Opcode Fuzzy Hash: d2e93635ec338890dfe438c4789fcaf7e26687fbfe6c7ce53d5981307f2d6baa
Instruction Fuzzy Hash: C23138E4A0AA0681EA54AF17BCD0979A3A0BF54B94FE40135D91E037A4DF7CF9418334

Function 00007FF704AA87D8 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 415COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AA8DB6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AA8DC2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AA8DCE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AA8DDA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AA8DE0

Strings

, xrefs: 00007FF704AA8A55
, xrefs: 00007FF704AA88BE

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: $
API String ID: 3668304517-227171996
Opcode ID: f2fdc83a9f6be17559bdfed1ab1fa604e61a382ff22291328a8e9483648cafea
Instruction ID: 40a8e2f16d028664239b88de0abc59b6964d8bf5e341e67e788267661010885e
Opcode Fuzzy Hash: f2fdc83a9f6be17559bdfed1ab1fa604e61a382ff22291328a8e9483648cafea
Instruction Fuzzy Hash: BEF1D1A3F1574640EE00BF66D8C49BDA361AF44B98FA05639CA1D177D5EF7CE0A483A0

Function 00007FF704AB57EC Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 317COMMONLIBRARYCODE

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF704AB598A
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF704AB5CAD
abort.LIBCMT ref: 00007FF704AB5CE1

Strings

csm, xrefs: 00007FF704AB58D1
csm, xrefs: 00007FF704AB59B1
csm, xrefs: 00007FF704AB5933

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: Is_bad_exception_allowedabortstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 2940173790-393685449
Opcode ID: 65edb01f61f21fff02eaccc9a46b43a233fa456fccf40e480b66f774ee54b1a7
Instruction ID: a03ca42f3ac0a9f6075a88bd9bc00979ae9e17c97515906835838ac5d8bd1a7b
Opcode Fuzzy Hash: 65edb01f61f21fff02eaccc9a46b43a233fa456fccf40e480b66f774ee54b1a7
Instruction Fuzzy Hash: 14E1BEB2D087829AE711AF66D8C0BADB7A0FF45748FA40135DA8D47697CF38E481C790

Function 00007FF704A94F38 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 158COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF704A94E24: SysAllocString.OLEAUT32 ref: 00007FF704A94E5F

VariantClear.OLEAUT32 ref: 00007FF704A95125

Strings

ROOT\CIMV2, xrefs: 00007FF704A94F7B
SELECT * FROM Win32_OperatingSystem, xrefs: 00007FF704A95017
Name, xrefs: 00007FF704A950F9
Windows 10, xrefs: 00007FF704A9510A
WQL, xrefs: 00007FF704A9502A

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: AllocClearStringVariant
String ID: Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL$Windows 10
API String ID: 1959693985-3505469590
Opcode ID: a8b35b7bcd37d82ee4aaa20c3b876beaab518b1de9e1ce59ea14af8b32f1fe8d
Instruction ID: 7769da5d38adac6a027e2199b872f8d238213ba8494ba7c1a6ca9f2175b715c8
Opcode Fuzzy Hash: a8b35b7bcd37d82ee4aaa20c3b876beaab518b1de9e1ce59ea14af8b32f1fe8d
Instruction Fuzzy Hash: 317140B6A14A1595EB20EF26DCC09ADB7B0FF88B98BA41136DA4E43B64CF3CD544C350

Function 00007FF704AB72EC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,00000000,00007FF704AB74F3,?,?,?,00007FF704AB525E,?,?,?,00007FF704AB5219), ref: 00007FF704AB7371
GetLastError.KERNEL32(?,?,00000000,00007FF704AB74F3,?,?,?,00007FF704AB525E,?,?,?,00007FF704AB5219), ref: 00007FF704AB737F
LoadLibraryExW.KERNEL32(?,?,00000000,00007FF704AB74F3,?,?,?,00007FF704AB525E,?,?,?,00007FF704AB5219), ref: 00007FF704AB73A9
FreeLibrary.KERNEL32(?,?,00000000,00007FF704AB74F3,?,?,?,00007FF704AB525E,?,?,?,00007FF704AB5219), ref: 00007FF704AB73EF
GetProcAddress.KERNEL32(?,?,00000000,00007FF704AB74F3,?,?,?,00007FF704AB525E,?,?,?,00007FF704AB5219), ref: 00007FF704AB73FB

Strings

api-ms-, xrefs: 00007FF704AB7391

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: eedfc97f7024c66fbeb39a7219499b253e22696fd1fdab2c5f769bf1fd383016
Instruction ID: 073888d33d11d5a3bc64f9e26f38b58ea44a843ee2c611b42112c39d54681735
Opcode Fuzzy Hash: eedfc97f7024c66fbeb39a7219499b253e22696fd1fdab2c5f769bf1fd383016
Instruction Fuzzy Hash: CB31E4A5A1AB4281EE61BF07AC80DB5A294FF84BA0FB94535DD1D0B781DF7CE0448370

Function 00007FF704AB1604 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 43libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,00007FF704AB1573,?,?,?,00007FF704AB192A), ref: 00007FF704AB162B
GetProcAddress.KERNEL32(?,?,?,00007FF704AB1573,?,?,?,00007FF704AB192A), ref: 00007FF704AB1648
GetProcAddress.KERNEL32(?,?,?,00007FF704AB1573,?,?,?,00007FF704AB192A), ref: 00007FF704AB1664

Strings

AcquireSRWLockExclusive, xrefs: 00007FF704AB163E
ReleaseSRWLockExclusive, xrefs: 00007FF704AB1653
KERNEL32.DLL, xrefs: 00007FF704AB1624

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: 4fe35f58cd4175722fa2f4edd42b7d77b08fa8d78ae8e9bf73ccac7c2071e7f8
Instruction ID: 3c28c53efe54a8b636e8376909fa1518f00222b4a81a491c99282cda54657f64
Opcode Fuzzy Hash: 4fe35f58cd4175722fa2f4edd42b7d77b08fa8d78ae8e9bf73ccac7c2071e7f8
Instruction Fuzzy Hash: D211FAA0A1AB4281FEA5BF07BDE0A7492A5AF087D4FF85439C81D06355EF3CA8448670

Function 00007FF704A9ED24 Relevance: 9.1, APIs: 6, Instructions: 120timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF704A951A4: GetVersionExW.KERNEL32 ref: 00007FF704A951D5

FileTimeToLocalFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF704A85AB4), ref: 00007FF704A9ED8C
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF704A85AB4), ref: 00007FF704A9ED98
SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF704A85AB4), ref: 00007FF704A9EDA8
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF704A85AB4), ref: 00007FF704A9EDB6
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF704A85AB4), ref: 00007FF704A9EDC4
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF704A85AB4), ref: 00007FF704A9EE05

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 197518eb8103cda2bd6b54f1f5e99fa721289ee203340eaf45d2c62117a67569
Instruction ID: 666e4f9f9b01b1d49fff7cbd3f19e6153743e7932d550e2473bbcfeeb7ad850b
Opcode Fuzzy Hash: 197518eb8103cda2bd6b54f1f5e99fa721289ee203340eaf45d2c62117a67569
Instruction Fuzzy Hash: 60518CB2B106518AEB14DFA9D8845ACB7B1FB48B88BA0403ADE1D57B58DF38E945C710

Function 00007FF704A9F010 Relevance: 9.1, APIs: 6, Instructions: 80timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32 ref: 00007FF704A9F074

Part of subcall function 00007FF704A951A4: GetVersionExW.KERNEL32 ref: 00007FF704A951D5

LocalFileTimeToFileTime.KERNEL32 ref: 00007FF704A9F096
FileTimeToSystemTime.KERNEL32 ref: 00007FF704A9F0A2
TzSpecificLocalTimeToSystemTime.KERNEL32 ref: 00007FF704A9F0B2
SystemTimeToFileTime.KERNEL32 ref: 00007FF704A9F0C0
SystemTimeToFileTime.KERNEL32 ref: 00007FF704A9F0CE

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 93bf5fe4be91675a5f4cba4a2df0f2c5ed0bd126a165fd4d88c3e7d5e64543a6
Instruction ID: 344d7c543afe4b4b5c12eb9469c714946d0860ae7ae45ea06a4568de54b2b909
Opcode Fuzzy Hash: 93bf5fe4be91675a5f4cba4a2df0f2c5ed0bd126a165fd4d88c3e7d5e64543a6
Instruction Fuzzy Hash: 6F3138A2B10A518EEB10DFB5D8805AC7770FF08759BA4503AEE1E97A58EF38D895C310

Function 00007FF704A97918 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 233COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A97C8C

Strings

.rar, xrefs: 00007FF704A97969, 00007FF704A97978
exe, xrefs: 00007FF704A979AF, 00007FF704A979BE
rar, xrefs: 00007FF704A97A9B, 00007FF704A97AAA, 00007FF704A97B67, 00007FF704A97B7C
sfx, xrefs: 00007FF704A979F3, 00007FF704A97A02

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: .rar$exe$rar$sfx
API String ID: 3668304517-630704357
Opcode ID: f9f2bcf0cb8583d59a24b9b75f9a5c37ac97f6480bd350e44fae3008da72eca6
Instruction ID: 088c53af6f91bc03314aeeeebfaaedc02b487d39ceb9235ae8b742bd222d212c
Opcode Fuzzy Hash: f9f2bcf0cb8583d59a24b9b75f9a5c37ac97f6480bd350e44fae3008da72eca6
Instruction Fuzzy Hash: 86A1A2AAA1460680EA00BF26DCD5ABCA361FF54B98FA41235DD1D077D6DF3CE941C3A0

Function 00007FF704AB5CE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF704AB5D58

Part of subcall function 00007FF704AB5210: abort.LIBCMT ref: 00007FF704AB5223

_CallSETranslator.LIBVCRUNTIME ref: 00007FF704AB5DA3
abort.LIBCMT ref: 00007FF704AB5FD1

Strings

RCC, xrefs: 00007FF704AB5D74
MOC, xrefs: 00007FF704AB5D6C

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: 0f4c2d06ef2d655583c55900dbb020dcf620b12558a4295111afe460be181df6
Instruction ID: 090b57eb77fd0109a3841d17726b0deeeeada52ea95003ddf6cc76c4fb1d1549
Opcode Fuzzy Hash: 0f4c2d06ef2d655583c55900dbb020dcf620b12558a4295111afe460be181df6
Instruction Fuzzy Hash: 9191C1B3E08B819AE710DF66E8806ADBBA0FB04788F644139EE4D07756DF38D195CB50

Function 00007FF704AB4F80 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF704AB4FAB
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF704AB5040
RtlUnwindEx.KERNEL32(?,?,?,?,?,?,?,00007FF704AB2F5E), ref: 00007FF704AB508F

Strings

f, xrefs: 00007FF704AB4FBE
csm, xrefs: 00007FF704AB5026

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: a7c39da158025e753bf36dfb1e051fd0b17def11f5f8def40396cbfe1c046983
Instruction ID: bfc54c6f346cd827cf39d3bfddd95e2b46c698fbd2457de446245928ca5ba170
Opcode Fuzzy Hash: a7c39da158025e753bf36dfb1e051fd0b17def11f5f8def40396cbfe1c046983
Instruction Fuzzy Hash: E451B471E1A602AAEB54EF16FC84E29B755FF40B8CFA08034D91A47749DF79E841C790

Function 00007FF704A8CEE0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF704A8D03D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A8D0D1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A8D0D7

Part of subcall function 00007FF704A8DE04: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF704A8CF4B), ref: 00007FF704A8DE27
Part of subcall function 00007FF704A8DE04: GetLastError.KERNEL32 ref: 00007FF704A8DE88
Part of subcall function 00007FF704A8DE04: CloseHandle.KERNEL32 ref: 00007FF704A8DE9B

Strings

SeSecurityPrivilege, xrefs: 00007FF704A8CF3F
SeRestorePrivilege, xrefs: 00007FF704A8CF5E

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: ErrorLast_invalid_parameter_noinfo_noreturn$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 2102711378-639343689
Opcode ID: 8e19f0960acccde70cdb6f4ae44bfdba7dde49cd3aecb391576d39059d5aab7f
Instruction ID: 0edaef2d897fec1802142345b89c006fe55aa69d0324a8f194ff2d898bf02941
Opcode Fuzzy Hash: 8e19f0960acccde70cdb6f4ae44bfdba7dde49cd3aecb391576d39059d5aab7f
Instruction Fuzzy Hash: 4551B4A2E1875145FA10FF67ACC0ABDA370AF447A4FA00139DE1E176D6DF3CA485C260

Function 00007FF704AA7B28 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 00007FF704AA7B6F
GetWindowRect.USER32 ref: 00007FF704AA7BC0
ShowWindow.USER32 ref: 00007FF704AA7C96
ShowWindow.USER32 ref: 00007FF704AA7CC3

Strings

RarHtmlClassName, xrefs: 00007FF704AA7C4B

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: Window$Show$Rect
String ID: RarHtmlClassName
API String ID: 2396740005-1658105358
Opcode ID: 95333b9ad2bfddc98b100d65ee3ae7a1141886215ecc40d0d40dcbf9cb340d19
Instruction ID: 107584cd1834729dd287569b0f775bf8a810cb91e5ffdebf240cc95ddeddf637
Opcode Fuzzy Hash: 95333b9ad2bfddc98b100d65ee3ae7a1141886215ecc40d0d40dcbf9cb340d19
Instruction Fuzzy Hash: EC51A3A6A0974286EA24EF23E894B7BE3A0FF84780FA04035DE4E47B55DF3CE0558750

Function 00007FF704AAFD0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32 ref: 00007FF704AAFD43
SetEnvironmentVariableW.KERNEL32 ref: 00007FF704AAFDBC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704AAFE1B

Strings

sfxcmd, xrefs: 00007FF704AAFD3C
sfxpar, xrefs: 00007FF704AAFDB5

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: EnvironmentVariable$_invalid_parameter_noinfo_noreturn
String ID: sfxcmd$sfxpar
API String ID: 3540648995-3493335439
Opcode ID: ce72e9bcdfddcf2667ebe4c513ec0d1727c59f1d3b739ca42450d660fec21911
Instruction ID: a89335c82d5f6acf9fcd04cd42511e9f70bf97839e4ad784663c0d739c396c3d
Opcode Fuzzy Hash: ce72e9bcdfddcf2667ebe4c513ec0d1727c59f1d3b739ca42450d660fec21911
Instruction Fuzzy Hash: CA3150B2A14A0584EB04AF66ECC49ACA371FF44B98FA40135DE5D177A9DF38D051C3A4

Function 00007FF704AAFED4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52COMMON

Download Yara Rule

Strings

RENAMEDLG, xrefs: 00007FF704AAFF60
REPLACEFILEDLG, xrefs: 00007FF704AAFF34, 00007FF704AAFF99

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 98f895654b64cd1d2f90e97d30244ed9b67d31cc2014a88c355cd353264df31a
Instruction ID: a6d79955b8208930f2b904d276d80cd9ac94586db6202c02c499d527d76d9e6c
Opcode Fuzzy Hash: 98f895654b64cd1d2f90e97d30244ed9b67d31cc2014a88c355cd353264df31a
Instruction Fuzzy Hash: 8521F9A6908A4784FA14AF17FCC4978A360AF49748FF40036E65D47360CF7CE0A48764

Function 00007FF704ABBFB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF704ABBFD0
GetProcAddress.KERNEL32 ref: 00007FF704ABBFE6
FreeLibrary.KERNEL32 ref: 00007FF704ABC00B

Strings

mscoree.dll, xrefs: 00007FF704ABBFC7
CorExitProcess, xrefs: 00007FF704ABBFDF

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 42a4ca90c7c49dddb16080121233970ff8583544d2054868cb5f0899d871e2db
Instruction ID: c91dee07d760966541359f364e1db9e6b5e113a62adb65c2338cbeebde583648
Opcode Fuzzy Hash: 42a4ca90c7c49dddb16080121233970ff8583544d2054868cb5f0899d871e2db
Instruction Fuzzy Hash: 4AF068A1A19A4281EF94BF12FCD4A79A3A0FF887A1FA41039D94F46755DF3CD484C710

Function 00007FF704AC45C0 Relevance: 7.7, APIs: 5, Instructions: 203COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF704AC4605

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: cf462e6f26ae3af6f96c078c51b53c82231ed120809331cf2f591469c69a5a17
Instruction ID: c36a74381acde309ed1e079e992b1db6d394f757f79c2cfd0d77589b7901d80d
Opcode Fuzzy Hash: cf462e6f26ae3af6f96c078c51b53c82231ed120809331cf2f591469c69a5a17
Instruction Fuzzy Hash: 1181A3E2E1865245F7A0BF679CE0ABDA6A0BF49B48FA04135DD0E13795DF3CA441C728

Function 00007FF704A93AF8 Relevance: 7.7, APIs: 5, Instructions: 164filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF704A93BBB
CreateFileW.KERNEL32 ref: 00007FF704A93C24
SetFileTime.KERNEL32 ref: 00007FF704A93CEC
CloseHandle.KERNEL32 ref: 00007FF704A93CF6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A93D2C

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: File$Create$CloseHandleTime_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2398171386-0
Opcode ID: ed02a809717236ee1ed586c7e858dbefa1ed7ae72bbe3c8719455611c93ecd51
Instruction ID: eb34c4196099773d6e50bd06c73e48d585215bceab0d91eef56ae7867f0d0856
Opcode Fuzzy Hash: ed02a809717236ee1ed586c7e858dbefa1ed7ae72bbe3c8719455611c93ecd51
Instruction Fuzzy Hash: 1451D4A2B04A0259FF50EF66EC80BBDA371AF487A8FA44635DE1D467D5DF3C98158310

Function 00007FF704AC3F34 Relevance: 7.6, APIs: 5, Instructions: 142fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FF704AC4767), ref: 00007FF704AC3F91
WideCharToMultiByte.KERNEL32 ref: 00007FF704AC406D
WriteFile.KERNEL32 ref: 00007FF704AC4093
WriteFile.KERNEL32 ref: 00007FF704AC40D2
GetLastError.KERNEL32 ref: 00007FF704AC410A

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiWide
String ID:
API String ID: 3659116390-0
Opcode ID: 8f90b3f8899b92826fb288bc35eb601c263b89b4fb676f823db5d062d6f6b41f
Instruction ID: 9f55f38846f4e5822e6f41d1d347087a8cc44b8f06e52e1f9c0ca8986fc97090
Opcode Fuzzy Hash: 8f90b3f8899b92826fb288bc35eb601c263b89b4fb676f823db5d062d6f6b41f
Instruction Fuzzy Hash: B851E0B2A14A6185F760DF26D890BACBBB0FF48798F648135CE4A57B99CF38D045C324

Function 00007FF704AB1E00 Relevance: 7.6, APIs: 5, Instructions: 137memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF704A94DF4), ref: 00007FF704AB1E87
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF704A94DF4), ref: 00007FF704AB1F09
SysAllocString.OLEAUT32 ref: 00007FF704AB1F16

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: 55eea0222137253c860f73f771396d48486a61dcff80d6f5aaddb46a2ec13fc8
Instruction ID: 91af9697947ac75f29a1976f206179d19f60229e111d5dfbe02b13e6d11bd9b3
Opcode Fuzzy Hash: 55eea0222137253c860f73f771396d48486a61dcff80d6f5aaddb46a2ec13fc8
Instruction Fuzzy Hash: C341D6B1A0964589EB54AF339C90778A291FF04BE4FA44635EA6D477D6DF3CD04183A0

Function 00007FF704ABF414 Relevance: 7.6, APIs: 5, Instructions: 114libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF704ABF536

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: d8da239e760e4119be076ce5ae60c5d71a4e7276355522d8061e2664917ecd9d
Instruction ID: 6b8f66b16c801ab444635537ae8de390aa49dc168e85e885a12dc7f1f86f53d2
Opcode Fuzzy Hash: d8da239e760e4119be076ce5ae60c5d71a4e7276355522d8061e2664917ecd9d
Instruction Fuzzy Hash: 3441E9A1B09A4185FE15AF136D80975E295BF48BD0FAD8635ED1E8B745EF3CE4408360

Function 00007FF704AC56D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF704AC56FF
_set_statfp.LIBCMT ref: 00007FF704AC571A
_set_statfp.LIBCMT ref: 00007FF704AC5736
_set_statfp.LIBCMT ref: 00007FF704AC5772

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: f3bd3298a46f29c998dca386ec4adc9bd6d7efdfabb851da102e47160911a3a1
Instruction ID: d1cfbe9914d4f14d7c8de8ba1e0c72a148162157fa2d0207a60b310e88001440
Opcode Fuzzy Hash: f3bd3298a46f29c998dca386ec4adc9bd6d7efdfabb851da102e47160911a3a1
Instruction Fuzzy Hash: D511D3FAE88627E1F6F4392AEDC5B7980416F553A0FE84A30F57D067D68F2CB4804128

Function 00007FF704AAFE24 Relevance: 7.5, APIs: 5, Instructions: 29windowsynchronizationCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32 ref: 00007FF704AAFE41
GetMessageW.USER32 ref: 00007FF704AAFE58
TranslateMessage.USER32 ref: 00007FF704AAFE63
DispatchMessageW.USER32 ref: 00007FF704AAFE6E
WaitForSingleObject.KERNEL32 ref: 00007FF704AAFE7C

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: Message$DispatchObjectPeekSingleTranslateWait
String ID:
API String ID: 3621893840-0
Opcode ID: eb57a341668d454e4e6cd52f39bb1811463ddcab187ea95c48cb89abc8d18535
Instruction ID: 3c618ad6f4742fd1f39c5fed948d4c5a08fb50b2c2dd6054f98e163baba47333
Opcode Fuzzy Hash: eb57a341668d454e4e6cd52f39bb1811463ddcab187ea95c48cb89abc8d18535
Instruction Fuzzy Hash: 99F06262B3944682F764AF22ECD4F36A251FFE4B05FE41030E55E81994DF2CD189CB24

Function 00007FF704AB625C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF704AB6286
abort.LIBCMT ref: 00007FF704AB64EA

Strings

csm, xrefs: 00007FF704AB62AB
csm, xrefs: 00007FF704AB641A

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: __except_validate_context_recordabort
String ID: csm$csm
API String ID: 746414643-3733052814
Opcode ID: 91fc108a1c492767e4bb41002f60c2920875b1ec76e01922ab372504797a4c8e
Instruction ID: d6199a5019e39063f01ede23a90f00f929a9d70357ee48956aefb54264bf4c5b
Opcode Fuzzy Hash: 91fc108a1c492767e4bb41002f60c2920875b1ec76e01922ab372504797a4c8e
Instruction Fuzzy Hash: 2571B2B2908A9186D760AF26D990B7DFBA0FF05B88F648135DE4C07B86CB3CD495C791

Function 00007FF704AB80F4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF704AB811B
_invalid_parameter_noinfo.LIBCMT ref: 00007FF704AB82ED

Strings

*, xrefs: 00007FF704AB8221
, xrefs: 00007FF704AB8276

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: 42643a1ee39b50d27a50b926b179a62c0cdc4d381fe14b17104e750277292b9f
Instruction ID: 9e11f23a8671499b3354579e9a87a08e07ae452322dc5192dea3296311af8acb
Opcode Fuzzy Hash: 42643a1ee39b50d27a50b926b179a62c0cdc4d381fe14b17104e750277292b9f
Instruction Fuzzy Hash: B65177B2D0D6428AE764BE2E88C477C7BA8FF05B18FB41139C6594529ACF3CD481C6A5

Function 00007FF704AC1758 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF704AC17CB
MultiByteToWideChar.KERNEL32 ref: 00007FF704AC1894
GetStringTypeW.KERNEL32 ref: 00007FF704AC18AE

Strings

$%s, xrefs: 00007FF704AC175A

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: ByteCharMultiWide$StringType
String ID: $%s
API String ID: 3586891840-3791308623
Opcode ID: 8174e861c2faa6f2f7f5292a0ee7474812abc1109b8acb2517e9a7bc716d8d39
Instruction ID: f87165d91e2c16fbd60944ea9a17a12db983009a30fef870d8a44e7febd871b5
Opcode Fuzzy Hash: 8174e861c2faa6f2f7f5292a0ee7474812abc1109b8acb2517e9a7bc716d8d39
Instruction Fuzzy Hash: 2D419772B1878145EB61AF26DC80AA9A291FF44BA8F940635DE1D077C5DF3CE4458750

Function 00007FF704AB66A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF704AB5210: abort.LIBCMT ref: 00007FF704AB5223

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF704AB674A
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF704AB6776

Strings

csm, xrefs: 00007FF704AB6876

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_recordabort
String ID: csm
API String ID: 2466640111-1018135373
Opcode ID: ef48871438151390fa300b301edbe87f2aaf35895cd4fd9de5e2d21b12dcaab2
Instruction ID: 8d30deeb4190ac7b0d3d59f55afd2957b0fab1e28f45d0f04fbf4c4be77e3bfc
Opcode Fuzzy Hash: ef48871438151390fa300b301edbe87f2aaf35895cd4fd9de5e2d21b12dcaab2
Instruction Fuzzy Hash: 40517FB2A1974187D620FF56E88166EB7A4FB88B94FA40134DF8D07B56CF38E450CB91

Function 00007FF704AC4360 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF704AC4446
WriteFile.KERNEL32 ref: 00007FF704AC4479
GetLastError.KERNEL32 ref: 00007FF704AC449B

Strings

U, xrefs: 00007FF704AC4424

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: ByteCharErrorFileLastMultiWideWrite
String ID: U
API String ID: 2456169464-4171548499
Opcode ID: a3c4996b5397ae7c68c43f4944c85cd830f0b958292ccb38960a62bfe152ddee
Instruction ID: a41be01b087a41160b1fb117b0e8a352696287257ae8524bc5d659b8308bf8d2
Opcode Fuzzy Hash: a3c4996b5397ae7c68c43f4944c85cd830f0b958292ccb38960a62bfe152ddee
Instruction Fuzzy Hash: B741F662718A8182EB60EF26E8947B9B7A0FF88794FA04131EE4D87784DF3CD441C764

Function 00007FF704AA90B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF704AA90D9
GetObjectW.GDI32 ref: 00007FF704AA9107
ReleaseDC.USER32 ref: 00007FF704AA91BB

Strings

, xrefs: 00007FF704AA9153

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: ObjectRelease
String ID:
API String ID: 1429681911-3916222277
Opcode ID: 0b5772d91688d342ea342be5c9c3c9ea07a5ad9e93d570546deb1a9808731c40
Instruction ID: 2ab566fde9d273155289a8116ec8a5271160af46def497490ed6a35934ee699e
Opcode Fuzzy Hash: 0b5772d91688d342ea342be5c9c3c9ea07a5ad9e93d570546deb1a9808731c40
Instruction Fuzzy Hash: 4731387560874286EA04EF13BC58A2BB7A0FB88FD5FA04435ED5A43B58CF3CE0498B14

Function 00007FF704A9E870 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,?,?,00007FF704AA317F,?,?,00001000,00007FF704A8E51D), ref: 00007FF704A9E8BB
CreateSemaphoreW.KERNEL32(?,?,?,00007FF704AA317F,?,?,00001000,00007FF704A8E51D), ref: 00007FF704A9E8CB
CreateEventW.KERNEL32(?,?,?,00007FF704AA317F,?,?,00001000,00007FF704A8E51D), ref: 00007FF704A9E8E4

Strings

Thread pool initialization failed., xrefs: 00007FF704A9E900

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 6610cce2f1ff4f40d78c24fcbab0d777ace7136147ab701da82aad1b7a389e44
Instruction ID: e29823250155962fed20db3bd3b3c9a6d073b7e01d2853abb11fdad22198ff19
Opcode Fuzzy Hash: 6610cce2f1ff4f40d78c24fcbab0d777ace7136147ab701da82aad1b7a389e44
Instruction Fuzzy Hash: 462108B2E1560186F750AF26DC84BAA72D1FF84B0CF688038CA0C0A285CF7E9845C7A4

Function 00007FF704AA85E0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF704AA85EC
GetDeviceCaps.GDI32 ref: 00007FF704AA85FD
ReleaseDC.USER32 ref: 00007FF704AA860A

Strings

, xrefs: 00007FF704AA8610

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: CapsDeviceRelease
String ID:
API String ID: 127614599-3916222277
Opcode ID: a42f7bf34e2550c06df92b4c4441a28b155cc5d7cfc3f2a0da00e80f490195b4
Instruction ID: d1b566b98b80a29ccd9dcb6e35f2c2d07bc992a7145a280ebf5d1707ef584c3c
Opcode Fuzzy Hash: a42f7bf34e2550c06df92b4c4441a28b155cc5d7cfc3f2a0da00e80f490195b4
Instruction Fuzzy Hash: 5CE08C60B0864182FF086FB7B9C982BA261AB4CBD0F658035DA2A4BB99DE3CC4844314

Function 00007FF704A8D1A8 Relevance: 6.2, APIs: 4, Instructions: 238timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNEL32 ref: 00007FF704A8D46C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A8D554
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A8D55A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A8D560

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$FileTime
String ID:
API String ID: 1137671866-0
Opcode ID: 64aef18ff04eab08c409baf29ab39efa604b42b32c66aa702a45212cf192b6b0
Instruction ID: f8c299709924b21cf8f7c9285a3a3ef89cc140b1bba7f4757e9828cbf57ad146
Opcode Fuzzy Hash: 64aef18ff04eab08c409baf29ab39efa604b42b32c66aa702a45212cf192b6b0
Instruction Fuzzy Hash: FCA1B5B2A1868291EA10EF66DC80AEDA371FF85784FE05536EA5D07AD9DF3CE544C310

Function 00007FF704AA0548 Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF704AA05FC
SetLastError.KERNEL32 ref: 00007FF704AA0697

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 24e2b0a7584a146235c26f2adfc6d280b44448a91f14294483c7ec998d7fea82
Instruction ID: 08a856690ebf2738685e02373ad9f817edd331591c1e690d3f400b18881bc684
Opcode Fuzzy Hash: 24e2b0a7584a146235c26f2adfc6d280b44448a91f14294483c7ec998d7fea82
Instruction Fuzzy Hash: 605193B2B14A4295FB00BF66DC846EC6321EF85B98FA04136DA1C57BD6EF2CD545C360

Function 00007FF704AA9D90 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF704AA9DBC
GetLastError.KERNEL32 ref: 00007FF704AA9E08
CreateDirectoryW.KERNEL32 ref: 00007FF704AA9F10
LocalFree.KERNEL32 ref: 00007FF704AA9F20

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: CreateCurrentDirectoryErrorFreeLastLocalProcess
String ID:
API String ID: 1077098981-0
Opcode ID: 91dec681af915968dd102d853b3eeeabd4842e789cbe2ad92d88e952f467e522
Instruction ID: 3fb3adc4f752e7bde8d0732f33936e1aae8707e22437c5ed1f18a86c221a8e8b
Opcode Fuzzy Hash: 91dec681af915968dd102d853b3eeeabd4842e789cbe2ad92d88e952f467e522
Instruction Fuzzy Hash: B55162B2618B4286FB50AF22E884B6EB364FF94B84FA01035EA4D57A58DF3CD514CB50

Function 00007FF704ABDB5C Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF704ABDBAF
WideCharToMultiByte.KERNEL32 ref: 00007FF704ABDC81
GetLastError.KERNEL32 ref: 00007FF704ABDCA4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF704ABDCD6

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: _invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 4141327611-0
Opcode ID: fdb879c7c344a6dcddabd48f24568e2f5e84c2dc3f6ceef9c32cec135b3ccbbf
Instruction ID: 3b2caaf9e9cf3012415f75a8634d4b2bacbf251830abd7f2a5d56dbaeddd9939
Opcode Fuzzy Hash: fdb879c7c344a6dcddabd48f24568e2f5e84c2dc3f6ceef9c32cec135b3ccbbf
Instruction Fuzzy Hash: E341B6B1A0C64246FB62BF2298C0779E290EF91B90FB44135DA4D47AD7DF7CD84187A0

Function 00007FF704A93980 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32 ref: 00007FF704A939BD
MoveFileW.KERNEL32 ref: 00007FF704A93A34
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A93AEB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A93AF1

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: FileMove_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3823481717-0
Opcode ID: 1e191b709e62ef26e60e8f1d0cc24d6cdbe4e9a67f5d62f6318cd10f240089dc
Instruction ID: 70e374a3389f5ebffea56bdbb1a2fca0fc9ead2ff00e0d3c02ebab17d1a22fbe
Opcode Fuzzy Hash: 1e191b709e62ef26e60e8f1d0cc24d6cdbe4e9a67f5d62f6318cd10f240089dc
Instruction Fuzzy Hash: FB41ADA2F14B5184FF00EFA6DC845AC6371BF48BA8BA05235DE5D26A99DF78D841C350

Function 00007FF704AC0B78 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF704ABC45B), ref: 00007FF704AC0B91
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF704ABC45B), ref: 00007FF704AC0BF3
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF704ABC45B), ref: 00007FF704AC0C2D
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF704ABC45B), ref: 00007FF704AC0C57

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 1557788787-0
Opcode ID: 23704c5f87cc5d65a6a85ab0da0438508b9fc27f2b888927c3d6011bf25654c1
Instruction ID: 911cb26e17fdd91ffd71a42721f91cde5201b5a878b96d1f24759163e5b04882
Opcode Fuzzy Hash: 23704c5f87cc5d65a6a85ab0da0438508b9fc27f2b888927c3d6011bf25654c1
Instruction Fuzzy Hash: 0F218061B1DB5181E6B4AF536880429E6A4FF94BD0BA84134DE9E63BA4DF3CE4528710

Function 00007FF704ABD440 Relevance: 6.0, APIs: 4, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF704AB7F28,?,?,?,00007FF704AB9D35), ref: 00007FF704ABD44A
SetLastError.KERNEL32(?,?,?,00007FF704AB7F28,?,?,?,00007FF704AB9D35), ref: 00007FF704ABD4B2
SetLastError.KERNEL32(?,?,?,00007FF704AB7F28,?,?,?,00007FF704AB9D35), ref: 00007FF704ABD4C8
abort.LIBCMT ref: 00007FF704ABD4CE

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: ErrorLast$abort
String ID:
API String ID: 1447195878-0
Opcode ID: df247b5a3948333368795c339682862bf84e23f7c025c70b8dad3e7beb060077
Instruction ID: 39d4288e858f06498f9585892ae6d60f2ef667c9a50980820fdf8acc4e939b24
Opcode Fuzzy Hash: df247b5a3948333368795c339682862bf84e23f7c025c70b8dad3e7beb060077
Instruction Fuzzy Hash: 7C018C90B0964242FA587F63AED5D3891A16F44790FB80538E92E47BD7EF2CB8044270

Function 00007FF704AA8590 Relevance: 6.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF704AA8598
GetDeviceCaps.GDI32 ref: 00007FF704AA85AE
GetDeviceCaps.GDI32 ref: 00007FF704AA85C2
ReleaseDC.USER32 ref: 00007FF704AA85D3

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: de15d0a72ac65e47349a1b4cc9ca260558533dfe27db70e7b1e031f833f09c6c
Instruction ID: 4d59f8753d97b2bce2f11039e4f6b95d073c7356039045225db16291e9d3b99c
Opcode Fuzzy Hash: de15d0a72ac65e47349a1b4cc9ca260558533dfe27db70e7b1e031f833f09c6c
Instruction Fuzzy Hash: 8FE0E5A4E0560242FF087F736CD993691509F48B45FA44439C82E46764DF3C90558624

Function 00007FF704A8E34C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 176COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A8E549

Strings

DXGIDebug.dll, xrefs: 00007FF704A8E35A

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: DXGIDebug.dll
API String ID: 3668304517-540382549
Opcode ID: fc0cef6792cd47313c4d8163d3b1aee0c93f55466201bdcbbf2781f388ab2540
Instruction ID: 6aff8dc982c3c5f5308707c36b5ff775fd50e184f860007b5274d0819c1a1505
Opcode Fuzzy Hash: fc0cef6792cd47313c4d8163d3b1aee0c93f55466201bdcbbf2781f388ab2540
Instruction Fuzzy Hash: ED71CFB2A14B8182EB14DF26E8847ADB3A4FF54794F904236DBAC07B95DF78D461C300

Function 00007FF704ABE1F4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF704ABE237

Strings

gfff, xrefs: 00007FF704ABE362
e+000, xrefs: 00007FF704ABE2DF

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: ffbcb58cc87a1110f60409a8afde5d08377aab6ce8cf060c3284a5669936e3c2
Instruction ID: 9d23a18c70272884cf283837fdfdb5af59dde0806529accb2be15dde1e6796c3
Opcode Fuzzy Hash: ffbcb58cc87a1110f60409a8afde5d08377aab6ce8cf060c3284a5669936e3c2
Instruction Fuzzy Hash: 58512EA2B187C146E7259F369C817AEAB91EF41B90F589231C69C47BD7CF2CD444C750

Function 00007FF704A99408 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF704A995A8: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF704A995E6

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A9959C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF704A995A2

Strings

SIZE, xrefs: 00007FF704A99443

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$swprintf
String ID: SIZE
API String ID: 449872665-3243624926
Opcode ID: e0bc738575b9dfc7518a9e38475377609f14f4f1dbbb3954c7928ccc9b577437
Instruction ID: f627d6aef16598206fde0cf202c3a26f12250ed544589a92dfd5f6a8dde678dd
Opcode Fuzzy Hash: e0bc738575b9dfc7518a9e38475377609f14f4f1dbbb3954c7928ccc9b577437
Instruction Fuzzy Hash: 8041E4E2A1864291EE50AF16DC81BBFA314EF89790FA04235EA9D067D6EF3CD544C710

Function 00007FF704ABC2C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF704ABC2EA
GetModuleFileNameA.KERNEL32(?,?,?,?,?,00007FF704AB2CD5), ref: 00007FF704ABC30B

Strings

C:\Users\user\Desktop\123.sfx.exe, xrefs: 00007FF704ABC2F9

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: FileModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\123.sfx.exe
API String ID: 3307058713-643797325
Opcode ID: 2b307fc7043d57580c2760bc14d10e66149d3294dbd6a1f00798eb6953a6f573
Instruction ID: 4a767daf38213837cccc08f0d1541382bdaa73b7e7ce762f88730d04302a7e86
Opcode Fuzzy Hash: 2b307fc7043d57580c2760bc14d10e66149d3294dbd6a1f00798eb6953a6f573
Instruction Fuzzy Hash: 984163F6A08B5286EB14BF27AC808B9F794EF44794BE44036E95D47B46DF3DE44183A0

Function 00007FF704AA9B40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF704A8255C: GetDlgItem.USER32 ref: 00007FF704A825AC
Part of subcall function 00007FF704A8255C: SetWindowTextW.USER32 ref: 00007FF704A825C8

EndDialog.USER32 ref: 00007FF704AA9C24
SetDlgItemTextW.USER32 ref: 00007FF704AA9CAA

Strings

ASKNEXTVOL, xrefs: 00007FF704AA9B72

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: df6f41e9741c0f8996d893104ea931d078e3acc76589f579c23b9fdb6368dbb8
Instruction ID: 3624eedc8e61d4e25549cec66275a632d3aba5e9fcc40a34bc7053085134e11e
Opcode Fuzzy Hash: df6f41e9741c0f8996d893104ea931d078e3acc76589f579c23b9fdb6368dbb8
Instruction Fuzzy Hash: B84194E2A08A4245FA10BF13DCD0ABAA395AF85BC4FB44436DE4D07795DF3DE45187A0

Function 00007FF704A99638 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF704A996EA

Part of subcall function 00007FF704AA0F68: WideCharToMultiByte.KERNEL32 ref: 00007FF704AA0F99

Strings

$%s, xrefs: 00007FF704A996D7
@%s, xrefs: 00007FF704A996CE

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: ByteCharMultiWide_snwprintf
String ID: $%s$@%s
API String ID: 2650857296-834177443
Opcode ID: 68d6d98aec82f67e7f26d78b4367655257a27e60e60eb814561ac576190adeba
Instruction ID: a7e3047e64f85a4181285fc08670c4bd20b9aeab3d53494afb0edf938272387a
Opcode Fuzzy Hash: 68d6d98aec82f67e7f26d78b4367655257a27e60e60eb814561ac576190adeba
Instruction Fuzzy Hash: E831E4F2B19A4695EA50AF67DC80AEAA3A4FF44784FA01036DE0D07795EF3CE905C750

Function 00007FF704ABEB04 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF704ABEB76
GetFileType.KERNEL32 ref: 00007FF704ABEB8C

Strings

@, xrefs: 00007FF704ABEBB7

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: FileHandleType
String ID: @
API String ID: 3000768030-2766056989
Opcode ID: 01c4e23626c5bd34e0d32a71787dfe5976e9b76bf070a7e2fa99837352baeece
Instruction ID: 94de1f2ad3a58703fbc759931321cf5aff289428f0e829d3b26e328c3038b616
Opcode Fuzzy Hash: 01c4e23626c5bd34e0d32a71787dfe5976e9b76bf070a7e2fa99837352baeece
Instruction Fuzzy Hash: 9B21E5A2A0868240EB60AF269CD057AA650EF55774F788339D66F077E5CF3CD881C3A0

Function 00007FF704AB4078 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF704AB1D3E), ref: 00007FF704AB40BC
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF704AB1D3E), ref: 00007FF704AB4102

Strings

csm, xrefs: 00007FF704AB40EF

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 995ce70781ed1107fbe35a2df86b6ab92d82f2488d4e31342cdb9a65d606da21
Instruction ID: 938b0b878056dc9ad7706090b7c0c427653a2dcfa38379f8f318888e8d52f50e
Opcode Fuzzy Hash: 995ce70781ed1107fbe35a2df86b6ab92d82f2488d4e31342cdb9a65d606da21
Instruction Fuzzy Hash: 5C115B72608B4182EB609F16E880669B7A0FB88B84F684234DE8D0775ADF3DC561C740

Function 00007FF704A9EA5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,00007FF704A9E95F,?,?,?,00007FF704A9463A,?,?,?), ref: 00007FF704A9EA63
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF704A9E95F,?,?,?,00007FF704A9463A,?,?,?), ref: 00007FF704A9EA6E

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00007FF704A9EA78

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: ErrorLastObjectSingleWait
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1211598281-2248577382
Opcode ID: 98ce5a6e9b01a49333d4d7b683bb298ff4a8e953ba0927a3bf2f7aa8eb90df55
Instruction ID: 556030fdddf61c0bfa91a798dd90b2100c7b22c30820689bd9e3f6fc0390f806
Opcode Fuzzy Hash: 98ce5a6e9b01a49333d4d7b683bb298ff4a8e953ba0927a3bf2f7aa8eb90df55
Instruction Fuzzy Hash: C9E0E5A1E1981281F660BF239CC6869A250BF65765FF00330D13E416E19F2CA94A8220

Function 00007FF704A9A43C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF704A9A447
FindResourceW.KERNEL32 ref: 00007FF704A9A45D

Strings

RTL, xrefs: 00007FF704A9A453

Memory Dump Source

Source File: 00000000.00000002.2123376648.00007FF704A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF704A80000, based on PE: true

Associated: 00000000.00000002.2123328572.00007FF704A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123415808.00007FF704AC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704ADB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123477497.00007FF704AE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2123597919.00007FF704AEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff704a80000_123.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: e39cf6139d6c3c808756c827088780cb49cd2dd94430b396554b51375d39015a
Instruction ID: 08f9ce29f3b45911242ae74438b3820994e0f1276a619e929e3da3bcbe3fe5db
Opcode Fuzzy Hash: e39cf6139d6c3c808756c827088780cb49cd2dd94430b396554b51375d39015a
Instruction Fuzzy Hash: 2FD017D1F0A64282FF696F62AC89B7562906F18B42FA84039C84E06390EF2D9488C760

Analysis Process: 123.exePID: 652, Parent PID: 6476COMMON

Execution Graph

Execution Coverage:	12.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	12.9%
Total number of Nodes:	1337
Total number of Limit Nodes:	16

Executed Functions

Function 00403552 Relevance: 81.0, APIs: 33, Strings: 13, Instructions: 464
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 00403575
GetVersionExW.KERNEL32(?,?,?,?,?,?,?,?), ref: 004035A0
GetVersionExW.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 004035B3
lstrlenA.KERNEL32(UXTHEME,UXTHEME,?,?,?,?,?,?,?,?), ref: 0040364C
#17.COMCTL32(?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403689
OleInitialize.OLE32(00000000), ref: 00403690
SHGetFileInfoW.SHELL32(0042AA28,00000000,?,000002B4,00000000), ref: 004036AF
GetCommandLineW.KERNEL32(00433700,NSIS Error,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 004036C4
CharNextW.USER32(00000000,0043F000,00000020,0043F000,00000000,?,00000008,0000000A,0000000C), ref: 004036FD
GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00008001,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403835
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403846
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403852
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403866
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040386E
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040387F
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403887
DeleteFileW.KERNELBASE(1033,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040389B
lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0043F000,00000000,?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403974

Part of subcall function 00406577: lstrcpynW.KERNEL32(?,?,00000400,004036C4,00433700,NSIS Error,?,00000008,0000000A,0000000C), ref: 00406584

wsprintfW.USER32 ref: 004039D1
GetFileAttributesW.KERNEL32(00437800,C:\Users\user\AppData\Local\Temp\), ref: 00403A04
DeleteFileW.KERNEL32(00437800), ref: 00403A10
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 00403A3E

Part of subcall function 00406337: MoveFileExW.KERNEL32(?,?,00000005,00405E35,?,00000000,000000F1,?,?,?,?,?), ref: 00406341

CopyFileW.KERNEL32(00442800,00437800,00000001,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00403A54

Part of subcall function 00405B5A: CreateProcessW.KERNELBASE(00000000,00437800,00000000,00000000,00000000,04000000,00000000,00000000,0042FA70,?,?,?,00437800,?), ref: 00405B83
Part of subcall function 00405B5A: CloseHandle.KERNEL32(?,?,?,00437800,?), ref: 00405B90

Part of subcall function 004068D4: FindFirstFileW.KERNEL32(75923420,0042FAB8,0042F270,00405F97,0042F270,0042F270,00000000,0042F270,0042F270,75923420,?,C:\Users\user\AppData\Local\Temp\,00405CA3,?,75923420,C:\Users\user\AppData\Local\Temp\), ref: 004068DF
Part of subcall function 004068D4: FindClose.KERNEL32(00000000), ref: 004068EB

ExitProcess.KERNEL32(?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403A9D
CoUninitialize.COMBASE(?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403AA2
ExitProcess.KERNEL32 ref: 00403ABF
CloseHandle.KERNEL32(00000000,00438000,00438000,?,00437800,00000000), ref: 00403AC6
GetCurrentProcess.KERNEL32(00000028,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403AE2
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?), ref: 00403AE9
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403AFE
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00403B21
ExitWindowsEx.USER32(00000002,80040002), ref: 00403B46
ExitProcess.KERNEL32 ref: 00403B69

Part of subcall function 00405B25: CreateDirectoryW.KERNELBASE(?,00000000,00403545,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 00405B2B

Strings

~nsu%X.tmp, xrefs: 004039C8
UXTHEME, xrefs: 00403640, 00403645, 0040364B
C:\Users\user\AppData\Local\Temp\, xrefs: 0040382A, 0040382F, 00403845, 00403851, 00403860, 0040386D, 00403879, 00403881, 0040396F, 004039F0, 00403A1C, 00403A3D, 00403A46
Low, xrefs: 00403868
NSIS Error, xrefs: 004036B5
SeShutdownPrivilege, xrefs: 00403AF8
1033, xrefs: 00403896
TEMP, xrefs: 0040387A
C:\users\public, xrefs: 00403992
C:\Users\user\AppData\Roaming\RDBNT, xrefs: 00403947
Error launching installer, xrefs: 0040391D
\Temp, xrefs: 0040384C
TMP, xrefs: 00403882

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: File$Process$Exit$CloseDirectory$CreateCurrentDeleteEnvironmentFindHandlePathTempTokenVariableVersionWindowslstrcatlstrlen$AdjustAttributesCharCommandCopyErrorFirstInfoInitializeLineLookupModeMoveNextOpenPrivilegePrivilegesUninitializeValuelstrcpynwsprintf
String ID: 1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\RDBNT$C:\users\public$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu%X.tmp
API String ID: 2017177436-1870024364
Opcode ID: 04707b10a4b3afb6a18ca337361403f50cb556bbdd5965bfbe7ebc29a3518fa6
Instruction ID: 854c728f01c0035939758d15b123b9002cb8995d15bf2fdbd915a0a46deb4321
Opcode Fuzzy Hash: 04707b10a4b3afb6a18ca337361403f50cb556bbdd5965bfbe7ebc29a3518fa6
Instruction Fuzzy Hash: 6DF1F470604301ABD320AF659D05B6B7EE8EB8570AF10483FF581B22D1DB7DDA458B6E

Function 00403C49 Relevance: 42.2, APIs: 13, Strings: 11, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040696B: GetModuleHandleA.KERNEL32(?,00000020,?,00403662,0000000C,?,?,?,?,?,?,?,?), ref: 0040697D
Part of subcall function 0040696B: GetProcAddress.KERNEL32(00000000,?), ref: 00406998

lstrcatW.KERNEL32(1033,0042CA68,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042CA68,00000000,00000002,75923420,C:\Users\user\AppData\Local\Temp\,00000000,0043F000,00008001), ref: 00403CCA
lstrlenW.KERNEL32("C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe" -Duser.language=en -Duser.country=US -Dfile.encoding=UTF-8 -classpath "l,?,?,?,"C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe" -Duser.language=en -Duser.country=US -Dfile.encoding=UTF-8 -classpath "l,00000000,0043F800,1033,0042CA68,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042CA68,00000000,00000002,75923420), ref: 00403D4A
lstrcmpiW.KERNEL32(?,.exe,"C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe" -Duser.language=en -Duser.country=US -Dfile.encoding=UTF-8 -classpath "l,?,?,?,"C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe" -Duser.language=en -Duser.country=US -Dfile.encoding=UTF-8 -classpath "l,00000000,0043F800,1033,0042CA68,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042CA68,00000000), ref: 00403D5D
GetFileAttributesW.KERNEL32("C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe" -Duser.language=en -Duser.country=US -Dfile.encoding=UTF-8 -classpath "l), ref: 00403D68
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,0043F800), ref: 00403DB1

Part of subcall function 004064BE: wsprintfW.USER32 ref: 004064CB

RegisterClassW.USER32(004336A0), ref: 00403DEE
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403E06
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403E3B
ShowWindow.USER32(00000005,00000000), ref: 00403E71
GetClassInfoW.USER32(00000000,RichEdit20W,004336A0), ref: 00403E9D
GetClassInfoW.USER32(00000000,RichEdit,004336A0), ref: 00403EAA
RegisterClassW.USER32(004336A0), ref: 00403EB3
DialogBoxParamW.USER32(?,00000000,00403FF7,00000000), ref: 00403ED2

Strings

1033, xrefs: 00403C69, 00403CC5
"C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe" -Duser.language=en -Duser.country=US -Dfile.encoding=UTF-8 -classpath "l, xrefs: 00403D11, 00403D1A, 00403D28, 00403D77, 00403D7D
.DEFAULT\Control Panel\International, xrefs: 00403CB5
.exe, xrefs: 00403D57
_Nb, xrefs: 00403DCD, 00403E35
RichEdit20W, xrefs: 00403E95, 00403E9B
RichEd20, xrefs: 00403E77
RichEd32, xrefs: 00403E85
RichEdit, xrefs: 00403EA4
C:\Users\user\AppData\Local\Temp\, xrefs: 00403C4E
Control Panel\Desktop\ResourceLocale, xrefs: 00403C7D

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe" -Duser.language=en -Duser.country=US -Dfile.encoding=UTF-8 -classpath "l$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-311948475
Opcode ID: a4b6b062c3cda51b96eb3e1e848ea22fea792b1bb39582dd55e536ebb93ad2e9
Instruction ID: c722afd28cb3ad108a11d8546cd61d6ece1c23d3a169ae69e987cf65e7f86a01
Opcode Fuzzy Hash: a4b6b062c3cda51b96eb3e1e848ea22fea792b1bb39582dd55e536ebb93ad2e9
Instruction Fuzzy Hash: 7961C370500700BED620AF66AD46F2B3A6CEB85B5AF40053FF945B22E2DB7C5941CA6D

Function 004030A2 Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 181
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004030B3
GetModuleFileNameW.KERNEL32(00000000,00442800,00000400), ref: 004030CF

Part of subcall function 00406067: GetFileAttributesW.KERNELBASE(00000003,004030E2,00442800,80000000,00000003), ref: 0040606B
Part of subcall function 00406067: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040608D

GetFileSize.KERNEL32(00000000,00000000,00443000,00000000,C:\users\public,C:\users\public,00442800,00442800,80000000,00000003), ref: 0040311B
GlobalAlloc.KERNELBASE(00000040,?), ref: 00403251

Strings

soft, xrefs: 00403190
Inst, xrefs: 00403187
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403278
C:\users\public, xrefs: 004030FD, 00403102, 00403108
Null, xrefs: 00403199
C:\Users\user\AppData\Local\Temp\, xrefs: 004030A9
Error launching installer, xrefs: 004030F2

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: C:\Users\user\AppData\Local\Temp\$C:\users\public$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-1304443319
Opcode ID: 18071a83ec6fb142dc69507f2a99f9a57da6e94b99e66eca773901507235fdac
Instruction ID: 55eb758a8cc994b5b8f5e8324c308f37a69edd03a8198e206d37cac48cd63750
Opcode Fuzzy Hash: 18071a83ec6fb142dc69507f2a99f9a57da6e94b99e66eca773901507235fdac
Instruction Fuzzy Hash: E9519171900204AFDB209FA5DD86B9E7EACEB09356F20417BF504B62D1C7789F408BAD

Function 004065B4 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 204
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32("C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe" -Duser.language=en -Duser.country=US -Dfile.encoding=UTF-8 -classpath "l,00000400), ref: 004066D6
GetWindowsDirectoryW.KERNEL32("C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe" -Duser.language=en -Duser.country=US -Dfile.encoding=UTF-8 -classpath "l,00000400,00000000,0042BA48,?,?,00000000,00000000,?,759223A0), ref: 004066EC
SHGetPathFromIDListW.SHELL32(00000000,"C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe" -Duser.language=en -Duser.country=US -Dfile.encoding=UTF-8 -classpath "l), ref: 0040674A
CoTaskMemFree.OLE32(00000000,?,00000000,00000007), ref: 00406753
lstrcatW.KERNEL32("C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe" -Duser.language=en -Duser.country=US -Dfile.encoding=UTF-8 -classpath "l,\Microsoft\Internet Explorer\Quick Launch,00000000,0042BA48,?,?,00000000,00000000,?,759223A0), ref: 0040677E
lstrlenW.KERNEL32("C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe" -Duser.language=en -Duser.country=US -Dfile.encoding=UTF-8 -classpath "l,00000000,0042BA48,?,?,00000000,00000000,?,759223A0), ref: 004067D8

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 004066A7
"C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe" -Duser.language=en -Duser.country=US -Dfile.encoding=UTF-8 -classpath "l, xrefs: 004065E1, 0040669B, 004066A2, 004066A6, 004066BF, 004066C0, 004066D5, 004066EB, 0040671C, 00406748, 0040677D, 00406783, 004067A0, 004067B3, 004067D1, 004067D7, 004067E0, 00406815
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406778

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: Directory$FreeFromListPathSystemTaskWindowslstrcatlstrlen
String ID: "C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe" -Duser.language=en -Duser.country=US -Dfile.encoding=UTF-8 -classpath "l$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 4024019347-1751192266
Opcode ID: 2066e1c471d7490a15c1c198898eb18b068b97d6eda6cad4e7272ae8e9db0920
Instruction ID: fc4c1bf1ff31ba1b34cdfc75387d7881e57296f2874843d1a5ebc397bafcf832
Opcode Fuzzy Hash: 2066e1c471d7490a15c1c198898eb18b068b97d6eda6cad4e7272ae8e9db0920
Instruction Fuzzy Hash: D16135716042009BD720AF24DD80B6B76E8EF85328F12453FF647B32D0DB7D9961865E

Function 004032D9 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403343
GetTickCount.KERNEL32 ref: 004033EA
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 00403413
wsprintfW.USER32 ref: 00403426

Strings

A, xrefs: 00403399
A, xrefs: 004034A3
... %d%%, xrefs: 00403420
*B, xrefs: 00403304

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: *B$ A$ A$... %d%%
API String ID: 551687249-3485722521
Opcode ID: 6d935c58c9c1f66a15f185bc6e4e505f3dabe6c18ce33db7fed369594a7e0453
Instruction ID: 3a086bfa1ae904988031f2e91e2ff9394e13111a018eeb379290de00703e2b75
Opcode Fuzzy Hash: 6d935c58c9c1f66a15f185bc6e4e505f3dabe6c18ce33db7fed369594a7e0453
Instruction Fuzzy Hash: 2F519F71900219DBCB11DF65DA44B9E7FB8AF44766F10413BE810BB2D1C7789A40CBA9

Function 00401794 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,"C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe" -Duser.language=en -Duser.country=US -Dfile.encoding=UTF-8 -classpath "l,C:\Users\user\AppData\Roaming\RDBNT,?,?,00000031), ref: 004017D5
CompareFileTime.KERNEL32(-00000014,?,"C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe" -Duser.language=en -Duser.country=US -Dfile.encoding=UTF-8 -classpath "l,"C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe" -Duser.language=en -Duser.country=US -Dfile.encoding=UTF-8 -classpath "l,00000000,00000000,"C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe" -Duser.language=en -Duser.country=US -Dfile.encoding=UTF-8 -classpath "l,C:\Users\user\AppData\Roaming\RDBNT,?,?,00000031), ref: 004017FA

Part of subcall function 00406577: lstrcpynW.KERNEL32(?,?,00000400,004036C4,00433700,NSIS Error,?,00000008,0000000A,0000000C), ref: 00406584

Part of subcall function 004055FC: lstrlenW.KERNEL32(0042BA48,00000000,?,759223A0,?,?,?,?,?,?,?,?,?,0040343D,00000000,?), ref: 00405634
Part of subcall function 004055FC: lstrlenW.KERNEL32(0040343D,0042BA48,00000000,?,759223A0,?,?,?,?,?,?,?,?,?,0040343D,00000000), ref: 00405644
Part of subcall function 004055FC: lstrcatW.KERNEL32(0042BA48,0040343D,0040343D,0042BA48,00000000,?,759223A0), ref: 00405657
Part of subcall function 004055FC: SetWindowTextW.USER32(0042BA48,0042BA48), ref: 00405669
Part of subcall function 004055FC: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040568F
Part of subcall function 004055FC: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004056A9
Part of subcall function 004055FC: SendMessageW.USER32(?,00001013,?,00000000), ref: 004056B7

Strings

"C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe" -Duser.language=en -Duser.country=US -Dfile.encoding=UTF-8 -classpath "l, xrefs: 004017B2, 004017BB, 004017C8, 004017DA, 004017E6, 0040181C, 00401832, 00401850, 0040188C, 0040190D, 00401916, 00401920, 0040192B
C:\Users\user\AppData\Roaming\RDBNT, xrefs: 0040185A, 00401876
C:\Users\user\AppData\Roaming\RDBNT, xrefs: 004017C3

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: "C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe" -Duser.language=en -Duser.country=US -Dfile.encoding=UTF-8 -classpath "l$C:\Users\user\AppData\Roaming\RDBNT$C:\Users\user\AppData\Roaming\RDBNT
API String ID: 1941528284-1169163433
Opcode ID: a58ea0222ac98990420b303d55ec3153f41b92666d08849931790dc50ba9057a
Instruction ID: 896c0c78208a39cbb5dd39340d0745d1a2bf2ace5f7797069eceb710e9101d93
Opcode Fuzzy Hash: a58ea0222ac98990420b303d55ec3153f41b92666d08849931790dc50ba9057a
Instruction Fuzzy Hash: 4C41B671900108BACB117BB5DD85DBE7AB9EF45328F21423FF412B10E2D73C8A919A2D

Function 004068FB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406912
wsprintfW.USER32 ref: 0040694D
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406961

Strings

%s%S.dll, xrefs: 00406947
UXTHEME, xrefs: 00406904

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME
API String ID: 2200240437-1106614640
Opcode ID: 7a73cbb44207cafadb11ab8eaaa41fd963bfa172cfc882b2dd9c54e233860d96
Instruction ID: 6d7bab0cfc2d48cbbbe6bb2f91b005b1c0391479526b60628745523d5c0137a7
Opcode Fuzzy Hash: 7a73cbb44207cafadb11ab8eaaa41fd963bfa172cfc882b2dd9c54e233860d96
Instruction Fuzzy Hash: 66F02B71501129A7CF10AB68DD0EF9F376CAB00304F10447AA646F10E0EB7CDB69CB98

Function 00406096 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004060B4
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,00403550,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C), ref: 004060CF

Strings

nsa, xrefs: 004060A3
C:\Users\user\AppData\Local\Temp\, xrefs: 0040609B

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-44229769
Opcode ID: 017de5c5da22b1c6cf72d7a8a287ef2c48f88e3ac937424cf3c6df762bd8e462
Instruction ID: 0f0e971a11aa9000600537ad3b21051f2e76e4828209a3ca974843c19b3e0847
Opcode Fuzzy Hash: 017de5c5da22b1c6cf72d7a8a287ef2c48f88e3ac937424cf3c6df762bd8e462
Instruction Fuzzy Hash: B5F09076B40204BBEB00CF69ED05F9EB7ACEBA5750F11803AE901F7180E6B099648768

Function 004015E6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405EF1: CharNextW.USER32(?,?,0042F270,?,00405F65,0042F270,0042F270,75923420,?,C:\Users\user\AppData\Local\Temp\,00405CA3,?,75923420,C:\Users\user\AppData\Local\Temp\,0043F000), ref: 00405EFF
Part of subcall function 00405EF1: CharNextW.USER32(00000000), ref: 00405F04
Part of subcall function 00405EF1: CharNextW.USER32(00000000), ref: 00405F1C

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040163F

Part of subcall function 00405ACB: CreateDirectoryW.KERNEL32(00437800,?), ref: 00405B0D

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Roaming\RDBNT,?,00000000,000000F0), ref: 00401672

Strings

C:\Users\user\AppData\Roaming\RDBNT, xrefs: 00401665

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Roaming\RDBNT
API String ID: 1892508949-2153498286
Opcode ID: 8b23014e874117772ebc9062bae1ca4a158d3493fb016c70d1ca52ef0131588f
Instruction ID: 104414052cab316a424bfe0d2ff1de268c148956b102069c6a2fab9df067ebf3
Opcode Fuzzy Hash: 8b23014e874117772ebc9062bae1ca4a158d3493fb016c70d1ca52ef0131588f
Instruction Fuzzy Hash: 0911BE31804514ABCF206FA5CD01AAE36B0EF14368B25493BE941B22F1C63A4A41DA5D

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(0040A2D8,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: a48e27458ca857e7bf1c95edfaa4f4fc3f64b4f364872359a8149092e2b898a4
Instruction ID: 0adee223d2b7ba7d815a442a2885e1f2b60e3b86eb1a18037e9b6c54a102055c
Opcode Fuzzy Hash: a48e27458ca857e7bf1c95edfaa4f4fc3f64b4f364872359a8149092e2b898a4
Instruction Fuzzy Hash: 0E01FF31620220AFE7195B389E05B6B3698E710329F10863FF851F62F1EA78DC429B4C

Function 00405B5A Relevance: 3.0, APIs: 2, Instructions: 24
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(00000000,00437800,00000000,00000000,00000000,04000000,00000000,00000000,0042FA70,?,?,?,00437800,?), ref: 00405B83
CloseHandle.KERNEL32(?,?,?,00437800,?), ref: 00405B90

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-0
Opcode ID: 6fd2602221babf1a8a9a6246b82f99e4ae13039f11edd6951af80fecf8f79ee2
Instruction ID: 1d4bd4e17b1592c090cadeee614c80d4297d43de2f88d62204b9ca700bb873e4
Opcode Fuzzy Hash: 6fd2602221babf1a8a9a6246b82f99e4ae13039f11edd6951af80fecf8f79ee2
Instruction Fuzzy Hash: C9E09AB4600219BFFB109B64AD06F7B767CE704604F408475BD15E6151D774A8158A78

Function 0040696B Relevance: 3.0, APIs: 2, Instructions: 22
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,00403662,0000000C,?,?,?,?,?,?,?,?), ref: 0040697D
GetProcAddress.KERNEL32(00000000,?), ref: 00406998

Part of subcall function 004068FB: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406912
Part of subcall function 004068FB: wsprintfW.USER32 ref: 0040694D
Part of subcall function 004068FB: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406961

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 38b25401b771ecf209a524bd0999a173af8b0ad39984603ae0a2953bb283c85e
Instruction ID: f16a4ad3e9102b165210d3f50f6adbe363033f5fe81171ed8a06a41b6d2757eb
Opcode Fuzzy Hash: 38b25401b771ecf209a524bd0999a173af8b0ad39984603ae0a2953bb283c85e
Instruction Fuzzy Hash: F1E08673504311AAD6105B759D0492772E89F89750302443EF986F2140DB38EC32A6AE

Function 00406067 Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(00000003,004030E2,00442800,80000000,00000003), ref: 0040606B
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040608D

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 6be4d53c09d0ea7202590e2ef391dde9d68f005235e9a58d36352f422cb06a2c
Instruction ID: 9d50a09f5748d4f60ef03139cc16a9656d1073ae209d3065c053d14625e31d4c
Opcode Fuzzy Hash: 6be4d53c09d0ea7202590e2ef391dde9d68f005235e9a58d36352f422cb06a2c
Instruction Fuzzy Hash: 87D09E31654301AFEF098F20DE16F2EBAA2EB84B00F11552CB682941E0DA715819DB15

Function 00406042 Relevance: 3.0, APIs: 2, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(?,?,00405C47,?,?,00000000,00405E1D,?,?,?,?), ref: 00406047
SetFileAttributesW.KERNEL32(?,00000000), ref: 0040605B

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: bc30e5c928ed30f9cb3e730bb3a024ff28878b527ec9bdb2640fa07c227b463d
Instruction ID: a0ae240d833e004fe72580c92a9f2193965d94811d262e1a0a63bc04ff00b3bc
Opcode Fuzzy Hash: bc30e5c928ed30f9cb3e730bb3a024ff28878b527ec9bdb2640fa07c227b463d
Instruction Fuzzy Hash: 7ED0C972504220AFC2102728AE0889BBB55DB542717028A35F8A9A22B0CB304CA68694

Function 00405B25 Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403545,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 00405B2B
GetLastError.KERNEL32(?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00405B39

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 7ce514c051633c67dabed91c1ba2c830ad6f4192d7236d4c27a26ed09d9cb01d
Instruction ID: 2532c664264170c07cbc731aa09703a23e3881c092aaf3b019fc47175ec23a7b
Opcode Fuzzy Hash: 7ce514c051633c67dabed91c1ba2c830ad6f4192d7236d4c27a26ed09d9cb01d
Instruction Fuzzy Hash: 98C04C70604906DAD7505F219F087177960AB50741F158439A6C7F40A0DA74A455D92D

Function 00406119 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,004034BD,00000000,0041EA20,000000FF,0041EA20,000000FF,000000FF,00000004,00000000), ref: 0040612D

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 4494c28c6fc58b77f7b94402ffbb10e79d92760fb9961e7d9dbcb201027e3d13
Instruction ID: 5447fabf40714e60d37a3b8d529c829a5aab84dab7567664cea5a9789522ebfd
Opcode Fuzzy Hash: 4494c28c6fc58b77f7b94402ffbb10e79d92760fb9961e7d9dbcb201027e3d13
Instruction Fuzzy Hash: DFE08C3221021ABBDF109E518C00EEB3B6CEB003A0F014432FD26E7050D630E86097A4

Function 004060EA Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,00403507,00000000,00000000,0040332B,000000FF,00000004,00000000,00000000,00000000), ref: 004060FE

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 076a4193e787d8b2f8fcded04b516b0b1a94860d7d4352c54bed072072f3bbd3
Instruction ID: 2902185137110ca2ffdb2282e3c832ce644deeff7f1201e2b4f2572205eed693
Opcode Fuzzy Hash: 076a4193e787d8b2f8fcded04b516b0b1a94860d7d4352c54bed072072f3bbd3
Instruction Fuzzy Hash: D0E08C3221021AABCF109E508C01EEB3BACFF043A0F014432FD12EB042D230E9229BA4

Function 0040350A Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403267,?), ref: 00403518

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 9851be0de28bb9513f6e500a0df6ea838ed72b99fd7baa621d8f85bec57c8f40
Instruction ID: 1f5c7ae16c2334422adcad36111bde95194575cbdac9b1f52e29a9f6e91cc98e
Opcode Fuzzy Hash: 9851be0de28bb9513f6e500a0df6ea838ed72b99fd7baa621d8f85bec57c8f40
Instruction Fuzzy Hash: 34B01271240300BFDA214F00DF09F057B21ABA0700F10C034B388380F086711035EB0D

Function 00401FC9 Relevance: 1.3, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 004055FC: lstrlenW.KERNEL32(0042BA48,00000000,?,759223A0,?,?,?,?,?,?,?,?,?,0040343D,00000000,?), ref: 00405634
Part of subcall function 004055FC: lstrlenW.KERNEL32(0040343D,0042BA48,00000000,?,759223A0,?,?,?,?,?,?,?,?,?,0040343D,00000000), ref: 00405644
Part of subcall function 004055FC: lstrcatW.KERNEL32(0042BA48,0040343D,0040343D,0042BA48,00000000,?,759223A0), ref: 00405657
Part of subcall function 004055FC: SetWindowTextW.USER32(0042BA48,0042BA48), ref: 00405669
Part of subcall function 004055FC: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040568F
Part of subcall function 004055FC: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004056A9
Part of subcall function 004055FC: SendMessageW.USER32(?,00001013,?,00000000), ref: 004056B7

Part of subcall function 00405B5A: CreateProcessW.KERNELBASE(00000000,00437800,00000000,00000000,00000000,04000000,00000000,00000000,0042FA70,?,?,?,00437800,?), ref: 00405B83
Part of subcall function 00405B5A: CloseHandle.KERNEL32(?,?,?,00437800,?), ref: 00405B90

CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00402010

Part of subcall function 00406A16: WaitForSingleObject.KERNEL32(?,00000064), ref: 00406A27
Part of subcall function 00406A16: GetExitCodeProcess.KERNEL32(?,?), ref: 00406A49

Part of subcall function 004064BE: wsprintfW.USER32 ref: 004064CB

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 2972824698-0
Opcode ID: 6cbd08055d6f438539874c7bc34098d0ff44dcb21f28870e7b48abad10dfc107
Instruction ID: 3bd5da99d2ff211530604a8704e688701187be5a7f5114c752edafe9c60b233e
Opcode Fuzzy Hash: 6cbd08055d6f438539874c7bc34098d0ff44dcb21f28870e7b48abad10dfc107
Instruction Fuzzy Hash: 82F0F6329041119BDB20BBA18A895DE76A4CF00318F21803FE202B21C6CBBC4D41AB6E

Function 00403B6F Relevance: 1.3, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00403AA2,?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403B7A

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 3a0e7e5e5cdf62e96be2142a5155a3d8c657aa15ddb96e9066be89a7fa45203e
Instruction ID: 1b7086e6f2e4317af50c710f47857d00c701bc700238930339e1f9ec47f16c49
Opcode Fuzzy Hash: 3a0e7e5e5cdf62e96be2142a5155a3d8c657aa15ddb96e9066be89a7fa45203e
Instruction Fuzzy Hash: 38C0223010070086F0202F389E0FA183A24670073DBA08329B0B8F00F3CF7C164C841D

Non-executed Functions

Function 0040573B Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405799
GetDlgItem.USER32(?,000003EE), ref: 004057A8
GetClientRect.USER32(?,?), ref: 004057E5
GetSystemMetrics.USER32(00000002), ref: 004057EC
SendMessageW.USER32(?,00001061,00000000,?), ref: 0040580D
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 0040581E
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405831
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 0040583F
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405852
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405874
ShowWindow.USER32(?,00000008), ref: 00405888
GetDlgItem.USER32(?,000003EC), ref: 004058A9
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 004058B9
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004058D2
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004058DE
GetDlgItem.USER32(?,000003F8), ref: 004057B7

Part of subcall function 0040452B: SendMessageW.USER32(00000028,?,00000001,00404356), ref: 00404539

GetDlgItem.USER32(?,000003EC), ref: 004058FB
CreateThread.KERNEL32(00000000,00000000,Function_000056CF,00000000), ref: 00405909
CloseHandle.KERNEL32(00000000), ref: 00405910
ShowWindow.USER32(00000000), ref: 00405934
ShowWindow.USER32(?,00000008), ref: 00405939
ShowWindow.USER32(00000008), ref: 00405983
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004059B7
CreatePopupMenu.USER32 ref: 004059C8
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004059DC
GetWindowRect.USER32(?,?), ref: 004059FC
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405A15
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405A4D
OpenClipboard.USER32(00000000), ref: 00405A5D
EmptyClipboard.USER32 ref: 00405A63
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405A6F
GlobalLock.KERNEL32(00000000), ref: 00405A79
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405A8D
GlobalUnlock.KERNEL32(00000000), ref: 00405AAD
SetClipboardData.USER32(0000000D,00000000), ref: 00405AB8
CloseClipboard.USER32 ref: 00405ABE

Strings

{, xrefs: 004059A1

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: dfead9bfc37cf3db2b35e915a87c725964709008a4f247d6999fb4be6a1ac7a0
Instruction ID: d3b07f9c2581fb6b60ef1a2666babd9f8dcdaaa8066b0d43d813b8afd8e95190
Opcode Fuzzy Hash: dfead9bfc37cf3db2b35e915a87c725964709008a4f247d6999fb4be6a1ac7a0
Instruction Fuzzy Hash: 03B159B0900608FFDF11AF60DD89AAE7B79FB48355F00813AFA45BA1A0C7785A51DF58

Function 004049E7 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404A36
SetWindowTextW.USER32(00000000,?), ref: 00404A60
SHBrowseForFolderW.SHELL32(?), ref: 00404B11
CoTaskMemFree.OLE32(00000000), ref: 00404B1C
lstrcmpiW.KERNEL32("C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe" -Duser.language=en -Duser.country=US -Dfile.encoding=UTF-8 -classpath "l,0042CA68,00000000,?,?), ref: 00404B4E
lstrcatW.KERNEL32(?,"C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe" -Duser.language=en -Duser.country=US -Dfile.encoding=UTF-8 -classpath "l), ref: 00404B5A
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404B6C

Part of subcall function 00405BBB: GetDlgItemTextW.USER32(?,?,00000400,00404BA3), ref: 00405BCE

Part of subcall function 00406825: CharNextW.USER32(?,*?|<>/":,00000000,0043F000,75923420,C:\Users\user\AppData\Local\Temp\,00000000,0040352D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 00406888
Part of subcall function 00406825: CharNextW.USER32(?,?,?,00000000,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00406897
Part of subcall function 00406825: CharNextW.USER32(?,0043F000,75923420,C:\Users\user\AppData\Local\Temp\,00000000,0040352D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 0040689C
Part of subcall function 00406825: CharPrevW.USER32(?,?,75923420,C:\Users\user\AppData\Local\Temp\,00000000,0040352D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 004068AF

GetDiskFreeSpaceW.KERNEL32(0042AA38,?,?,0000040F,?,0042AA38,0042AA38,?,00000001,0042AA38,?,?,000003FB,?), ref: 00404C2F
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404C4A

Part of subcall function 00404DA3: lstrlenW.KERNEL32(0042CA68,0042CA68,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404E44
Part of subcall function 00404DA3: wsprintfW.USER32 ref: 00404E4D
Part of subcall function 00404DA3: SetDlgItemTextW.USER32(?,0042CA68), ref: 00404E60

Strings

"C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe" -Duser.language=en -Duser.country=US -Dfile.encoding=UTF-8 -classpath "l, xrefs: 00404B48, 00404B4D, 00404B58
A, xrefs: 00404B0A

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe" -Duser.language=en -Duser.country=US -Dfile.encoding=UTF-8 -classpath "l$A
API String ID: 2624150263-1401299251
Opcode ID: 716f91307e0c0206c4811f73cf3aa40f2f43fcc6cf09981b0470e9a043fb6368
Instruction ID: 819d6111372f9eb468737b2dc9595d459319e5efb98401d1644bfd8e85b56d65
Opcode Fuzzy Hash: 716f91307e0c0206c4811f73cf3aa40f2f43fcc6cf09981b0470e9a043fb6368
Instruction Fuzzy Hash: 14A180B1901208ABDB11EFA5DD45BAFB7B8EF84314F11803BF601B62D1D77C9A418B69

Function 00405C83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,75923420,C:\Users\user\AppData\Local\Temp\,0043F000), ref: 00405CAC
lstrcatW.KERNEL32(0042EA70,\*.*,0042EA70,?,?,75923420,C:\Users\user\AppData\Local\Temp\,0043F000), ref: 00405CF4
lstrcatW.KERNEL32(?,0040A014,?,0042EA70,?,?,75923420,C:\Users\user\AppData\Local\Temp\,0043F000), ref: 00405D17
lstrlenW.KERNEL32(?,?,0040A014,?,0042EA70,?,?,75923420,C:\Users\user\AppData\Local\Temp\,0043F000), ref: 00405D1D
FindFirstFileW.KERNEL32(0042EA70,?,?,?,0040A014,?,0042EA70,?,?,75923420,C:\Users\user\AppData\Local\Temp\,0043F000), ref: 00405D2D
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405DCD
FindClose.KERNEL32(00000000), ref: 00405DDC

Strings

pB, xrefs: 00405CDC
C:\Users\user\AppData\Local\Temp\, xrefs: 00405C90
\*.*, xrefs: 00405CEE

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: C:\Users\user\AppData\Local\Temp\$\*.*$pB
API String ID: 2035342205-1746305512
Opcode ID: 22bb0f4a0285bec378f517b8b25bc548c1454a96ed25189fc1485adbf29640f7
Instruction ID: 26a84cf893ecfac7fe2d2a8ab9ced37764d13583991ceadb599b2dfedf858990
Opcode Fuzzy Hash: 22bb0f4a0285bec378f517b8b25bc548c1454a96ed25189fc1485adbf29640f7
Instruction Fuzzy Hash: 8E41B030800A18B6CB21AB65DC4DAAF7778EF42718F10813BF851711D1DB7C4A82DEAE

Function 004021CF Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004085E8,?,00000001,004085D8,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040224E

Strings

C:\Users\user\AppData\Roaming\RDBNT, xrefs: 0040228E

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Roaming\RDBNT
API String ID: 542301482-2153498286
Opcode ID: 2ea10d9ea62cde922a238e3bbbbd5ec5bc19de412f736f9070a899e80d1e9b13
Instruction ID: 879178e2914a864b6efeea5842d2d3985b85c893096dfa9a9f6c7732eb85e553
Opcode Fuzzy Hash: 2ea10d9ea62cde922a238e3bbbbd5ec5bc19de412f736f9070a899e80d1e9b13
Instruction Fuzzy Hash: D1412571A00209AFCB00DFE4CA89A9D7BB5FF48318B20457EF505EB2D1DB799981CB54

Function 00404F63 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404F7B
GetDlgItem.USER32(?,00000408), ref: 00404F86
GlobalAlloc.KERNEL32(00000040,?), ref: 00404FD0
LoadImageW.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404FE7
SetWindowLongW.USER32(?,000000FC,00405570), ref: 00405000
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00405014
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00405026
SendMessageW.USER32(?,00001109,00000002), ref: 0040503C
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00405048
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 0040505A
DeleteObject.GDI32(00000000), ref: 0040505D
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00405088
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00405094
SendMessageW.USER32(?,00001132,00000000,?), ref: 0040512F
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 0040515F

Part of subcall function 0040452B: SendMessageW.USER32(00000028,?,00000001,00404356), ref: 00404539

SendMessageW.USER32(?,00001132,00000000,?), ref: 00405173
GetWindowLongW.USER32(?,000000F0), ref: 004051A1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 004051AF
ShowWindow.USER32(?,00000005), ref: 004051BF
SendMessageW.USER32(?,00000419,00000000,?), ref: 004052BA
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040531F
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405334
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405358
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405378
ImageList_Destroy.COMCTL32(?), ref: 0040538D
GlobalFree.KERNEL32(?), ref: 0040539D
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405416
SendMessageW.USER32(?,00001102,?,?), ref: 004054BF
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004054CE
InvalidateRect.USER32(?,00000000,00000001), ref: 004054F9
ShowWindow.USER32(?,00000000), ref: 00405547
GetDlgItem.USER32(?,000003FE), ref: 00405552
ShowWindow.USER32(00000000), ref: 00405559

Strings

N, xrefs: 004051F8
, xrefs: 00405531
M, xrefs: 00405117

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 90cd5b96e7067808b838d0f88060242d92195fc86ed4621a895529849429e476
Instruction ID: 2b71226c2ce540754c325362a134889399d6c5c4637dca841463e5b600fa6882
Opcode Fuzzy Hash: 90cd5b96e7067808b838d0f88060242d92195fc86ed4621a895529849429e476
Instruction Fuzzy Hash: 8802AD70900608AFDF20DFA8DD85AAF7BB5FB45314F10817AE611BA2E1D7798A41CF58

Function 00403FF7 Relevance: 51.4, APIs: 34, Instructions: 357windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00404033
ShowWindow.USER32(?), ref: 00404053
GetWindowLongW.USER32(?,000000F0), ref: 00404065
ShowWindow.USER32(?,00000004), ref: 0040407E
DestroyWindow.USER32 ref: 00404092
SetWindowLongW.USER32(?,00000000,00000000), ref: 004040AB
GetDlgItem.USER32(?,?), ref: 004040CA
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 004040DE
IsWindowEnabled.USER32(00000000), ref: 004040E5
GetDlgItem.USER32(?,00000001), ref: 00404190
GetDlgItem.USER32(?,00000002), ref: 0040419A
SetClassLongW.USER32(?,000000F2,?), ref: 004041B4
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00404205
GetDlgItem.USER32(?,00000003), ref: 004042AB
ShowWindow.USER32(00000000,?), ref: 004042CC
EnableWindow.USER32(?,?), ref: 004042DE
EnableWindow.USER32(?,?), ref: 004042F9
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040430F
EnableMenuItem.USER32(00000000), ref: 00404316
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040432E
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00404341
lstrlenW.KERNEL32(0042CA68,?,0042CA68,00000000), ref: 0040436B
SetWindowTextW.USER32(?,0042CA68), ref: 0040437F
ShowWindow.USER32(?,0000000A), ref: 004044B3

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: Window$Item$MessageSendShow$EnableLong$Menu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 1860320154-0
Opcode ID: 85e06a1bfb462d71b49bda8b571905cea54c43c8c85ee92c4a54339351a5f343
Instruction ID: 8cad316efbf8f9c89f6feec2797fb874042f4abab253e3557332251604c97906
Opcode Fuzzy Hash: 85e06a1bfb462d71b49bda8b571905cea54c43c8c85ee92c4a54339351a5f343
Instruction Fuzzy Hash: C6C1A1B1500204BBDB206F61EE89E2B3AA8FB85755F01453EF751B51F0CB39A8529B2D

Function 004046B5 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404753
GetDlgItem.USER32(?,000003E8), ref: 00404767
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404784
GetSysColor.USER32(?), ref: 00404795
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004047A3
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004047B1
lstrlenW.KERNEL32(?), ref: 004047B6
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004047C3
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004047D8
GetDlgItem.USER32(?,0000040A), ref: 00404831
SendMessageW.USER32(00000000), ref: 00404838
GetDlgItem.USER32(?,000003E8), ref: 00404863
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004048A6
LoadCursorW.USER32(00000000,00007F02), ref: 004048B4
SetCursor.USER32(00000000), ref: 004048B7
LoadCursorW.USER32(00000000,00007F00), ref: 004048D0
SetCursor.USER32(00000000), ref: 004048D3
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404902
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404914

Strings

"C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe" -Duser.language=en -Duser.country=US -Dfile.encoding=UTF-8 -classpath "l, xrefs: 00404892
N, xrefs: 00404851
,F@, xrefs: 004048BF

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: "C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe" -Duser.language=en -Duser.country=US -Dfile.encoding=UTF-8 -classpath "l$,F@$N
API String ID: 3103080414-2854563819
Opcode ID: ffd7346a229d966f7877475afaa511d8b27e78dae7af650fbb9c2f9128a087cb
Instruction ID: ccb0ec9a7d9d767aff215416cd1a2e620de701fb5c4a8d8609e67ea5798c0c5e
Opcode Fuzzy Hash: ffd7346a229d966f7877475afaa511d8b27e78dae7af650fbb9c2f9128a087cb
Instruction Fuzzy Hash: 046192F1900209BFDB10AF64DD85EAA7B69FB84315F00853AFB05B65E0C778A951CF98

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00433700,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: f8b3db801d2c504d9e2de6f85bac4b8fdc05036872983a9c428bf394377a2a15
Instruction ID: eca0ad76d85821e0a7fbe67f508e5060b260b918cc65b70bf06bca200ae74670
Opcode Fuzzy Hash: f8b3db801d2c504d9e2de6f85bac4b8fdc05036872983a9c428bf394377a2a15
Instruction Fuzzy Hash: 2F418B71800209AFCB058FA5DE459AFBFB9FF45314F00802EF591AA1A0C738EA54DFA4

Function 004061BD Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,00406358,?,?), ref: 004061F8
GetShortPathNameW.KERNEL32(?,00430108,00000400), ref: 00406201

Part of subcall function 00405FCC: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004062B1,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FDC
Part of subcall function 00405FCC: lstrlenA.KERNEL32(00000000,?,00000000,004062B1,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 0040600E

GetShortPathNameW.KERNEL32(?,00430908,00000400), ref: 0040621E
wsprintfA.USER32 ref: 0040623C
GetFileSize.KERNEL32(00000000,00000000,00430908,C0000000,00000004,00430908,?,?,?,?,?), ref: 00406277
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00406286
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004062BE
SetFilePointer.KERNEL32(0040A580,00000000,00000000,00000000,00000000,0042FD08,00000000,-0000000A,0040A580,00000000,[Rename],00000000,00000000,00000000), ref: 00406314
GlobalFree.KERNEL32(00000000), ref: 00406325
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0040632C

Part of subcall function 00406067: GetFileAttributesW.KERNELBASE(00000003,004030E2,00442800,80000000,00000003), ref: 0040606B
Part of subcall function 00406067: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040608D

Strings

[Rename], xrefs: 004062A6, 004062B8
%ls=%ls, xrefs: 00406232

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 67e7abcb15a3b792ff514517dbaa51231beb97817eaf9b334bdc8e12bec0558b
Instruction ID: 21ba76f912769f78f8e3df01d85e3e27af82f360ac84a16f7af8f01611abcd2b
Opcode Fuzzy Hash: 67e7abcb15a3b792ff514517dbaa51231beb97817eaf9b334bdc8e12bec0558b
Instruction Fuzzy Hash: 66314330240325BBD2206B659D48F6B3B6CDF45708F16043EFD42B62C2DA3C982486BD

Function 0040455D Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040457A
GetSysColor.USER32(00000000), ref: 004045B8
SetTextColor.GDI32(?,00000000), ref: 004045C4
SetBkMode.GDI32(?,?), ref: 004045D0
GetSysColor.USER32(?), ref: 004045E3
SetBkColor.GDI32(?,?), ref: 004045F3
DeleteObject.GDI32(?), ref: 0040460D
CreateBrushIndirect.GDI32(?), ref: 00404617

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 9dba601b91aff6ac4bf2e5f3eaee39d76022ea5146a5c84035e03d3d84c8d27c
Instruction ID: 3bf72a8e0ffa46ee4049c610ab3cabbd6d50cfb344f29d4a8179c655b9565abb
Opcode Fuzzy Hash: 9dba601b91aff6ac4bf2e5f3eaee39d76022ea5146a5c84035e03d3d84c8d27c
Instruction Fuzzy Hash: 5C2165B1500B04ABC7319F38DE08B577BF4AF41715F04892EEA96A26E0D739D944CB54

Function 00402711 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 0040277D
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004027B8
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004027DB
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004027F1

Part of subcall function 00406148: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 0040615E

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 0040289D

Strings

9, xrefs: 00402760

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: e6852b5c5fbfd8bc876860f3b14f1bcaed0b753dd9a04d4db6e12186382bd870
Instruction ID: d1aefac9689752b6b3ea6a4f87dd4281ecbe68d6f3974aa7f4e2ef829afcd0bd
Opcode Fuzzy Hash: e6852b5c5fbfd8bc876860f3b14f1bcaed0b753dd9a04d4db6e12186382bd870
Instruction Fuzzy Hash: 66510C75D04119AADF20EFD4CA85AAEBBB9FF44304F14817BE501B62D0D7B89D828B58

Function 004055FC Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042BA48,00000000,?,759223A0,?,?,?,?,?,?,?,?,?,0040343D,00000000,?), ref: 00405634
lstrlenW.KERNEL32(0040343D,0042BA48,00000000,?,759223A0,?,?,?,?,?,?,?,?,?,0040343D,00000000), ref: 00405644
lstrcatW.KERNEL32(0042BA48,0040343D,0040343D,0042BA48,00000000,?,759223A0), ref: 00405657
SetWindowTextW.USER32(0042BA48,0042BA48), ref: 00405669
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040568F
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004056A9
SendMessageW.USER32(?,00001013,?,00000000), ref: 004056B7

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 7a9b63bfacfea3e7ee08c26d0c930c27eafc8712a75251909ef17a9a102c325c
Instruction ID: 60923f6e922cea494a698f26c75bee70e53a21f42b4b77269416c2a585f1ce57
Opcode Fuzzy Hash: 7a9b63bfacfea3e7ee08c26d0c930c27eafc8712a75251909ef17a9a102c325c
Instruction Fuzzy Hash: 9A21A171900258BACB119FA5ED449DFBFB4EF45310F50843AF908B22A0C3794A40CFA8

Function 00406825 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,0043F000,75923420,C:\Users\user\AppData\Local\Temp\,00000000,0040352D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 00406888
CharNextW.USER32(?,?,?,00000000,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00406897
CharNextW.USER32(?,0043F000,75923420,C:\Users\user\AppData\Local\Temp\,00000000,0040352D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 0040689C
CharPrevW.USER32(?,?,75923420,C:\Users\user\AppData\Local\Temp\,00000000,0040352D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 004068AF

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00406826
*?|<>/":, xrefs: 00406877

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-1201062745
Opcode ID: d9890b2689dddc4776a4db6af1629ac80bd1bcc56ba6148264ccbff8cf15ab87
Instruction ID: bedb2e6347f460b6a244a356934bd0223db9426f0f89d28790e15ec7ef568a4f
Opcode Fuzzy Hash: d9890b2689dddc4776a4db6af1629ac80bd1bcc56ba6148264ccbff8cf15ab87
Instruction Fuzzy Hash: C911B66780221295DB303B148C40A7762A8AF59754F56C43FED86732C0E77C5C9282AD

Function 00404EB1 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404ECC
GetMessagePos.USER32 ref: 00404ED4
ScreenToClient.USER32(?,?), ref: 00404EEE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404F00
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404F26

Strings

f, xrefs: 00404F02

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 3b05e908374c5eb3ed0cc07743cf8bdf4b6f619b857b2f4ef42225a5e6fc1927
Instruction ID: fe1e2a7802b6c51c8f018a14413b1ee553013da7dc16083b389f375565560bf3
Opcode Fuzzy Hash: 3b05e908374c5eb3ed0cc07743cf8bdf4b6f619b857b2f4ef42225a5e6fc1927
Instruction Fuzzy Hash: 20015E71900219BADB00DB94DD85BFEBBBCAF95711F10412BBB51B61D0C7B4AA418BA4

Function 00402FB8 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402FD6
MulDiv.KERNEL32(09A3F43F,00000064,?), ref: 00403001
wsprintfW.USER32 ref: 00403011
SetWindowTextW.USER32(?,?), ref: 00403021
SetDlgItemTextW.USER32(?,00000406,?), ref: 00403033

Strings

verifying installer: %d%%, xrefs: 0040300B

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 492ce7ecf44becc2b6f328ccb1258d65c9f2870c51930cf6044baf7ee7e6d13e
Instruction ID: de78d71e2fb772fb87643f85aa6fa794cb5f2d0f129fd79c7e15704eeb750e6f
Opcode Fuzzy Hash: 492ce7ecf44becc2b6f328ccb1258d65c9f2870c51930cf6044baf7ee7e6d13e
Instruction Fuzzy Hash: 85014F71640208BBEF209F60DD49FEE3B79AB04344F008039FA02B51D0DBB996559B59

Function 00402975 Relevance: 9.1, APIs: 6, Instructions: 91memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004029D6
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029F2
GlobalFree.KERNEL32(?), ref: 00402A2B
GlobalFree.KERNEL32(00000000), ref: 00402A3E
CloseHandle.KERNEL32(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A5A
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A6D

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: bf19edcd9f5006e680e916d6cdac36739c80b8922926ab7d8fccc2e42281a72c
Instruction ID: fd7949a1005e62e73a365a75524f2bbb059e9229dbd09bef2f8decdc6a7611be
Opcode Fuzzy Hash: bf19edcd9f5006e680e916d6cdac36739c80b8922926ab7d8fccc2e42281a72c
Instruction Fuzzy Hash: FA31A271D00124BBCF21AFA5CE89D9E7E79AF45324F14423AF421762E1CB798D418FA8

Function 00402ECE Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402F22
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402F6E
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F77
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F8E
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F99

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: 2404979ab5d72bd1f47e4c5d2100d154d2dcf156ce7fec90999c2a50aae3b712
Instruction ID: 446d876c474c9d83549856ad9cac23e68bb7371358ae7480bd0e7fa7c4692e5e
Opcode Fuzzy Hash: 2404979ab5d72bd1f47e4c5d2100d154d2dcf156ce7fec90999c2a50aae3b712
Instruction Fuzzy Hash: 1D212A7150010ABFDF129F90CE89EEF7A7DEB54388F110076B909B21E0E7B58E54AA64

Function 00401DA6 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401DBF
GetClientRect.USER32(?,?), ref: 00401E0A
LoadImageW.USER32(?,?,?,?,?,?), ref: 00401E3A
SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E4E
DeleteObject.GDI32(00000000), ref: 00401E5E

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 81c9bb8771d2fff4a04963bae7b32cf8a9b6882c20dc3426dc9c78dd315e4f46
Instruction ID: c57303c31a56d7bc8f2a0c5af16d3cdd50a2ae23bf22298ce01a5789fd7b985b
Opcode Fuzzy Hash: 81c9bb8771d2fff4a04963bae7b32cf8a9b6882c20dc3426dc9c78dd315e4f46
Instruction Fuzzy Hash: B9211972900119AFCB05DF98DE45AEEBBB5EB08354F14003AFA45F62A0D7789D81DB98

Function 00401E73 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401E76
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E90
MulDiv.KERNEL32(00000000,00000000), ref: 00401E98
ReleaseDC.USER32(?,00000000), ref: 00401EA9
CreateFontIndirectW.GDI32(0040CDF0), ref: 00401EF8

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: d16b9d3e65f9976eb005c53eb2d4e9b3ac670e2d85412e8b50a51612330472b7
Instruction ID: 32ce691c062fdf7882ca7c79f7dc95dd78c7e40f541a0607bb82830de01dd458
Opcode Fuzzy Hash: d16b9d3e65f9976eb005c53eb2d4e9b3ac670e2d85412e8b50a51612330472b7
Instruction Fuzzy Hash: 3C017171905250EFE7005BB4EE49BDD3FA4AB19301F208A7AF142B61E2CBB904458BED

Function 00401C68 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CD8
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CF0

Strings

!, xrefs: 00401CA4

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: a637eb720a8cb25f7279c4c7dfa93e68b81a041eba1bee5adc213dda34b2fd0f
Instruction ID: 1a2acd516b32d4a8bba1f086ee74ddb70cdd2400578aaa813c3bd98b8eca9c32
Opcode Fuzzy Hash: a637eb720a8cb25f7279c4c7dfa93e68b81a041eba1bee5adc213dda34b2fd0f
Instruction Fuzzy Hash: 1121A071D1421AAEEB05AFA4D94AAFE7BB0EF44304F10453FF501B61D0D7B88941DB98

Function 00404DA3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042CA68,0042CA68,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404E44
wsprintfW.USER32 ref: 00404E4D
SetDlgItemTextW.USER32(?,0042CA68), ref: 00404E60

Strings

%u.%u%s%s, xrefs: 00404E2E

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 2c674a3dc48973326ebd454f1002488dce618ddc5f98b18a2ee0300ee1e706a4
Instruction ID: f1ad69e943298bab6ea0b6c220370dbc78873d19d133ff1b34b391d97265b774
Opcode Fuzzy Hash: 2c674a3dc48973326ebd454f1002488dce618ddc5f98b18a2ee0300ee1e706a4
Instruction Fuzzy Hash: 3011EB336041287BDB10566DAC45E9E329CDF85374F250237FE25F21D5E978C92182E8

Function 00405E46 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040353F,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 00405E4C
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040353F,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 00405E56
lstrcatW.KERNEL32(?,0040A014,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00405E68

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405E46

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-823278215
Opcode ID: 1ad634ba4b40e47f3a67f9c69e663da68b942b7adec5edae9754e9c2c01f4b37
Instruction ID: f2f0f64a112d89f35c11d852d44423d34ca235ab8761dbed5ccf1744ff487032
Opcode Fuzzy Hash: 1ad634ba4b40e47f3a67f9c69e663da68b942b7adec5edae9754e9c2c01f4b37
Instruction Fuzzy Hash: C2D05E31101534AAC6116F54AD04DDB62AC9E46384381483BF541B20A5C778595186FD

Function 0040303E Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000,0040321C,00000001), ref: 00403051
GetTickCount.KERNEL32 ref: 0040306F
CreateDialogParamW.USER32(0000006F,00000000,00402FB8,00000000), ref: 0040308C
ShowWindow.USER32(00000000,00000005), ref: 0040309A

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: dba963b85b565a1be4b34eea4ba853e9dad76a83014f6dce089c5eda9641480c
Instruction ID: e0f0fd039426b51c9db09d8e0aed7b7b9f53d87474512ec8403aba9b2c913b41
Opcode Fuzzy Hash: dba963b85b565a1be4b34eea4ba853e9dad76a83014f6dce089c5eda9641480c
Instruction Fuzzy Hash: 93F05470602A21ABC6216F50FE09A9B7B69FB45B12B41043AF545B11ACCB384891CB9D

Function 00405F4E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406577: lstrcpynW.KERNEL32(?,?,00000400,004036C4,00433700,NSIS Error,?,00000008,0000000A,0000000C), ref: 00406584

Part of subcall function 00405EF1: CharNextW.USER32(?,?,0042F270,?,00405F65,0042F270,0042F270,75923420,?,C:\Users\user\AppData\Local\Temp\,00405CA3,?,75923420,C:\Users\user\AppData\Local\Temp\,0043F000), ref: 00405EFF
Part of subcall function 00405EF1: CharNextW.USER32(00000000), ref: 00405F04
Part of subcall function 00405EF1: CharNextW.USER32(00000000), ref: 00405F1C

lstrlenW.KERNEL32(0042F270,00000000,0042F270,0042F270,75923420,?,C:\Users\user\AppData\Local\Temp\,00405CA3,?,75923420,C:\Users\user\AppData\Local\Temp\,0043F000), ref: 00405FA7
GetFileAttributesW.KERNEL32(0042F270,0042F270,0042F270,0042F270,0042F270,0042F270,00000000,0042F270,0042F270,75923420,?,C:\Users\user\AppData\Local\Temp\,00405CA3,?,75923420,C:\Users\user\AppData\Local\Temp\), ref: 00405FB7

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405F4E

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 3248276644-823278215
Opcode ID: 7c21406a6ebf8fc224ae0ccc6b020e70a1639b7280e68367676f2d78d50147cb
Instruction ID: 6a7a19aedd3560da6e477bd72522a8c235124595f9c35bb96c459409ca5d5c37
Opcode Fuzzy Hash: 7c21406a6ebf8fc224ae0ccc6b020e70a1639b7280e68367676f2d78d50147cb
Instruction Fuzzy Hash: 28F0F42A105E6369C622333A5C05AAF1954CE86324B5A453FBC91F22C5CF3C8A42CDBE

Function 00405570 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040559F
CallWindowProcW.USER32(?,?,?,?), ref: 004055F0

Part of subcall function 00404542: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404554

Strings

, xrefs: 00405580

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 831ed5cf29225e66f7bf56ab76169cd98d2ca93c2364028159cf8fc7ca140134
Instruction ID: f144bc20a23b2fc1dad06cc698734642626ca736bc3518a3bbd7873959a32aa8
Opcode Fuzzy Hash: 831ed5cf29225e66f7bf56ab76169cd98d2ca93c2364028159cf8fc7ca140134
Instruction Fuzzy Hash: 21017171100608BBDF219F11DD84A9F376BEB84794F204037FA027A1D9C7398D529A69

Function 00406445 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,00000000,00000000,0042BA48,?,00000800,00000000,?,0042BA48,?,?,"C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe" -Duser.language=en -Duser.country=US -Dfile.encoding=UTF-8 -classpath "l,?,00000000,004066B6,80000002), ref: 0040648B
RegCloseKey.ADVAPI32(?), ref: 00406496

Strings

"C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe" -Duser.language=en -Duser.country=US -Dfile.encoding=UTF-8 -classpath "l, xrefs: 0040644C

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: CloseQueryValue
String ID: "C:\Users\user\AppData\Roaming\RDBNT\jre\bin\javaw.exe" -Duser.language=en -Duser.country=US -Dfile.encoding=UTF-8 -classpath "l
API String ID: 3356406503-1648896867
Opcode ID: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
Instruction ID: 39ab2095516423f533248995afa5b88f9e2e33bd0920f2eea258779ff0fd120f
Opcode Fuzzy Hash: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
Instruction Fuzzy Hash: AB017C72500209AADF21CF51CC09EDB3BACFB55364F01803AFD1AA21A0D778D964DBA8

Function 00403BB4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,75923420,00000000,C:\Users\user\AppData\Local\Temp\,00403B8C,00403AA2,?,?,00000008,0000000A,0000000C), ref: 00403BCE
GlobalFree.KERNEL32(?), ref: 00403BD5

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403BB4

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-823278215
Opcode ID: 522759d04011631da2fa13ba2704cf46823a2ab452b41ebb0ecea140ccdeae61
Instruction ID: 378dd3650374f781d23bf779db5809bbac3881e8a2166d277484928c36cee721
Opcode Fuzzy Hash: 522759d04011631da2fa13ba2704cf46823a2ab452b41ebb0ecea140ccdeae61
Instruction Fuzzy Hash: 20E08C336204205BC6311F15AE05B1A77786F89B2AF01402AE8407B2628BB47C528FC8

Function 00405E92 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\users\public,0040310E,C:\users\public,C:\users\public,00442800,00442800,80000000,00000003), ref: 00405E98
CharPrevW.USER32(80000000,00000000,80000000,C:\users\public,0040310E,C:\users\public,C:\users\public,00442800,00442800,80000000,00000003), ref: 00405EA8

Strings

C:\users\public, xrefs: 00405E92

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\users\public
API String ID: 2709904686-2565504569
Opcode ID: 4d9a109f9f2e29ac56c0736ccbd4fa6bf3a04a93e1f4050107f2eb61dc35f761
Instruction ID: f09b3c5ebc87e5286f4ae90cf2a9e4f9baad7a67d9a69d6c991adc66958b5f71
Opcode Fuzzy Hash: 4d9a109f9f2e29ac56c0736ccbd4fa6bf3a04a93e1f4050107f2eb61dc35f761
Instruction Fuzzy Hash: 40D05EB28019209ED3226B04EC0499F73A8EF123107868826E980A61A5D7785D818AEC

Function 00405FCC Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004062B1,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FDC
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405FF4
CharNextA.USER32(00000000,?,00000000,004062B1,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406005
lstrlenA.KERNEL32(00000000,?,00000000,004062B1,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 0040600E

Memory Dump Source

Source File: 00000004.00000002.2199042061.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198950495.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199073927.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000416000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000431000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199098224.0000000000440000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2199399363.0000000000451000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_123.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 2e04212541fd7d2d0fc4f715182178ccf0de62a07a1c27cf83518a5c6c9cf375
Instruction ID: b896d6fd3cda69cb85c158c7a33f171d68b8f81fed19edc6c2f6f75b2124ada4
Opcode Fuzzy Hash: 2e04212541fd7d2d0fc4f715182178ccf0de62a07a1c27cf83518a5c6c9cf375
Instruction Fuzzy Hash: 64F0F631104418FFC702DFA5DD00D9EBBA8EF45350B2200B9E841FB250D674DE11AB68

Analysis Process: javaw.exePID: 6508, Parent PID: 652COMMON

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.4%
Total number of Nodes:	1236
Total number of Limit Nodes:	20

Executed Functions

Function 00024DC6 Relevance: 14.0, APIs: 3, Strings: 5, Instructions: 46
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00023971: _vwprintf.LIBCMT ref: 00023983

Part of subcall function 00024CDB: _strlen.LIBCMT ref: 00024D21
Part of subcall function 00024CDB: _strlen.LIBCMT ref: 00024D2F
Part of subcall function 00024CDB: _strlen.LIBCMT ref: 00024D3A

LoadLibraryA.KERNEL32(?), ref: 00024DE1
GetProcAddress.KERNEL32(00000000,JNI_CreateJavaVM), ref: 00024E05
GetProcAddress.KERNEL32(00000000,JNI_GetDefaultJavaVMInitArgs), ref: 00024E12

Part of subcall function 00023BA3: _vwprintf.LIBCMT ref: 00023BB8
Part of subcall function 00023BA3: _vswprintf_s.LIBCMT ref: 00023BD3
Part of subcall function 00023BA3: MessageBoxA.USER32(00000000,00000000,Java Virtual Machine Launcher,00000010), ref: 00023BE9

Strings

Error: loading: %s, xrefs: 00024DF0
JVM path is %s, xrefs: 00024DCD
JNI_GetDefaultJavaVMInitArgs, xrefs: 00024E0A
Error: can't find JNI interfaces in: %s, xrefs: 00024E29
JNI_CreateJavaVM, xrefs: 00024DFF

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: _strlen$AddressProc_vwprintf$LibraryLoadMessage_vswprintf_s
String ID: Error: can't find JNI interfaces in: %s$Error: loading: %s$JNI_CreateJavaVM$JNI_GetDefaultJavaVMInitArgs$JVM path is %s
API String ID: 888266038-3810690643
Opcode ID: f11e59d976f83ee683d8ca88ca607ee25261099c156ffdba2bcb0ff86111405e
Instruction ID: c0e7c91b1c10c5756b8f29f31b2559f37d811c21a5a073f08faadb975a6413ec
Opcode Fuzzy Hash: f11e59d976f83ee683d8ca88ca607ee25261099c156ffdba2bcb0ff86111405e
Instruction Fuzzy Hash: E3F02276108325FBEF126FA5BC02AEABBDCEF14760F114027FA485A052DAB5C9408B50

Function 6B926F48 Relevance: 68.6, APIs: 2, Strings: 37, Instructions: 310
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch.LIBCMT ref: 6B926F4F

Part of subcall function 6B95F49D: _JNU_GetEnv@8.JAVA(6C975A58,00010002,6B95A2EA,00000004,6B8C7083,?,00000020,?,00000020,?), ref: 6B95F4AC

Part of subcall function 6B954450: GetCurrentThreadId.KERNEL32 ref: 6B95448B
Part of subcall function 6B954450: _CxxThrowException.MSVCR100(?,6B989788), ref: 6B9544A7
Part of subcall function 6B954450: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,000000FF,?,6B989788), ref: 6B9544B6
Part of subcall function 6B954450: WaitForSingleObject.KERNEL32(00000000), ref: 6B9544BD

_CxxThrowException.MSVCR100(?,6B989388), ref: 6B92733E

Strings

winGraphicsConfig, xrefs: 6B9271F3
Ljava/awt/GraphicsConfiguration;, xrefs: 6B92718F
foreground, xrefs: 6B927130
getToolkitImpl, xrefs: 6B92727B
width, xrefs: 6B9270CB
Ljava/awt/Container;, xrefs: 6B92716E
Ljava/awt/peer/ComponentPeer;, xrefs: 6B92704D
Ljava/awt/Color;, xrefs: 6B92710B, 6B927110, 6B92712F
Ljava/awt/Cursor;, xrefs: 6B927234
visible, xrefs: 6B9270ED
parent, xrefs: 6B927173
Lsun/awt/AppContext;, xrefs: 6B9271CD
java/awt/event/InputEvent, xrefs: 6B926F67
enabled, xrefs: 6B927152
focusable, xrefs: 6B9271B1
()Ljava/awt/Toolkit;, xrefs: 6B927276
getFont_NoClientCode, xrefs: 6B92725A
cursor, xrefs: 6B927239
appContext, xrefs: 6B9271D2
sun/awt/windows/WComponentPeer, xrefs: 6B927034
replaceSurfaceData, xrefs: 6B9272D7
()Ljava/awt/Font;, xrefs: 6B927255
()Ljava/awt/Point;, xrefs: 6B9272B4
getButtonDownMasks, xrefs: 6B926F81
graphicsConfig, xrefs: 6B927194
()Z, xrefs: 6B927297
getLocationOnScreen_NoTreeLock, xrefs: 6B9272B9
peer, xrefs: 6B927052
Lsun/awt/Win32GraphicsConfig;, xrefs: 6B9271EE
height, xrefs: 6B9270AE
()[I, xrefs: 6B926F7C
background, xrefs: 6B927111
isEnabledImpl, xrefs: 6B92729C
replaceSurfaceDataLater, xrefs: 6B9272F2
hwnd, xrefs: 6B927216
disposeLater, xrefs: 6B92730D
()V, xrefs: 6B9272D1, 6B9272D6, 6B9272F1, 6B92730C

Memory Dump Source

Source File: 00000005.00000002.2267521549.000000006B8B1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8B0000, based on PE: true

Associated: 00000005.00000002.2267495654.000000006B8B0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267626294.000000006B969000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267685099.000000006B9A4000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267741690.000000006B9A6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267784368.000000006B9A7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267838865.000000006B9A8000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267863426.000000006B9A9000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AA000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AD000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267959620.000000006B9D0000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6b8b0000_javaw.jbxd

Similarity

API ID: ExceptionThrow$CreateCurrentEnv@8EventH_prolog3_catchObjectSingleThreadWait
String ID: ()Ljava/awt/Font;$()Ljava/awt/Point;$()Ljava/awt/Toolkit;$()V$()Z$()[I$Ljava/awt/Color;$Ljava/awt/Container;$Ljava/awt/Cursor;$Ljava/awt/GraphicsConfiguration;$Ljava/awt/peer/ComponentPeer;$Lsun/awt/AppContext;$Lsun/awt/Win32GraphicsConfig;$appContext$background$cursor$disposeLater$enabled$focusable$foreground$getButtonDownMasks$getFont_NoClientCode$getLocationOnScreen_NoTreeLock$getToolkitImpl$graphicsConfig$height$hwnd$isEnabledImpl$java/awt/event/InputEvent$parent$peer$replaceSurfaceData$replaceSurfaceDataLater$sun/awt/windows/WComponentPeer$visible$width$winGraphicsConfig
API String ID: 2813242525-2195416285
Opcode ID: 4534441d025801a761fe5e1a7215c5e4369e7e3201e5b05cff915abe19e6c55d
Instruction ID: 7af06e391b8e4910781913f404b370bf8ac27de6e3b98744de3eab73d5ff310d
Opcode Fuzzy Hash: 4534441d025801a761fe5e1a7215c5e4369e7e3201e5b05cff915abe19e6c55d
Instruction Fuzzy Hash: E5B14B35645642BBEB219F65DC48FAE3BF8AF8A344B5144B9FC44EB251DB38C940CB60

Function 00022F8A Relevance: 51.1, APIs: 12, Strings: 17, Instructions: 313
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00023AD9: QueryPerformanceFrequency.KERNEL32(00045498,?,?,?,0002172C,00000000,checkAndLoadMain,(ZILjava/lang/String;)Ljava/lang/Class;), ref: 00023AEC

_fgets.LIBCMT ref: 00023015
_memmove.LIBCMT ref: 00023093
_strlen.LIBCMT ref: 000230BA
_strcspn.LIBCMT ref: 000230D0
_strspn.LIBCMT ref: 000230EC

Part of subcall function 00023BA3: _vwprintf.LIBCMT ref: 00023BB8
Part of subcall function 00023BA3: _vswprintf_s.LIBCMT ref: 00023BD3
Part of subcall function 00023BA3: MessageBoxA.USER32(00000000,00000000,Java Virtual Machine Launcher,00000010), ref: 00023BE9

Part of subcall function 000239B8: _strlen.LIBCMT ref: 000239BC
Part of subcall function 000239B8: _strncmp.LIBCMT ref: 000239CA

_strcspn.LIBCMT ref: 0002313F
_strspn.LIBCMT ref: 00023154
_strcspn.LIBCMT ref: 0002316C
_fgets.LIBCMT ref: 000232D4

Strings

Warning: Missing server class VM on line %d of `%s', xrefs: 00023202
name: %s vmType: %s server_class: %s, xrefs: 00023290
VM_IF_SERVER_CLASS, xrefs: 00023284
jvm.cfg[%d] = ->%s<-, xrefs: 00023242
name: %s vmType: %s alias: %s, xrefs: 000232B2
Error: could not open `%s', xrefs: 00022FF0
ERROR, xrefs: 000231AC
KNOWN, xrefs: 00023112
Warning: Unknown VM type on line %d of `%s', xrefs: 0002322C
VM_ALIASED_TO, xrefs: 000232A6
IF_SERVER_CLASS, xrefs: 000231C1
ALIASED_TO, xrefs: 00023127
IGNORE, xrefs: 00023197
Warning: Missing VM type on line %d of `%s', xrefs: 00023100
Warning: No leading - on line %d of `%s', xrefs: 00023045
WARN, xrefs: 0002317F
%ld micro seconds to parse jvm.cfg, xrefs: 00023313

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: _strcspn$_fgets_strlen_strspn$FrequencyMessagePerformanceQuery_memmove_strncmp_vswprintf_s_vwprintf
String ID: name: %s vmType: %s alias: %s$ name: %s vmType: %s server_class: %s$%ld micro seconds to parse jvm.cfg$ALIASED_TO$ERROR$Error: could not open `%s'$IF_SERVER_CLASS$IGNORE$KNOWN$VM_ALIASED_TO$VM_IF_SERVER_CLASS$WARN$Warning: Missing VM type on line %d of `%s'$Warning: Missing server class VM on line %d of `%s'$Warning: No leading - on line %d of `%s'$Warning: Unknown VM type on line %d of `%s'$jvm.cfg[%d] = ->%s<-
API String ID: 297572648-2085308502
Opcode ID: f7b574da07abf6186fd0f5ebb922b6c47facb9819d0ca28a53b5d1a83d301051
Instruction ID: 91375864cc25106a642227025d725f034927c2412ad1f676100661b628568c6f
Opcode Fuzzy Hash: f7b574da07abf6186fd0f5ebb922b6c47facb9819d0ca28a53b5d1a83d301051
Instruction Fuzzy Hash: 1CA13D72C04325AFEB259FA4BC06BDD7BE8EF06314F20001AF6046B193EB795A55CB15

Function 000247B7 Relevance: 47.5, APIs: 10, Strings: 17, Instructions: 208
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00023A4E: GetModuleFileNameA.KERNEL32(00000000,?,?,?,000247E5,?,?,?,00000104), ref: 00023A5A
Part of subcall function 00023A4E: _strrchr.LIBCMT ref: 00023A63
Part of subcall function 00023A4E: _strrchr.LIBCMT ref: 00023A6E

RegOpenKeyExA.ADVAPI32(80000002,Software\JavaSoft\Java Runtime Environment,00000000,00020019,?,_JAVA_SPLASH_FILE,?,00000104), ref: 000248B8

Part of subcall function 00023B5D: _vswprintf_s.LIBCMT ref: 00023B7D

__stat64i32.LIBCMT ref: 00024812
_strlen.LIBCMT ref: 00024832
RegCloseKey.ADVAPI32(?), ref: 00024920
RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 0002496E
RegCloseKey.ADVAPI32(?), ref: 000249C6
RegCloseKey.ADVAPI32(?), ref: 00024A28
RegCloseKey.ADVAPI32(?), ref: 00024A2D

Part of subcall function 00023A87: RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,00000104,Software\JavaSoft\Java Runtime Environment,?,?,?,00024909,?,CurrentVersion,?,00000104), ref: 00023AA5
Part of subcall function 00023A87: RegQueryValueExA.ADVAPI32(00000001,?,00000000,00000000,?,00000104,?,?,?,00024909,?,CurrentVersion), ref: 00023ACA

RegCloseKey.ADVAPI32(?), ref: 000249CB

Part of subcall function 00023971: _vwprintf.LIBCMT ref: 00023983

Strings

MicroVersion, xrefs: 000249E4
Version major.minor.micro = %s.%s, xrefs: 00024A12
_JAVA_SPLASH_FILE, xrefs: 000248A0
JavaHome, xrefs: 00024994
Error: Registry key '%s'\CurrentVersion'has value '%s', but '%s' is required., xrefs: 0002494E
\jre, xrefs: 0002487F
Warning: Can't read MicroVersion, xrefs: 000249F8
CurrentVersion, xrefs: 000248FC
Error: opening registry key '%s', xrefs: 000248BF, 0002497C
Error: Failed reading value of registry key:%s\CurrentVersion, xrefs: 00024911
Software\JavaSoft\Java Runtime Environment, xrefs: 000248AD, 000248B2, 000248BE, 00024910, 0002494D, 0002497B, 000249AF
Failed reading value of registry key:%s\%s\JavaHome, xrefs: 000249B0
%s\bin\java.dll, xrefs: 000247F0
Error: could not find java.dll, xrefs: 000248CB
JRE path is %s, xrefs: 0002481F, 0002488B, 00024A32
Insufficient space to store JRE path, xrefs: 00024843
%s\jre\bin\java.dll, xrefs: 00024856

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: Close$OpenQueryValue_strrchr$FileModuleName__stat64i32_strlen_vswprintf_s_vwprintf
String ID: %s\bin\java.dll$%s\jre\bin\java.dll$CurrentVersion$Error: Failed reading value of registry key:%s\CurrentVersion$Error: Registry key '%s'\CurrentVersion'has value '%s', but '%s' is required.$Error: could not find java.dll$Error: opening registry key '%s'$Failed reading value of registry key:%s\%s\JavaHome$Insufficient space to store JRE path$JRE path is %s$JavaHome$MicroVersion$Software\JavaSoft\Java Runtime Environment$Version major.minor.micro = %s.%s$Warning: Can't read MicroVersion$\jre$_JAVA_SPLASH_FILE
API String ID: 3601377668-3297123116
Opcode ID: fece7673f0d11a24d0a9fbc29845bf10b8be8ffd08942e584bc2e5ff3e3a27f9
Instruction ID: 43574491a2f66e3778f24e07bdaa47f1d179d15abde43e32dce09a96d523d8a6
Opcode Fuzzy Hash: fece7673f0d11a24d0a9fbc29845bf10b8be8ffd08942e584bc2e5ff3e3a27f9
Instruction Fuzzy Hash: D351B772845168ABEF31BFA4BC46EEE7BACDF15310F100057FA19A6083EF759614CA61

Function 00024CDB Relevance: 19.3, APIs: 4, Strings: 7, Instructions: 72
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000247B7: __stat64i32.LIBCMT ref: 00024812

_strlen.LIBCMT ref: 00024D21
_strlen.LIBCMT ref: 00024D2F
_strlen.LIBCMT ref: 00024D3A
LoadLibraryA.KERNEL32(?,?,?,?,?,?,\bin\verify.dll), ref: 00024D89

Part of subcall function 00023BA3: _vwprintf.LIBCMT ref: 00023BB8
Part of subcall function 00023BA3: _vswprintf_s.LIBCMT ref: 00023BD3
Part of subcall function 00023BA3: MessageBoxA.USER32(00000000,00000000,Java Virtual Machine Launcher,00000010), ref: 00023BE9

Strings

Error: loading: %s, xrefs: 00024D97
\bin\, xrefs: 00024D28
\bin\verify.dll, xrefs: 00024CFD
Error: Path length exceeds maximum length (PATH_MAX), xrefs: 00024D48
CRT path is %s, xrefs: 00024D69
msvcr100.dll, xrefs: 00024D1C
\bin\msvcr100.dll, xrefs: 00024D5A

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: _strlen$LibraryLoadMessage__stat64i32_vswprintf_s_vwprintf
String ID: CRT path is %s$Error: Path length exceeds maximum length (PATH_MAX)$Error: loading: %s$\bin\$\bin\msvcr100.dll$\bin\verify.dll$msvcr100.dll
API String ID: 3923379734-855819635
Opcode ID: f4cf1188ad3c89cea0c1ba8734eadc06e0e5cbe12166758f04cf4291b5dbb500
Instruction ID: 530a5a04fe08365822ae53a94b245548c980ed00611af9364e8d393e0d9e96ae
Opcode Fuzzy Hash: f4cf1188ad3c89cea0c1ba8734eadc06e0e5cbe12166758f04cf4291b5dbb500
Instruction Fuzzy Hash: D011B7725402389BDB11ABA4FC86FED73ECAF41318F50041AF541DB082EF74A5488760

Function 00024F6F Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 103
synchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wgetenv.LIBCMT ref: 00024FC9
__wgetenv.LIBCMT ref: 00024FF1
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?), ref: 0002505B
GetExitCodeThread.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 00025066
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?), ref: 0002506D

Part of subcall function 0002AF5A: ___set_flsgetvalue.LIBCMT ref: 0002AF7F
Part of subcall function 0002AF5A: __calloc_crt.LIBCMT ref: 0002AF8B
Part of subcall function 0002AF5A: __getptd.LIBCMT ref: 0002AF98
Part of subcall function 0002AF5A: __initptd.LIBCMT ref: 0002AFA1
Part of subcall function 0002AF5A: CreateThread.KERNEL32(?,?,0002AEF5,00000000,?,?), ref: 0002AFCF
Part of subcall function 0002AF5A: GetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 0002AFD9
Part of subcall function 0002AF5A: _free.LIBCMT ref: 0002AFE2
Part of subcall function 0002AF5A: __dosmaperr.LIBCMT ref: 0002AFED

Strings

J2D_D3D, xrefs: 00024FC4
preloadD3D, xrefs: 00025045
true, xrefs: 00025022
false, xrefs: 00024FCF, 00024FD8, 00024FFD
J2D_D3D_PRELOAD, xrefs: 00024FEC

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: Thread__wgetenv$CloseCodeCreateErrorExitHandleLastObjectSingleWait___set_flsgetvalue__calloc_crt__dosmaperr__getptd__initptd_free
String ID: J2D_D3D$J2D_D3D_PRELOAD$false$preloadD3D$true
API String ID: 2452802370-3397395437
Opcode ID: f617527dc0f3dea030143ea288d2df117d49b05bbbccc2046e20e5730626910e
Instruction ID: acf0970f315029a69ea01abb4a01507d1f1e5ffd741c527781aba44e7cb6236c
Opcode Fuzzy Hash: f617527dc0f3dea030143ea288d2df117d49b05bbbccc2046e20e5730626910e
Instruction Fuzzy Hash: 1831E7B5900624BFDB22AFA4BD85EDE7BA8FB85311B100116F604B6152E7394950CB95

Function 0002141D Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0002142C

Part of subcall function 00028A72: __stbuf.LIBCMT ref: 00028AC0
Part of subcall function 00028A72: __ftbuf.LIBCMT ref: 00028AE9

Strings

JNI_FALSE, xrefs: 0002147D
nOptions is %ld, xrefs: 00021490
ignoreUnrecognized is %s, , xrefs: 00021483
option[%2d] = '%s', xrefs: 000214AE
JNI_TRUE, xrefs: 00021476, 00021482
JavaVM args: , xrefs: 00021458
version 0x%08lx, , xrefs: 00021465

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: __ftbuf__stbuf_memset
String ID: option[%2d] = '%s'$JNI_FALSE$JNI_TRUE$JavaVM args: $ignoreUnrecognized is %s, $nOptions is %ld$version 0x%08lx,
API String ID: 2530426458-3298565182
Opcode ID: 1901b2a219712e29ad2489bfd63d5dac4a350cfee76984a748c4870a9000e199
Instruction ID: 636ff243626c833a7bbaedeb050dcc23fd4add4b9cc4c29459745a08562a1643
Opcode Fuzzy Hash: 1901b2a219712e29ad2489bfd63d5dac4a350cfee76984a748c4870a9000e199
Instruction Fuzzy Hash: F8110675D01234BBEF11EBE4AC02EEDBBA8EF05315F008055F905BB153DA758A408B92

Function 0002AF5A Relevance: 12.1, APIs: 8, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___set_flsgetvalue.LIBCMT ref: 0002AF7F
__calloc_crt.LIBCMT ref: 0002AF8B
__getptd.LIBCMT ref: 0002AF98
__initptd.LIBCMT ref: 0002AFA1
CreateThread.KERNEL32(?,?,0002AEF5,00000000,?,?), ref: 0002AFCF
GetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 0002AFD9
_free.LIBCMT ref: 0002AFE2
__dosmaperr.LIBCMT ref: 0002AFED

Part of subcall function 0002AB01: __getptd_noexit.LIBCMT ref: 0002AB01

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__dosmaperr__getptd__getptd_noexit__initptd_free
String ID:
API String ID: 73303432-0
Opcode ID: f33153ad0a3d3a1d4337ea9efbdb96ba37ebf0c727d85145b04d2b8a1ca62162
Instruction ID: 24a7dbf7258546157a62dd4ed496eb74230648685c170f6ff7c74b80329db1e5
Opcode Fuzzy Hash: f33153ad0a3d3a1d4337ea9efbdb96ba37ebf0c727d85145b04d2b8a1ca62162
Instruction Fuzzy Hash: 34110272204366AFEB61AFE4FC419DB37E9EF06360B00002AF914C6492DF74DC018762

Function 000233BA Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0002443D: _memset.LIBCMT ref: 0002444A
Part of subcall function 0002443D: InitCommonControlsEx.COMCTL32(?), ref: 0002445D

Part of subcall function 00028A72: __stbuf.LIBCMT ref: 00028AC0
Part of subcall function 00028A72: __ftbuf.LIBCMT ref: 00028AE9

__wgetenv.LIBCMT ref: 000235AC

Part of subcall function 000213BF: _strlen.LIBCMT ref: 000213D1
Part of subcall function 000213BF: _strlen.LIBCMT ref: 000213DA
Part of subcall function 000213BF: _strlen.LIBCMT ref: 000213E7
Part of subcall function 000213BF: _sprintf.LIBCMT ref: 000213FE

Strings

-Dsun.java.launcher.diag=true, xrefs: 00023495
Command line args:, xrefs: 00023462
CLASSPATH, xrefs: 000235A7
argv[%d] = %s, xrefs: 0002347E
%ld micro seconds to LoadJavaVM, xrefs: 00023555

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: _strlen$CommonControlsInit__ftbuf__stbuf__wgetenv_memset_sprintf
String ID: %ld micro seconds to LoadJavaVM$-Dsun.java.launcher.diag=true$CLASSPATH$Command line args:$argv[%d] = %s
API String ID: 2460755827-597257649
Opcode ID: 4e951fbfed77aead93e55f91b5bc1d20e93dd1cb237c6f3d939e8b0f629f20a0
Instruction ID: 96c141bc705146c4ecbe7ca574feacfb6a56a14a43ce219e0abe0f45b76ab946
Opcode Fuzzy Hash: 4e951fbfed77aead93e55f91b5bc1d20e93dd1cb237c6f3d939e8b0f629f20a0
Instruction Fuzzy Hash: C2713FB2900268AFDF21EFE4ED85EDD77B9BB09304F10411AE909AB112EB359A45CF51

Function 0002AEF5 Relevance: 10.5, APIs: 7, Instructions: 34
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___set_flsgetvalue.LIBCMT ref: 0002AEFB

Part of subcall function 0002D34F: TlsGetValue.KERNEL32(?,0002AF00), ref: 0002D358
Part of subcall function 0002D34F: DecodePointer.KERNEL32(?,0002AF00), ref: 0002D36A
Part of subcall function 0002D34F: TlsSetValue.KERNEL32(00000000,?,0002AF00), ref: 0002D379

___fls_getvalue@4.LIBCMT ref: 0002AF06

Part of subcall function 0002D32F: TlsGetValue.KERNEL32(?,?,0002AF0B,00000000), ref: 0002D33D

___fls_setvalue@8.LIBCMT ref: 0002AF19

Part of subcall function 0002D383: DecodePointer.KERNEL32(?,?,?,0002AF1E,00000000,?,00000000), ref: 0002D394

GetLastError.KERNEL32(00000000,?,00000000), ref: 0002AF22
ExitThread.KERNEL32 ref: 0002AF29
GetCurrentThreadId.KERNEL32 ref: 0002AF2F
__freefls@4.LIBCMT ref: 0002AF4F

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: Value$DecodePointerThread$CurrentErrorExitLast___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
String ID:
API String ID: 2383549826-0
Opcode ID: 3596894f8474d5d9b675ad947b46dac075495c4b070b4a1126c309267f5a67f3
Instruction ID: 687a97cada28ad23bd9654f960987f39e0923473572f5df950db15ddc1489c3f
Opcode Fuzzy Hash: 3596894f8474d5d9b675ad947b46dac075495c4b070b4a1126c309267f5a67f3
Instruction Fuzzy Hash: 6AF036B45006A0EFD748FFA1E949C8E7BADAF853443158456F808D7213DB3DDD4687A2

Function 6B93B2CD Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 41
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows,00000000,00000001,00000000), ref: 6B93B2EF
RegQueryValueExW.KERNEL32(00000000,GDIProcessHandleQuota,00000000,00000000,?,?), ref: 6B93B314
RegCloseKey.ADVAPI32(00000000), ref: 6B93B33E

Strings

GDIProcessHandleQuota, xrefs: 6B93B305
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6B93B2E0

Memory Dump Source

Source File: 00000005.00000002.2267521549.000000006B8B1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8B0000, based on PE: true

Associated: 00000005.00000002.2267495654.000000006B8B0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267626294.000000006B969000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267685099.000000006B9A4000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267741690.000000006B9A6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267784368.000000006B9A7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267838865.000000006B9A8000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267863426.000000006B9A9000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AA000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AD000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267959620.000000006B9D0000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6b8b0000_javaw.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: GDIProcessHandleQuota$SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
API String ID: 3677997916-3108655066
Opcode ID: f9feadfcffcbb31b9788e67ea2b2a904ae377a55c71a2512f6823985a33c9606
Instruction ID: 6afa4bdf85e37975f878f30b0eb37f2728e03ce9165d0e617f5d0322d6a9d429
Opcode Fuzzy Hash: f9feadfcffcbb31b9788e67ea2b2a904ae377a55c71a2512f6823985a33c9606
Instruction Fuzzy Hash: FE013C75E08218FBEF209BA4CC0AB9E7BB9EB45744F2040A4FA02E6181F774DA04D724

Function 000243EF Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 29
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(jvm.dll,?,00021502,?,sun/launcher/LauncherHelper,00021530,?,?), ref: 000243FE
GetProcAddress.KERNEL32(00000000,JVM_FindClassFromBootLoader), ref: 00024413

Strings

Error: loading: %s, xrefs: 00024423
JVM_FindClassFromBootLoader, xrefs: 0002440C, 00024411, 00024422
jvm.dll, xrefs: 000243F9

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Error: loading: %s$JVM_FindClassFromBootLoader$jvm.dll
API String ID: 1646373207-1240634009
Opcode ID: caf8a8110edcaa2ab62dc78f17dc7f81923d01a8e13c6ef69cb644bf990bfe71
Instruction ID: eb1f8cc9e4943907558e3dbee597c2b005733f9e554158cf92ce68474c39f5f3
Opcode Fuzzy Hash: caf8a8110edcaa2ab62dc78f17dc7f81923d01a8e13c6ef69cb644bf990bfe71
Instruction Fuzzy Hash: 7DE0D831209271EF7B567BB5BC04E8B3FDCAF917667108016F509E2010E738DD004A61

Function 0002151B Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 87COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00021523

Part of subcall function 00023BA3: _vwprintf.LIBCMT ref: 00023BB8
Part of subcall function 00023BA3: _vswprintf_s.LIBCMT ref: 00023BD3
Part of subcall function 00023BA3: MessageBoxA.USER32(00000000,00000000,Java Virtual Machine Launcher,00000010), ref: 00023BE9

Strings

makePlatformString, xrefs: 00021592
(Z[B)Ljava/lang/String;, xrefs: 0002158D
Error: A JNI error has occurred, please check your installation and try again, xrefs: 00021539, 000215AA

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: Message_strlen_vswprintf_s_vwprintf
String ID: (Z[B)Ljava/lang/String;$Error: A JNI error has occurred, please check your installation and try again$makePlatformString
API String ID: 1165818999-1765258479
Opcode ID: 60f1b91031a10a71f3800c1f58f0047c392c05e8a1e1580c685d7d9c78a97121
Instruction ID: d626e181ce16f63ca545a85663b33efcc27048620cb56119aa987f91b25c4b44
Opcode Fuzzy Hash: 60f1b91031a10a71f3800c1f58f0047c392c05e8a1e1580c685d7d9c78a97121
Instruction Fuzzy Hash: E221C835204A21EFD7619FA5EC48EDE37FCEF95709F1000A9F942DA252D774CA408B54

Function 00024746 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

__stat64i32.LIBCMT ref: 0002479E

Part of subcall function 00023B5D: _vswprintf_s.LIBCMT ref: 00023B7D

Strings

%s\jvm.dll, xrefs: 00024788
%s\bin\%s\jvm.dll, xrefs: 00024774

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: __stat64i32_vswprintf_s
String ID: %s\bin\%s\jvm.dll$%s\jvm.dll
API String ID: 2146080085-3784575571
Opcode ID: 2cd3c138f08f8cd1ea104efaef8da7059799b0b7318f2edbae99d20aba2377f6
Instruction ID: 918e2f69249ea746d054740767160c14e7ce0e720f60b0f313801a0f8360bb64
Opcode Fuzzy Hash: 2cd3c138f08f8cd1ea104efaef8da7059799b0b7318f2edbae99d20aba2377f6
Instruction Fuzzy Hash: 43F0F6716052297ABA01BA64BC43DFF3BECCF07750F50001AF506990C3EF34DA025166

Function 00029C59 Relevance: 3.0, APIs: 2, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0002AB01: __getptd_noexit.LIBCMT ref: 0002AB01

__lock_file.LIBCMT ref: 00029CA0

Part of subcall function 00029B0E: __lock.LIBCMT ref: 00029B33

__fclose_nolock.LIBCMT ref: 00029CAB

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: e176d8988c2fa02609d224f5f2e28411cdb4a0c615ceea8dcdb4191e07408348
Instruction ID: 839c84e9695c2e0c0c385c25520933c46b55c8a1ac8bab7399761870f903856e
Opcode Fuzzy Hash: e176d8988c2fa02609d224f5f2e28411cdb4a0c615ceea8dcdb4191e07408348
Instruction Fuzzy Hash: DAF0B470901735DAEB22AB75F802BEE7BE06F01335F318305E425AE0D3CB789A019B55

Function 0002AEB4 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0002AEC0

Part of subcall function 0002D50A: __getptd_noexit.LIBCMT ref: 0002D50D
Part of subcall function 0002D50A: __amsg_exit.LIBCMT ref: 0002D51A

Part of subcall function 0002AE95: __getptd_noexit.LIBCMT ref: 0002AE9A
Part of subcall function 0002AE95: __freeptd.LIBCMT ref: 0002AEA4
Part of subcall function 0002AE95: ExitThread.KERNEL32 ref: 0002AEAD

__XcptFilter.LIBCMT ref: 0002AEE1

Part of subcall function 0002EF45: __getptd_noexit.LIBCMT ref: 0002EF4B

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: __getptd_noexit$ExitFilterThreadXcpt__amsg_exit__freeptd__getptd
String ID:
API String ID: 418257734-0
Opcode ID: e786191d4bfe25f6747c8cebd7148e738f6fb592110185bf62dccad3d24d43a8
Instruction ID: af554f4cc0c093b6ca56cd232a80ef53bd57843b7b911a62cfd1c3f00f33c931
Opcode Fuzzy Hash: e786191d4bfe25f6747c8cebd7148e738f6fb592110185bf62dccad3d24d43a8
Instruction Fuzzy Hash: 0BE0ECB1A446109FEB19FBA0E916EAE7775AF45301F210099F1015B2A3CE759D419A21

Function 0003887B Relevance: 3.0, APIs: 2, Instructions: 18COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00038893

Part of subcall function 0002CEAC: __mtinitlocknum.LIBCMT ref: 0002CEC2
Part of subcall function 0002CEAC: __amsg_exit.LIBCMT ref: 0002CECE
Part of subcall function 0002CEAC: EnterCriticalSection.KERNEL32(?,?,?,0002D5B5,0000000D,00042790,00000008,0002AF54,?,00000000), ref: 0002CED6

__tzset_nolock.LIBCMT ref: 000388A4

Part of subcall function 0003819A: __lock.LIBCMT ref: 000381BC
Part of subcall function 0003819A: ____lc_codepage_func.LIBCMT ref: 00038203
Part of subcall function 0003819A: __getenv_helper_nolock.LIBCMT ref: 00038225
Part of subcall function 0003819A: _free.LIBCMT ref: 0003825C
Part of subcall function 0003819A: _strlen.LIBCMT ref: 00038263
Part of subcall function 0003819A: __malloc_crt.LIBCMT ref: 0003826A
Part of subcall function 0003819A: _strlen.LIBCMT ref: 00038280
Part of subcall function 0003819A: _strcpy_s.LIBCMT ref: 0003828E
Part of subcall function 0003819A: __invoke_watson.LIBCMT ref: 000382A3
Part of subcall function 0003819A: _free.LIBCMT ref: 000382B2

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: __lock_free_strlen$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__invoke_watson__malloc_crt__mtinitlocknum__tzset_nolock_strcpy_s
String ID:
API String ID: 1828324828-0
Opcode ID: 7aa8b24920079b7953b33731d9917b1b73dd313be1758134480a33e393104460
Instruction ID: 9bc50c072e80fd6b3172d61cc796b12ee461f83ad505f07bc9591347376a9793
Opcode Fuzzy Hash: 7aa8b24920079b7953b33731d9917b1b73dd313be1758134480a33e393104460
Instruction Fuzzy Hash: FBE0C2744817B0E7E767BFA06A1259CB3A46B46B23FA1819AF511160D3CF390A05C796

Function 00023339 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00023354

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 788b53cbcde18e15b00b1868fd466babfb65cd6495f2befcf16f9c286e6594b3
Instruction ID: 1a82f3417d38297c3e93d0e588a6b25e08ba4fbe44b0ce5ff337e2e54223f02a
Opcode Fuzzy Hash: 788b53cbcde18e15b00b1868fd466babfb65cd6495f2befcf16f9c286e6594b3
Instruction Fuzzy Hash: E411C2B1A00319AFCB40DF98D941ADEB7F8BB08304F004426F918EB201E774EA158BA1

Function 0002AE7D Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

__waccess_s.LIBCMT ref: 0002AE88

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: __waccess_s
String ID:
API String ID: 4272103461-0
Opcode ID: ef7a6628b8ba34dfa5084db135283d76d392227949a9b5e0c08c397448921cd0
Instruction ID: cf9177a7784404d9bd08ba1de6c37cd835bfa21aac0584c66d42615f64bbdc23
Opcode Fuzzy Hash: ef7a6628b8ba34dfa5084db135283d76d392227949a9b5e0c08c397448921cd0
Instruction Fuzzy Hash: FBC09B3315411D7F9F055DF5FC01C553F59D7817707104115F91DC9891DD32D5515541

Function 00029F5A Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

__fsopen.LIBCMT ref: 00029F67

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: __fsopen
String ID:
API String ID: 3646066109-0
Opcode ID: 458c5a181ffae5f95d358663ef626c75276123e7ccc662156e21cb703a51c411
Instruction ID: c9eb10352a1be808aa30796c781a7d8afcf3ed1429eb589236bd4c0041bbd191
Opcode Fuzzy Hash: 458c5a181ffae5f95d358663ef626c75276123e7ccc662156e21cb703a51c411
Instruction Fuzzy Hash: 99C0927284420C77DF112A82EC02E8A3F1A9BC0760F058020FB1C1D162AA73EA619689

Non-executed Functions

Function 00025225 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 119fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00023904: _malloc.LIBCMT ref: 00023908
Part of subcall function 00023904: _perror.LIBCMT ref: 00023917

FindFirstFileA.KERNEL32(?,00000008,00000000,00000000,?), ref: 0002524E
FindNextFileA.KERNEL32(00000000,000454C0), ref: 00025289
_strlen.LIBCMT ref: 000252A4
_strlen.LIBCMT ref: 000252F2
_strlen.LIBCMT ref: 000252FA
_memmove.LIBCMT ref: 00025315
_memmove.LIBCMT ref: 00025328
FindClose.KERNEL32(00000000), ref: 0002534E

Strings

JAR, xrefs: 000252CE
jar, xrefs: 000252BA

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: Find_strlen$File_memmove$CloseFirstNext_malloc_perror
String ID: JAR$jar
API String ID: 3211738383-1396542530
Opcode ID: 2c9202c5c1f74b0047434b6897bc7eb3b629e8a55378df4a847e9b2f16b9f63b
Instruction ID: 1b1d0561dcb6a10de1301d990c4d5bee6657546419fe62c817f6af0140e2b937
Opcode Fuzzy Hash: 2c9202c5c1f74b0047434b6897bc7eb3b629e8a55378df4a847e9b2f16b9f63b
Instruction Fuzzy Hash: 31312371600624FBDB10AF74EC86AAEBBECEF46725F204029F405EA183DB75D944CB18

Function 00021000 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 84COMMON

Download Yara Rule

APIs

__wgetenv.LIBCMT ref: 00021013
GetCommandLineA.KERNEL32 ref: 00021053

Part of subcall function 00028A72: __stbuf.LIBCMT ref: 00028AC0
Part of subcall function 00028A72: __ftbuf.LIBCMT ref: 00028AE9

Strings

1.8.0_101-b13, xrefs: 000210C4
_JAVA_LAUNCHER_DEBUG, xrefs: 00021009
wwwd_args[%d] = %s, xrefs: 0002103D
1.8, xrefs: 000210BF
Windows original main args:, xrefs: 0002101F

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: CommandLine__ftbuf__stbuf__wgetenv
String ID: 1.8$1.8.0_101-b13$Windows original main args:$_JAVA_LAUNCHER_DEBUG$wwwd_args[%d] = %s
API String ID: 1994048314-67548272
Opcode ID: e4f47c172649e9db2d6bc14ba2c096b21f3ecd34bf5a031e4fcc76fbc65077b6
Instruction ID: a0744685dae2afb5ba7932406d83ceb644faf61c6f0c99fed1a69ba6e3c2a2d8
Opcode Fuzzy Hash: e4f47c172649e9db2d6bc14ba2c096b21f3ecd34bf5a031e4fcc76fbc65077b6
Instruction Fuzzy Hash: D92129B56002346FE3146FE4FCC6CAB779CE746715B51002DF640CB113EA76AD508BA0

Function 000296E8 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00031497
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 000314AC
UnhandledExceptionFilter.KERNEL32(00041358), ref: 000314B7
GetCurrentProcess.KERNEL32(C0000409), ref: 000314D3
TerminateProcess.KERNEL32(00000000), ref: 000314DA

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 95a463916405d592adeeca70b8cb0a8d7105439e23b6dcdb119041d352ad454a
Instruction ID: c368a108b49dcf9fa121e7fabce368deac5e40b1264fbfafd22f9a89b93429e0
Opcode Fuzzy Hash: 95a463916405d592adeeca70b8cb0a8d7105439e23b6dcdb119041d352ad454a
Instruction Fuzzy Hash: 2A21E2FC800204DFF721DF64FE886453BB4BB0B301F104059EA0997261E7BE59898F1A

Function 0002296B Relevance: 93.2, APIs: 5, Strings: 48, Instructions: 438COMMON

Download Yara Rule

Strings

-no-jre-restrict-search, xrefs: 00022CBE
-Xrunhprof:cpu=old,file=java.prof, xrefs: 00022BFA
-noverify, xrefs: 00022B9B
-X%s, xrefs: 00022D57
-noasyncgc, xrefs: 00022C94
-verifyremote, xrefs: 00022B82
-cp, xrefs: 000229B3
-version, xrefs: 00022A30
-splash:, xrefs: 00022CE8
-tm, xrefs: 00022B0A
-Xdiag, xrefs: 00022AA1
-Xnoclassgc, xrefs: 00022B51
-XshowSettings:, xrefs: 00022A8C
-XshowSettings, xrefs: 00022A77
-ss, xrefs: 00022C16
-Xfuture, xrefs: 00022B58
-mx, xrefs: 00022C55
-Dsun.java.launcher.diag=true, xrefs: 00022AB3
-verify, xrefs: 00022B69
Warning: %s option is no longer supported., xrefs: 00022D36
-fullversion, xrefs: 00022ABD
-classpath, xrefs: 00022998
-Xverify:remote, xrefs: 00022B94
-checksource, xrefs: 00022C6A
-verbosegc, xrefs: 00022AD2
-version:, xrefs: 00022CA9
Error: %s requires class path specification, xrefs: 00022E15
-Xt, xrefs: 00022B00
-Xtm, xrefs: 00022B1C
-Xdebug, xrefs: 00022B38
-d64, xrefs: 00022D1D
-jar, xrefs: 000229C8
-debug, xrefs: 00022B26
-d32, xrefs: 00022D0C
-oss, xrefs: 00022C2B
-Xrunhprof:cpu=old,file=%s, xrefs: 00022BEA
-showversion, xrefs: 00022A45
Error: %s requires jar file specification, xrefs: 00022DC2
-prof, xrefs: 00022BBC
-Xverify:all, xrefs: 00022B7B
-verbose:gc, xrefs: 00022AE4
-noclassgc, xrefs: 00022B3F
-ms, xrefs: 00022C40
-Xverify:none, xrefs: 00022BAD
-cs, xrefs: 00022C7F
-help, xrefs: 000229F1
-jre-restrict-search, xrefs: 00022CD3
%s full version "%s", xrefs: 00022DFA

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: Message_vswprintf_s_vwprintf
String ID: %s full version "%s"$-Dsun.java.launcher.diag=true$-X%s$-Xdebug$-Xdiag$-Xfuture$-Xnoclassgc$-Xrunhprof:cpu=old,file=%s$-Xrunhprof:cpu=old,file=java.prof$-XshowSettings$-XshowSettings:$-Xt$-Xtm$-Xverify:all$-Xverify:none$-Xverify:remote$-checksource$-classpath$-cp$-cs$-d32$-d64$-debug$-fullversion$-help$-jar$-jre-restrict-search$-ms$-mx$-no-jre-restrict-search$-noasyncgc$-noclassgc$-noverify$-oss$-prof$-showversion$-splash:$-ss$-tm$-verbose:gc$-verbosegc$-verify$-verifyremote$-version$-version:$Error: %s requires class path specification$Error: %s requires jar file specification$Warning: %s option is no longer supported.
API String ID: 1624507446-425787817
Opcode ID: 77b7aeacb7a13311005ac32edd778aa71c8c10bcdbb374fb2f3766ce1704fade
Instruction ID: aa03c02e50882f27b39104c4ac883c7852ab85d72892c305b66bebb5d1a02983
Opcode Fuzzy Hash: 77b7aeacb7a13311005ac32edd778aa71c8c10bcdbb374fb2f3766ce1704fade
Instruction Fuzzy Hash: D4B1867624C73279B6266A64BC43E9F27CC9F16375F34002AF901FD1C2EFA59981C269

Function 6B936B1C Relevance: 60.2, APIs: 20, Strings: 20, Instructions: 200COMMON

Download Yara Rule

APIs

wcsstr.MSVCR100 ref: 6B936B29
wcsstr.MSVCR100 ref: 6B936B3B

Strings

HANGEUL_CHARSET, xrefs: 6B936B96
ANSI_CHARSET, xrefs: 6B936B23
GREEK_CHARSET, xrefs: 6B936C14
DEFAULT_CHARSET, xrefs: 6B936B35
JOHAB_CHARSET, xrefs: 6B936BD5
THAI_CHARSET, xrefs: 6B936C53
MAC_CHARSET, xrefs: 6B936C92
CHINESEBIG5_CHARSET, xrefs: 6B936BAB
OEM_CHARSET, xrefs: 6B936BC0
RUSSIAN_CHARSET, xrefs: 6B936C7D
SYMBOL_CHARSET, xrefs: 6B936B48
VIETNAMESE_CHARSET, xrefs: 6B936C3E
WingDings, xrefs: 6B936B5A
GB2312_CHARSET, xrefs: 6B936B81
TURKISH_CHARSET, xrefs: 6B936C29
SHIFTJIS_CHARSET, xrefs: 6B936B6C
HEBREW_CHARSET, xrefs: 6B936BEA
EASTEUROPE_CHARSET, xrefs: 6B936C68
BALTIC_CHARSET, xrefs: 6B936CA4
ARABIC_CHARSET, xrefs: 6B936BFF

Memory Dump Source

Source File: 00000005.00000002.2267521549.000000006B8B1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8B0000, based on PE: true

Associated: 00000005.00000002.2267495654.000000006B8B0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267626294.000000006B969000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267685099.000000006B9A4000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267741690.000000006B9A6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267784368.000000006B9A7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267838865.000000006B9A8000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267863426.000000006B9A9000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AA000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AD000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267959620.000000006B9D0000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6b8b0000_javaw.jbxd

Similarity

API ID: wcsstr
String ID: ANSI_CHARSET$ARABIC_CHARSET$BALTIC_CHARSET$CHINESEBIG5_CHARSET$DEFAULT_CHARSET$EASTEUROPE_CHARSET$GB2312_CHARSET$GREEK_CHARSET$HANGEUL_CHARSET$HEBREW_CHARSET$JOHAB_CHARSET$MAC_CHARSET$OEM_CHARSET$RUSSIAN_CHARSET$SHIFTJIS_CHARSET$SYMBOL_CHARSET$THAI_CHARSET$TURKISH_CHARSET$VIETNAMESE_CHARSET$WingDings
API String ID: 2735924446-499274865
Opcode ID: e376bbd9fe05977a15347f44168088db095774f7a0ea1910536660de8dd0d236
Instruction ID: 85e0c726dee09aa9fbf3eefe81e459ec40c3aab57eda2f2b18c950a6ace0be79
Opcode Fuzzy Hash: e376bbd9fe05977a15347f44168088db095774f7a0ea1910536660de8dd0d236
Instruction Fuzzy Hash: A3412D2770C62724BA69217DBC51BBA479CCBC25B2B2084BFF610D55C0EF0DD48296B5

Function 0002256F Relevance: 54.6, APIs: 9, Strings: 22, Instructions: 351COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 000225C9
__wgetenv.LIBCMT ref: 000225DB
_strlen.LIBCMT ref: 000227BC
_strlen.LIBCMT ref: 000227C9
_strcat.LIBCMT ref: 000227DC
_strlen.LIBCMT ref: 00022802
_strlen.LIBCMT ref: 0002280F
_strcat.LIBCMT ref: 00022822

Part of subcall function 0002394B: __strdup.LIBCMT ref: 0002394F
Part of subcall function 0002394B: _perror.LIBCMT ref: 0002395E

Strings

-no-jre-restrict-search, xrefs: 00022663
_JAVA_SPLASH_FILE=, xrefs: 000227C1, 000227C6, 000227DA
null, xrefs: 000228A1, 000228C9
-Djava.awt.headless=true, xrefs: 000226C9
-cp, xrefs: 000226A5
-splash:, xrefs: 000226F9
Error: Syntax error in version specification "%s", xrefs: 0002288B
-jar, xrefs: 0002267C
true, xrefs: 000228B2, 000228C8
Error: main-class: attribute exceeds system limits of %d bytesError: A fatal exception has occurred. Program will exit., xrefs: 00022961
Error: Unable to locate JRE meeting specification "%s", xrefs: 000228F6
_JAVA_SPLASH_JAR=, xrefs: 00022807, 0002280C, 00022820
-Djava.awt.headless=, xrefs: 000226E3
-classpath, xrefs: 00022694
Error: Unable to access jarfile %s, xrefs: 00022768
false, xrefs: 000228B9
-version:, xrefs: 0002262A
_JAVA_VERSION_SET, xrefs: 000225D6
JRE-Version = %s, JRE-Restrict-Search = %s Selected = %s, xrefs: 000228CA
_JAVA_VERSION_SET=, xrefs: 00022597, 0002262F, 0002264B, 00022668, 00022681, 00022699, 000226AA, 000226CE, 000226E8, 000226FE, 00022756, 00022762
Error: Invalid or corrupt jarfile %s, xrefs: 0002276F
-jre-restrict-search, xrefs: 00022646

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: _strlen$_strcat$__strdup__wgetenv_memset_perror
String ID: -Djava.awt.headless=$-Djava.awt.headless=true$-classpath$-cp$-jar$-jre-restrict-search$-no-jre-restrict-search$-splash:$-version:$Error: Invalid or corrupt jarfile %s$Error: Syntax error in version specification "%s"$Error: Unable to access jarfile %s$Error: Unable to locate JRE meeting specification "%s"$Error: main-class: attribute exceeds system limits of %d bytesError: A fatal exception has occurred. Program will exit.$JRE-Version = %s, JRE-Restrict-Search = %s Selected = %s$_JAVA_SPLASH_FILE=$_JAVA_SPLASH_JAR=$_JAVA_VERSION_SET$_JAVA_VERSION_SET=$false$null$true
API String ID: 550220418-1483392412
Opcode ID: b6716f29b74bb4678f04700ea215a104be7fdd45b740e935ccd19a31b68b89fe
Instruction ID: 5e9dd58dc0de3b9fc766c6386ad847155a09c19e2a90f0466c00d133974d7546
Opcode Fuzzy Hash: b6716f29b74bb4678f04700ea215a104be7fdd45b740e935ccd19a31b68b89fe
Instruction Fuzzy Hash: B4B1C672D09239AEEB259BE4FC45BEDB7F8AF05724F20002AE404FB152EB749941CB50

Function 00024022 Relevance: 49.3, APIs: 15, Strings: 13, Instructions: 331processsynchronizationCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105,-00000004,00000000,?), ref: 0002405B
_strlen.LIBCMT ref: 0002408E

Part of subcall function 00023B5D: _vswprintf_s.LIBCMT ref: 00023B7D

GetCommandLineA.KERNEL32 ref: 000240BF

Part of subcall function 0002394B: __strdup.LIBCMT ref: 0002394F
Part of subcall function 0002394B: _perror.LIBCMT ref: 0002395E

_strlen.LIBCMT ref: 000240DD
_strlen.LIBCMT ref: 000240E8

Part of subcall function 00023904: _malloc.LIBCMT ref: 00023908
Part of subcall function 00023904: _perror.LIBCMT ref: 00023917

_strcat.LIBCMT ref: 00024121

Part of subcall function 00023C26: GetLastError.KERNEL32 ref: 00023C3C
Part of subcall function 00023C26: FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 00023C54
Part of subcall function 00023C26: _vwprintf.LIBCMT ref: 00023CA6
Part of subcall function 00023C26: _strlen.LIBCMT ref: 00023CBA
Part of subcall function 00023C26: _vswprintf_s.LIBCMT ref: 00023CD3
Part of subcall function 00023C26: MessageBoxA.USER32(00000000,00000000,Java Virtual Machine Launcher,00000010), ref: 00023CF8
Part of subcall function 00023C26: LocalFree.KERNEL32(?), ref: 00023D42

_strcat.LIBCMT ref: 00024134
_strncmp.LIBCMT ref: 000241AC
_memset.LIBCMT ref: 000242E6
_memset.LIBCMT ref: 000242F5
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000001,00000000,00000000,00000000,?,?), ref: 00024313
WaitForSingleObject.KERNEL32(?,000000FF,00000001), ref: 00024338
GetExitCodeProcess.KERNEL32(?,?), ref: 0002434A
CloseHandle.KERNEL32(?), ref: 0002436D
CloseHandle.KERNEL32(?), ref: 00024372

Part of subcall function 00023971: _vwprintf.LIBCMT ref: 00023983

Strings

-no-jre-restrict-search, xrefs: 000241C9
-cp, xrefs: 00024193
ReExec Args: %s, xrefs: 000242AC
Error: WaitForSingleObject() failed., xrefs: 00024356
Error: CreateProcess(%s, ...) failed:, xrefs: 00024321
Error: Unable to resolve %s, xrefs: 0002437C
ReExec Command: %s (%s), xrefs: 0002429F
-classpath, xrefs: 00024182
ExecJRE: new: %s, xrefs: 00024083
ExecJRE: old: %s, xrefs: 00024078
%s\bin\%s.exe, xrefs: 000240B0
-version:, xrefs: 000241A6
-jre-restrict-search, xrefs: 000241B8

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: _strlen$CloseHandleMessageProcess_memset_perror_strcat_vswprintf_s_vwprintf$CodeCommandCreateErrorExitFileFormatFreeLastLineLocalModuleNameObjectSingleWait__strdup_malloc_strncmp
String ID: %s\bin\%s.exe$-classpath$-cp$-jre-restrict-search$-no-jre-restrict-search$-version:$Error: CreateProcess(%s, ...) failed:$Error: Unable to resolve %s$Error: WaitForSingleObject() failed.$ExecJRE: new: %s$ExecJRE: old: %s$ReExec Args: %s$ReExec Command: %s (%s)
API String ID: 160412451-2302492997
Opcode ID: 4d6ee39d0993622d5e8ed0f7da9781bfd5b0bff20fba37770d0fed7efdbcd23d
Instruction ID: 03d0c43eb21c09e22047c947c36ee34a451afa4d5fc399a2c38005a19eaf43e5
Opcode Fuzzy Hash: 4d6ee39d0993622d5e8ed0f7da9781bfd5b0bff20fba37770d0fed7efdbcd23d
Instruction Fuzzy Hash: BC915572D04225AAEF15ABB5BC46EEF7BBCEF09310F100416F601F6083EE699A45C765

Function 0002D6C1 Relevance: 42.1, APIs: 19, Strings: 5, Instructions: 109libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,00028CE3), ref: 0002D6C9
__mtterm.LIBCMT ref: 0002D6D5

Part of subcall function 0002D3A0: DecodePointer.KERNEL32(00000005,0002D837,?,00028CE3), ref: 0002D3B1
Part of subcall function 0002D3A0: TlsFree.KERNEL32(00000002,0002D837,?,00028CE3), ref: 0002D3CB

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 0002D6EB
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 0002D6F8
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 0002D705
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 0002D712
TlsAlloc.KERNEL32(?,00028CE3), ref: 0002D762
TlsSetValue.KERNEL32(00000000,?,00028CE3), ref: 0002D77D
__init_pointers.LIBCMT ref: 0002D787
EncodePointer.KERNEL32(?,00028CE3), ref: 0002D798
EncodePointer.KERNEL32(?,00028CE3), ref: 0002D7A5
EncodePointer.KERNEL32(?,00028CE3), ref: 0002D7B2
EncodePointer.KERNEL32(?,00028CE3), ref: 0002D7BF
DecodePointer.KERNEL32(Function_0000D524,?,00028CE3), ref: 0002D7E0
__calloc_crt.LIBCMT ref: 0002D7F5
DecodePointer.KERNEL32(00000000,?,00028CE3), ref: 0002D80F
__initptd.LIBCMT ref: 0002D81A
GetCurrentThreadId.KERNEL32 ref: 0002D821

Strings

FlsAlloc, xrefs: 0002D6E5
FlsFree, xrefs: 0002D707
FlsGetValue, xrefs: 0002D6ED
KERNEL32.DLL, xrefs: 0002D6C4
FlsSetValue, xrefs: 0002D6FA

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$Decode$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__initptd__mtterm
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3732613303-3819984048
Opcode ID: 549a599822d06df0f74eac34bd869d33f68e5444033e951c3bc86b123099ff73
Instruction ID: cd1552deb47e48a4b05872252cb44b6a612c28e2af0a59e4b2a53b1c47893299
Opcode Fuzzy Hash: 549a599822d06df0f74eac34bd869d33f68e5444033e951c3bc86b123099ff73
Instruction Fuzzy Hash: D53191B9844B21DBF751EF74BE09A193EE8EB46721700457BE554E22B2EB3C8800CF94

Function 6B94CBC2 Relevance: 40.7, APIs: 27, Instructions: 221memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,6B94DDC0,?,00000002,00000000,00000000,6B94DDC0,00000000,?,?,00000000,?,?,?,?,6B94DDC0), ref: 6B94CBF6
GlobalFree.KERNEL32(00000000), ref: 6B94CC19
_control87.MSVCR100 ref: 6B94CC42
_control87.MSVCR100 ref: 6B94CC5D
_control87.MSVCR100 ref: 6B94CC6B
GlobalAlloc.KERNEL32(00000042,?,?,?,?), ref: 6B94CC79
GlobalLock.KERNEL32(00000000), ref: 6B94CC87
_control87.MSVCR100 ref: 6B94CCA6
_control87.MSVCR100 ref: 6B94CCB4
GlobalUnlock.KERNEL32(?), ref: 6B94CCC1
GlobalAlloc.KERNEL32(00000042,?,?,?,00000002,00000000,6B94DDC0,?,?,?,?,6B94DDC0,?,?,?), ref: 6B94CCD7
GlobalFree.KERNEL32(00000000), ref: 6B94CCE5
GlobalLock.KERNEL32(00000000), ref: 6B94CCEE
GlobalFree.KERNEL32(?), ref: 6B94CD01
GlobalFree.KERNEL32(00000000), ref: 6B94CD04
memcpy.MSVCR100(00000000,?,?,?,?,?,6B94DDC0,?,?,?), ref: 6B94CD21
GlobalUnlock.KERNEL32(?), ref: 6B94CD2C
wcslen.MSVCR100 ref: 6B94CD43
wcslen.MSVCR100 ref: 6B94CD4B
wcslen.MSVCR100 ref: 6B94CD56
GlobalAlloc.KERNEL32(00000042,?,?,?,?,?,?,?,?,?,?,6B94DDC0,?,?,?), ref: 6B94CD70
GlobalLock.KERNEL32(00000000), ref: 6B94CD7A
memcpy.MSVCR100(00000008,?,00000000,?,?,?,?,?,?,?,?,?,6B94DDC0,?,?,?), ref: 6B94CD94
memcpy.MSVCR100(?,?,?,00000008,?,00000000,?,?,?,?,?,?,?,?,?,6B94DDC0), ref: 6B94CDB1
memcpy.MSVCR100(?,?,?,?,?,?,00000008,?,00000000), ref: 6B94CDD2
GlobalUnlock.KERNEL32(?), ref: 6B94CDE4
GlobalFree.KERNEL32(00000000), ref: 6B94CDEB

Memory Dump Source

Source File: 00000005.00000002.2267521549.000000006B8B1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8B0000, based on PE: true

Associated: 00000005.00000002.2267495654.000000006B8B0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267626294.000000006B969000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267685099.000000006B9A4000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267741690.000000006B9A6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267784368.000000006B9A7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267838865.000000006B9A8000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267863426.000000006B9A9000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AA000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AD000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267959620.000000006B9D0000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6b8b0000_javaw.jbxd

Similarity

API ID: Global$Free_control87$Allocmemcpy$LockUnlockwcslen
String ID:
API String ID: 1392141960-0
Opcode ID: a46c44366391cdc065bf5bea627d1fcc729bcf1d88e0e921ab60498a8745333a
Instruction ID: 30464e3ed26cce4acc086e0f7b37ff1dbf11406d172b38a5e8a3e254b8a0851c
Opcode Fuzzy Hash: a46c44366391cdc065bf5bea627d1fcc729bcf1d88e0e921ab60498a8745333a
Instruction Fuzzy Hash: CA7169B1D04219BFEF009FB4CC859BEBBB8EB09359B10486AF914E2250E738D954DB60

Function 000217A2 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 137COMMON

Download Yara Rule

APIs

__wgetenv.LIBCMT ref: 000217D6

Part of subcall function 00025476: __wgetenv.LIBCMT ref: 000254B0

_strlen.LIBCMT ref: 000217E9
_strlen.LIBCMT ref: 000217F2
_sprintf.LIBCMT ref: 00021816
_strlen.LIBCMT ref: 000217FF

Part of subcall function 00023904: _malloc.LIBCMT ref: 00023908
Part of subcall function 00023904: _perror.LIBCMT ref: 00023917

_strlen.LIBCMT ref: 0002184F
_sprintf.LIBCMT ref: 00021869
_strlen.LIBCMT ref: 0002188B
_strlen.LIBCMT ref: 00021896
_strcat.LIBCMT ref: 000218BF
_strlen.LIBCMT ref: 000218FD

Strings

-Dapplication.home=%s, xrefs: 00021863
CLASSPATH, xrefs: 000217C6
Error: Could not determine application home., xrefs: 00021839
-Denv.class.path=%s, xrefs: 00021810
-Djava.class.path=, xrefs: 000218B7

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: _strlen$__wgetenv_sprintf$_malloc_perror_strcat
String ID: -Dapplication.home=%s$-Denv.class.path=%s$-Djava.class.path=$CLASSPATH$Error: Could not determine application home.
API String ID: 29729583-1614226486
Opcode ID: eb27d09ef9de04e2e6e92683b3c18046372b6f46abcfc324734674573927ec0a
Instruction ID: 6fb3e4a8c9a9904cd026270def13152a16f39e6726d3a862c916204b487b4799
Opcode Fuzzy Hash: eb27d09ef9de04e2e6e92683b3c18046372b6f46abcfc324734674573927ec0a
Instruction Fuzzy Hash: EB4184B3940538AADB21BEB4BCC2EEE77ACAF55314F140029F504E7103EF755A858BA5

Function 00025C27 Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 272COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00025C49

Part of subcall function 0002A029: __FF_MSGBANNER.LIBCMT ref: 0002A042
Part of subcall function 0002A029: __NMSG_WRITE.LIBCMT ref: 0002A049
Part of subcall function 0002A029: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,0002FE09,?,00000001,?,?,0002CE37,00000018,00042708,0000000C,0002CEC7), ref: 0002A06E

_free.LIBCMT ref: 00025C75
__read.LIBCMT ref: 00025C87
_free.LIBCMT ref: 00025C96

Part of subcall function 00028DD0: HeapFree.KERNEL32(00000000,00000000,?,0002D4FB,00000000,?,0002FE09,?,00000001,?,?,0002CE37,00000018,00042708,0000000C,0002CEC7), ref: 00028DE6
Part of subcall function 00028DD0: GetLastError.KERNEL32(00000000,?,0002D4FB,00000000,?,0002FE09,?,00000001,?,?,0002CE37,00000018,00042708,0000000C,0002CEC7,?), ref: 00028DF8

_free.LIBCMT ref: 00025E69

Strings

_JAVA_SPLASH_FILE, xrefs: 00025C7D

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: _free$Heap$AllocateErrorFreeLast__read_malloc
String ID: _JAVA_SPLASH_FILE
API String ID: 2809924035-1214838622
Opcode ID: 1b7608ac0aeb938f69ed7915d4669e1db6809d1e4b1d2f2b273dc10f45fd1577
Instruction ID: f22f8ce03f3299682e1831f5566dc383f6db493ade284ac8a3686722429ef697
Opcode Fuzzy Hash: 1b7608ac0aeb938f69ed7915d4669e1db6809d1e4b1d2f2b273dc10f45fd1577
Instruction Fuzzy Hash: A4913B709086741ADB3D4B7DACA45BEBFF49F85302B08466EF8E6D1182E53CD605DB24

Function 00024E3A Relevance: 22.8, APIs: 7, Strings: 6, Instructions: 100libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00000000), ref: 00024F3B

Part of subcall function 000247B7: __stat64i32.LIBCMT ref: 00024812

_strlen.LIBCMT ref: 00024E8D
_strlen.LIBCMT ref: 00024E9A
LoadLibraryA.KERNEL32(?,00000000,false,00000000), ref: 00024ECF
LoadLibraryA.KERNEL32(?), ref: 00024EF0
LoadLibraryA.KERNEL32(?), ref: 00024F0D
GetProcAddress.KERNEL32(00000000,preloadStop), ref: 00024F1E

Part of subcall function 00023BA3: _vwprintf.LIBCMT ref: 00023BB8
Part of subcall function 00023BA3: _vswprintf_s.LIBCMT ref: 00023BD3
Part of subcall function 00023BA3: MessageBoxA.USER32(00000000,00000000,Java Virtual Machine Launcher,00000010), ref: 00023BE9

Strings

\bin\java.dll, xrefs: 00024ED8
\bin\verify.dll, xrefs: 00024E92, 00024E97, 00024EBC
Error: Path length exceeds maximum length (PATH_MAX), xrefs: 00024EA7
\bin\awt.dll, xrefs: 00024EF9
false, xrefs: 00024E67
preloadStop, xrefs: 00024F18

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: LibraryLoad$AddressProc_strlen$Message__stat64i32_vswprintf_s_vwprintf
String ID: Error: Path length exceeds maximum length (PATH_MAX)$\bin\awt.dll$\bin\java.dll$\bin\verify.dll$false$preloadStop
API String ID: 2711846210-2579839895
Opcode ID: 8a55defed937fb900c702d6e2fed99cc1ec6e1b99485beed3d53919d9fcf97d7
Instruction ID: ceb864f9bb0a1c4a279a459ba847d98b6ebe04c8c567a7a6b79ff75b75f6370b
Opcode Fuzzy Hash: 8a55defed937fb900c702d6e2fed99cc1ec6e1b99485beed3d53919d9fcf97d7
Instruction Fuzzy Hash: D13182729086198EEB65EFB5FC45BCE7BECAB45315F20002AE515E7182EB78D448CF24

Function 000210E3 Relevance: 22.8, APIs: 7, Strings: 6, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 000239B8: _strlen.LIBCMT ref: 000239BC
Part of subcall function 000239B8: _strncmp.LIBCMT ref: 000239CA

_strlen.LIBCMT ref: 00021115
_strlen.LIBCMT ref: 0002111D
_strlen.LIBCMT ref: 0002112F

Part of subcall function 00023904: _malloc.LIBCMT ref: 00023908
Part of subcall function 00023904: _perror.LIBCMT ref: 00023917

GetCurrentProcessId.KERNEL32 ref: 00021143

Part of subcall function 00023B5D: _vswprintf_s.LIBCMT ref: 00023B7D

Part of subcall function 00029007: __lock.LIBCMT ref: 00029015
Part of subcall function 00029007: __putenv_helper.LIBCMT ref: 00029024

GetCurrentProcessId.KERNEL32(0000000A), ref: 00021175

Part of subcall function 00028A72: __stbuf.LIBCMT ref: 00028AC0
Part of subcall function 00028A72: __ftbuf.LIBCMT ref: 00028AE9

__wgetenv.LIBCMT ref: 000211A4
_free.LIBCMT ref: 000211B5

Part of subcall function 00028DD0: HeapFree.KERNEL32(00000000,00000000,?,0002D4FB,00000000,?,0002FE09,?,00000001,?,?,0002CE37,00000018,00042708,0000000C,0002CEC7), ref: 00028DE6
Part of subcall function 00028DD0: GetLastError.KERNEL32(00000000,?,0002D4FB,00000000,?,0002FE09,?,00000001,?,?,0002CE37,00000018,00042708,0000000C,0002CEC7,?), ref: 00028DF8

Strings

-XX:NativeMemoryTracking=, xrefs: 000210FE, 00021103, 00021114
%s%d, xrefs: 00021181
TRACER_MARKER: NativeMemoryTracking: putenv arg %s, xrefs: 00021199
%s%d=%s, xrefs: 0002114F
TRACER_MARKER: NativeMemoryTracking: env var is %s, xrefs: 0002118E
TRACER_MARKER: NativeMemoryTracking: got value %s, xrefs: 000211AA

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: _strlen$CurrentProcess$ErrorFreeHeapLast__ftbuf__lock__putenv_helper__stbuf__wgetenv_free_malloc_perror_strncmp_vswprintf_s
String ID: %s%d$%s%d=%s$-XX:NativeMemoryTracking=$TRACER_MARKER: NativeMemoryTracking: env var is %s$TRACER_MARKER: NativeMemoryTracking: got value %s$TRACER_MARKER: NativeMemoryTracking: putenv arg %s
API String ID: 3768438103-269954147
Opcode ID: 210881ec3adc47f8dc19604dfe3f070e5a5fd08e79a2e31b14818a3c70982bd8
Instruction ID: 3f10c2b59de5ab80687fd3eec081677997146a2721eaec83a48313de99a42bc1
Opcode Fuzzy Hash: 210881ec3adc47f8dc19604dfe3f070e5a5fd08e79a2e31b14818a3c70982bd8
Instruction Fuzzy Hash: 2B1102729002387E9A12B7717C82CEF6AAC8F43BA4B108059FA00F7143EE789A118271

Function 00022312 Relevance: 21.2, APIs: 1, Strings: 11, Instructions: 220COMMON

Download Yara Rule

APIs

__wgetenv.LIBCMT ref: 00022324

Part of subcall function 00023904: _malloc.LIBCMT ref: 00023908
Part of subcall function 00023904: _perror.LIBCMT ref: 00023917

Strings

Warning: %s VM not supported; %s VM will be used, xrefs: 00022553
Default VM: %s, xrefs: 0002248B
Error: Unable to resolve VM alias %s, xrefs: 0002252D
Error: Corrupt jvm.cfg file; cycle in alias list., xrefs: 00022503
-J-XXaltjvm=, xrefs: 000223E2
-cp, xrefs: 00022391
JDK_ALTERNATE_VM, xrefs: 0002231F
-classpath, xrefs: 0002237C
Error: %s VM not supported, xrefs: 00022541
-XXaltjvm=, xrefs: 000223CF
ERROR, xrefs: 00022515

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: __wgetenv_malloc_perror
String ID: -J-XXaltjvm=$-XXaltjvm=$-classpath$-cp$Default VM: %s$ERROR$Error: %s VM not supported$Error: Corrupt jvm.cfg file; cycle in alias list.$Error: Unable to resolve VM alias %s$JDK_ALTERNATE_VM$Warning: %s VM not supported; %s VM will be used
API String ID: 2682589870-2532945928
Opcode ID: cf2b5c500f2c898470670fd0b47c2edc26b10356a741ce392031112566569e2b
Instruction ID: acda67a5e1cc304121892aeec2c17768041487bc6c4a32d72a963777c65d4c10
Opcode Fuzzy Hash: cf2b5c500f2c898470670fd0b47c2edc26b10356a741ce392031112566569e2b
Instruction Fuzzy Hash: 8C710271A00A39FFDB21DFA8E881A6D77E4EB06318F108099E945EB252D771EE41CB40

Function 6B946A00 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 97windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,00000000,?,?,6B9463E6,00000000,?,00000000), ref: 6B946A12
wcslen.MSVCR100 ref: 6B946A23
_CxxThrowException.MSVCR100(00000000,6B989388), ref: 6B946A53
JNU_NewObjectByName.JAVA(?,java/lang/OutOfMemoryError,(Ljava/lang/String;)V,00000000,00000000,6B989388,?,6B9463E6,00000000,?,00000000), ref: 6B946A64
FormatMessageW.KERNEL32(00001100,00000000,00000000,00000400,00000000,00000000,00000000,?,?,6B9463E6,00000000,?,00000000), ref: 6B946A82
wcslen.MSVCR100 ref: 6B946A8B
JNU_NewObjectByName.JAVA(?,java/lang/InternalError,(Ljava/lang/String;)V,00000000,?,6B9463E6,00000000,?,00000000), ref: 6B946AB4
LocalFree.KERNEL32(00000000), ref: 6B946AC1

Strings

(Ljava/lang/String;)V, xrefs: 6B946A59, 6B946AA9
java/lang/InternalError, xrefs: 6B946AAE
too many menu handles, xrefs: 6B946A1D, 6B946A22, 6B946A30
java/lang/OutOfMemoryError, xrefs: 6B946A5E

Memory Dump Source

Source File: 00000005.00000002.2267521549.000000006B8B1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8B0000, based on PE: true

Associated: 00000005.00000002.2267495654.000000006B8B0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267626294.000000006B969000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267685099.000000006B9A4000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267741690.000000006B9A6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267784368.000000006B9A7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267838865.000000006B9A8000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267863426.000000006B9A9000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AA000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AD000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267959620.000000006B9D0000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6b8b0000_javaw.jbxd

Similarity

API ID: NameObjectwcslen$ErrorExceptionFormatFreeLastLocalMessageThrow
String ID: (Ljava/lang/String;)V$java/lang/InternalError$java/lang/OutOfMemoryError$too many menu handles
API String ID: 633141992-867821964
Opcode ID: 8ae7e38c25e948cee49315b22e2307914afcc15d7dc0baef644ff7f58efe1889
Instruction ID: 4eb3974e976adc8d7fd05df0ebdfbc15be5620ccf48041d23f8f0d4a9739a32b
Opcode Fuzzy Hash: 8ae7e38c25e948cee49315b22e2307914afcc15d7dc0baef644ff7f58efe1889
Instruction Fuzzy Hash: 1E21BDB6505104BFDB129FA4CC88CEF7B7CEF8A255B1188A9F90197201EB79DD05CB61

Function 6B92CBBD Relevance: 20.0, APIs: 13, Instructions: 450COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 6B92CBC4

Part of subcall function 6B95F49D: _JNU_GetEnv@8.JAVA(6C975A58,00010002,6B95A2EA,00000004,6B8C7083,?,00000020,?,00000020,?), ref: 6B95F4AC

Part of subcall function 6B954450: GetCurrentThreadId.KERNEL32 ref: 6B95448B
Part of subcall function 6B954450: _CxxThrowException.MSVCR100(?,6B989788), ref: 6B9544A7
Part of subcall function 6B954450: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,000000FF,?,6B989788), ref: 6B9544B6
Part of subcall function 6B954450: WaitForSingleObject.KERNEL32(00000000), ref: 6B9544BD

GetLastError.KERNEL32(?,?,?,?,?,?,00000001,0000002C), ref: 6B92CCC0
GetLastError.KERNEL32(?,?,?,?,?,?,00000001,0000002C), ref: 6B92CD40
GetLastError.KERNEL32(?,?,?,?,?,?,00000001,0000002C), ref: 6B92CD8E
GetLastError.KERNEL32(?,?,?,?,?,?,00000001,0000002C), ref: 6B92CDB5
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,0000002C), ref: 6B92CDF0
free.MSVCR100 ref: 6B92CE57
_CxxThrowException.MSVCR100(?,6B989388), ref: 6B92D08D
free.MSVCR100 ref: 6B92D0C8

Memory Dump Source

Source File: 00000005.00000002.2267521549.000000006B8B1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8B0000, based on PE: true

Associated: 00000005.00000002.2267495654.000000006B8B0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267626294.000000006B969000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267685099.000000006B9A4000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267741690.000000006B9A6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267784368.000000006B9A7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267838865.000000006B9A8000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267863426.000000006B9A9000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AA000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AD000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267959620.000000006B9D0000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6b8b0000_javaw.jbxd

Similarity

API ID: ErrorLast$ExceptionThrowfree$CreateCurrentEnv@8EventH_prolog3_catch_ObjectSingleThreadWait
String ID:
API String ID: 1826456516-0
Opcode ID: 5b386bea6e095379d400970e04cbba4a8a6c68fe38737aaa580d7af4297790b6
Instruction ID: f4a0b062a8f400119fa83bbe54673919a5f2a72702ff5abfcadc57e86f7a3498
Opcode Fuzzy Hash: 5b386bea6e095379d400970e04cbba4a8a6c68fe38737aaa580d7af4297790b6
Instruction Fuzzy Hash: 68024871D55219EFDB118FA4C988BEEBFB8FF09710F20002AF904A6254D779D941CBA1

Function 6B8FAAF0 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 102COMMON

Download Yara Rule

APIs

Part of subcall function 6B8FAA50: J2dTraceImpl.AWT(00000001,00000001,OGLContext_IsExtensionAvailable: extension string is null,00000000,?,6B8FAD05,00000000,GL_ARB_fragment_shader), ref: 6B8FAA68

Part of subcall function 6B8FAA50: strlen.MSVCR100 ref: 6B8FAA79
Part of subcall function 6B8FAA50: strcspn.MSVCR100 ref: 6B8FAA96
Part of subcall function 6B8FAA50: strlen.MSVCR100 ref: 6B8FAA9F
Part of subcall function 6B8FAA50: strncmp.MSVCR100 ref: 6B8FAAAE
Part of subcall function 6B8FAA50: J2dTraceImpl.AWT(00000003,00000001,OGLContext_IsExtensionAvailable: %s=%s,?,false,00000000,6B91D391,?,?,?,?,WGLGraphicsConfig_getWGLConfigInfo), ref: 6B8FAAD7

_JNU_GetStaticFieldByName@20.JAVA(?,00000000,sun/java2d/opengl/OGLSurfaceData,isFBObjectEnabled,6B969480,?,?,?,?,?,?,6B8FAD71,?,00000000), ref: 6B8FAB2D
J2dTraceImpl.AWT(00000003,00000001,OGLContext_IsFBObjectExtensionAvailable: disabled via flag,?,00000000,sun/java2d/opengl/OGLSurfaceData,isFBObjectEnabled,6B969480,?,?,?,?,?,?,6B8FAD71,?), ref: 6B8FAB43

Part of subcall function 6B90EA57: _J2dTraceInit@0.AWT(?,6B8B4EE4,00000001,00000001,BufferedMaskBlit_enqueueTile: cannot lock mask array), ref: 6B90EA63
Part of subcall function 6B90EA57: fprintf.MSVCR100 ref: 6B90EABA
Part of subcall function 6B90EA57: vfprintf.MSVCR100 ref: 6B90EACB
Part of subcall function 6B90EA57: fprintf.MSVCR100 ref: 6B90EAE5
Part of subcall function 6B90EA57: fflush.MSVCR100 ref: 6B90EAEF

J2dTraceImpl.AWT(00000003,00000001,OGLContext_IsFBObjectExtensionAvailable: fbobject unsupported,?,?,00000000,sun/java2d/opengl/OGLSurfaceData,isFBObjectEnabled,6B969480,?,?,?,?,?,?,6B8FAD71), ref: 6B8FABE6
J2dTraceImpl.AWT(00000003,00000001,OGLContext_IsFBObjectExtensionAvailable: fbobject supported,?,?,?,00000000,sun/java2d/opengl/OGLSurfaceData,isFBObjectEnabled,6B969480), ref: 6B8FAC2F

Strings

sun/java2d/opengl/OGLSurfaceData, xrefs: 6B8FAB25
OGLContext_IsFBObjectExtensionAvailable: disabled via flag, xrefs: 6B8FAB3A
isFBObjectEnabled, xrefs: 6B8FAB20
GL_EXT_framebuffer_object, xrefs: 6B8FAAF3
GL_ARB_depth_texture, xrefs: 6B8FAB05
OGLContext_IsFBObjectExtensionAvailable: fbobject supported, xrefs: 6B8FAC26
OGLContext_IsFBObjectExtensionAvailable: fbobject unsupported, xrefs: 6B8FABDD

Memory Dump Source

Source File: 00000005.00000002.2267521549.000000006B8B1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8B0000, based on PE: true

Associated: 00000005.00000002.2267495654.000000006B8B0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267626294.000000006B969000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267685099.000000006B9A4000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267741690.000000006B9A6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267784368.000000006B9A7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267838865.000000006B9A8000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267863426.000000006B9A9000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AA000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AD000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267959620.000000006B9D0000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6b8b0000_javaw.jbxd

Similarity

API ID: Trace$Impl$fprintfstrlen$FieldInit@0Name@20Staticfflushstrcspnstrncmpvfprintf
String ID: GL_ARB_depth_texture$GL_EXT_framebuffer_object$OGLContext_IsFBObjectExtensionAvailable: disabled via flag$OGLContext_IsFBObjectExtensionAvailable: fbobject supported$OGLContext_IsFBObjectExtensionAvailable: fbobject unsupported$isFBObjectEnabled$sun/java2d/opengl/OGLSurfaceData
API String ID: 554788551-3888500106
Opcode ID: 5f348e8dbc0c5b20c46c9296a9713acb5263d19586535df892bf92bc7dff9142
Instruction ID: 96a5da2b618eefa24472a60a2da07f839f5b05f1b2a7c5e4fe56e547448c9c49
Opcode Fuzzy Hash: 5f348e8dbc0c5b20c46c9296a9713acb5263d19586535df892bf92bc7dff9142
Instruction Fuzzy Hash: F831E5756943007FFA107BA08C9BFDE3764AF99B04F100468F745AE0C1E6EAE10987B6

Function 6B90EB00 Relevance: 18.2, APIs: 12, Instructions: 169COMMON

Download Yara Rule

APIs

_Transform_transform@12.AWT(?,?,?), ref: 6B90EB42
fabs.MSVCR100 ref: 6B90EB5F
fabs.MSVCR100 ref: 6B90EB82
_Transform_transform@12.AWT(?,?,?), ref: 6B90EBD5
fabs.MSVCR100 ref: 6B90EBE4
fabs.MSVCR100 ref: 6B90EC07
_Transform_transform@12.AWT(?,?,?), ref: 6B90EC59
fabs.MSVCR100 ref: 6B90EC68
fabs.MSVCR100 ref: 6B90EC8B
_Transform_transform@12.AWT(?,?,?), ref: 6B90ECDE
fabs.MSVCR100 ref: 6B90ECED
fabs.MSVCR100 ref: 6B90ED0C

Memory Dump Source

Source File: 00000005.00000002.2267521549.000000006B8B1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8B0000, based on PE: true

Associated: 00000005.00000002.2267495654.000000006B8B0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267626294.000000006B969000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267685099.000000006B9A4000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267741690.000000006B9A6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267784368.000000006B9A7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267838865.000000006B9A8000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267863426.000000006B9A9000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AA000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AD000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267959620.000000006B9D0000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6b8b0000_javaw.jbxd

Similarity

API ID: fabs$Transform_transform@12
String ID:
API String ID: 3810233683-0
Opcode ID: c6484a7b2245efdca3e279eb54ce4473952442c8fda6733feb0c46404c620543
Instruction ID: 463f538ec8f32395075da4db836c4eae0ee02ca43aa8e58fedfea71bf36cba5d
Opcode Fuzzy Hash: c6484a7b2245efdca3e279eb54ce4473952442c8fda6733feb0c46404c620543
Instruction Fuzzy Hash: 5151B371818A44FBD740BF68D594A9ABBF8FF85344F80596DF8C801260EF35D068CB52

Function 0002451D Relevance: 17.7, APIs: 1, Strings: 9, Instructions: 201COMMON

Download Yara Rule

Strings

Warning: app args parsing error, xrefs: 000245C9
passing arguments as-is., xrefs: 00024590
expandArgs, xrefs: 000246D9
passing arguments as-is, xrefs: 000245D3
Warning: app args is larger than the original, %d %d, xrefs: 00024586
%s, xrefs: 00024676
Error: A JNI error has occurred, please check your installation and try again, xrefs: 00024537, 000246EF
([Ljava/lang/String;)[Ljava/lang/String;, xrefs: 000246D4
%c%s, xrefs: 0002465D

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: Message_vswprintf_s_vwprintf
String ID: %c%s$%s$([Ljava/lang/String;)[Ljava/lang/String;$Error: A JNI error has occurred, please check your installation and try again$Warning: app args is larger than the original, %d %d$Warning: app args parsing error$expandArgs$passing arguments as-is$passing arguments as-is.
API String ID: 1624507446-1045827887
Opcode ID: 82218153c7f0c7ad4ce974e8fc820d36b0499b5402a67bb4fd2e8e91f5b7b793
Instruction ID: 599504900c89b57461f179f978f4d4a8024a3c1fa3b1064b75cf30f8125967ad
Opcode Fuzzy Hash: 82218153c7f0c7ad4ce974e8fc820d36b0499b5402a67bb4fd2e8e91f5b7b793
Instruction Fuzzy Hash: B8512671D04139BFCB12AFE4FC469EEBBB8EF05350F10405AF941A6143DB759A418B62

Function 6B926A92 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 194COMMON

Download Yara Rule

APIs

Part of subcall function 6B923B9F: GetCurrentThreadId.KERNEL32 ref: 6B923B9F

_JNU_GetEnv@8.JAVA(00010002), ref: 6B926AF9
_JNU_ThrowNullPointerException@8.JAVA(?,null pData,?,00010002), ref: 6B926B75
??3@YAXPAX@Z.MSVCR100(?,?,00010002), ref: 6B926CC8

Strings

null pData, xrefs: 6B926B6F
peer, xrefs: 6B926B28

Memory Dump Source

Source File: 00000005.00000002.2267521549.000000006B8B1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8B0000, based on PE: true

Associated: 00000005.00000002.2267495654.000000006B8B0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267626294.000000006B969000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267685099.000000006B9A4000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267741690.000000006B9A6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267784368.000000006B9A7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267838865.000000006B9A8000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267863426.000000006B9A9000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AA000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AD000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267959620.000000006B9D0000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6b8b0000_javaw.jbxd

Similarity

API ID: ??3@CurrentEnv@8Exception@8NullPointerThreadThrow
String ID: null pData$peer
API String ID: 1717875540-751156914
Opcode ID: c810c0755f985899391187927cc546a67b4c1919ac217eb1384216418045d87a
Instruction ID: f3019cfd204438422eefb19ff764372fd1edcd46016297cbc8765a6f3cf08de5
Opcode Fuzzy Hash: c810c0755f985899391187927cc546a67b4c1919ac217eb1384216418045d87a
Instruction Fuzzy Hash: 52713471D14308AFEF209FF4C888A9EBBB9EF49314F20416AE515AB658E735E845CF50

Function 000257B5 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 171COMMON

Download Yara Rule

APIs

__lseeki64.LIBCMT ref: 000257C7
__read.LIBCMT ref: 000257F0
__lseeki64.LIBCMT ref: 00025851

Part of subcall function 0002B07F: ___lock_fhandle.LIBCMT ref: 0002B0FF
Part of subcall function 0002B07F: __lseeki64_nolock.LIBCMT ref: 0002B11E

__lseeki64.LIBCMT ref: 0002589B
_malloc.LIBCMT ref: 000258B2
__read.LIBCMT ref: 000258C8
_free.LIBCMT ref: 00025928
_memmove.LIBCMT ref: 0002593E
_free.LIBCMT ref: 00025946

Strings

_JAVA_SPLASH_FILE, xrefs: 000257BB

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: __lseeki64$__read_free$___lock_fhandle__lseeki64_nolock_malloc_memmove
String ID: _JAVA_SPLASH_FILE
API String ID: 1537261635-1214838622
Opcode ID: c951dbccd2ab2ccf7145bf24b500b455c70aeb8d26040207642a5d2a09759887
Instruction ID: 088eea554c20085ec4398329046b35f322418fefd2b3e2ade8332299e38d681e
Opcode Fuzzy Hash: c951dbccd2ab2ccf7145bf24b500b455c70aeb8d26040207642a5d2a09759887
Instruction Fuzzy Hash: E951B031E04D35F6EB251A287C857BE7BF6DF80362F148169FC22E6182EA70DE009754

Function 0002559A Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

__lseeki64.LIBCMT ref: 000255C0
_malloc.LIBCMT ref: 000255DF
__read.LIBCMT ref: 000255F7
_malloc.LIBCMT ref: 0002565D

Part of subcall function 0002A029: __FF_MSGBANNER.LIBCMT ref: 0002A042
Part of subcall function 0002A029: __NMSG_WRITE.LIBCMT ref: 0002A049
Part of subcall function 0002A029: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,0002FE09,?,00000001,?,?,0002CE37,00000018,00042708,0000000C,0002CEC7), ref: 0002A06E

_free.LIBCMT ref: 0002568A
_free.LIBCMT ref: 00025682

Part of subcall function 00028DD0: HeapFree.KERNEL32(00000000,00000000,?,0002D4FB,00000000,?,0002FE09,?,00000001,?,?,0002CE37,00000018,00042708,0000000C,0002CEC7), ref: 00028DE6
Part of subcall function 00028DD0: GetLastError.KERNEL32(00000000,?,0002D4FB,00000000,?,0002FE09,?,00000001,?,?,0002CE37,00000018,00042708,0000000C,0002CEC7,?), ref: 00028DF8

_free.LIBCMT ref: 0002569B
_free.LIBCMT ref: 000256C2

Strings

_JAVA_SPLASH_FILE, xrefs: 000255A4
1.2.8, xrefs: 00025631

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: _free$Heap_malloc$AllocateErrorFreeLast__lseeki64__read
String ID: 1.2.8$_JAVA_SPLASH_FILE
API String ID: 3852694377-2039201388
Opcode ID: b64b9d3b64be4ba92b5a229ad257b3100baa525a30aaeda738b4c4bb16ae6627
Instruction ID: 5a5a5be880d4652cfc4a9f57a93912954ae4cc9c3cd81823098458715d32c87f
Opcode Fuzzy Hash: b64b9d3b64be4ba92b5a229ad257b3100baa525a30aaeda738b4c4bb16ae6627
Instruction Fuzzy Hash: FE311C31A04B15AFCB259F64FC8999E77F8EF54322F60452EF854D7291EB31E8008B14

Function 00023C26 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0002AB01: __getptd_noexit.LIBCMT ref: 0002AB01

GetLastError.KERNEL32 ref: 00023C3C
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 00023C54
_vwprintf.LIBCMT ref: 00023CA6
_strlen.LIBCMT ref: 00023CBA
_vswprintf_s.LIBCMT ref: 00023CD3
MessageBoxA.USER32(00000000,00000000,Java Virtual Machine Launcher,00000010), ref: 00023CF8
_vfwprintf.LIBCMT ref: 00023D14
_fprintf.LIBCMT ref: 00023D32
LocalFree.KERNEL32(?), ref: 00023D42

Strings

Java Virtual Machine Launcher, xrefs: 00023CF1

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: Message$ErrorFormatFreeLastLocal__getptd_noexit_fprintf_strlen_vfwprintf_vswprintf_s_vwprintf
String ID: Java Virtual Machine Launcher
API String ID: 389823976-898708411
Opcode ID: 68ae3f39f4993aaa55c6d0a2a5e11eccbd2d6df90b0d570ef8918f223fd8760e
Instruction ID: 5ab1522e8f0eb62303c85f2fdb414cb621748f80057759193ef265df4b6fcc7b
Opcode Fuzzy Hash: 68ae3f39f4993aaa55c6d0a2a5e11eccbd2d6df90b0d570ef8918f223fd8760e
Instruction Fuzzy Hash: 6431ABB28452E47EEB12AB90BC45EEE7FAC9F02350F144099F401BB153DA7A4F85C751

Function 00025FDF Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 129COMMON

Download Yara Rule

APIs

__wopen.LIBCMT ref: 00025FEE

Part of subcall function 00025C27: _malloc.LIBCMT ref: 00025C49

__close.LIBCMT ref: 0002604D

Part of subcall function 00025F2A: _strpbrk.LIBCMT ref: 00025F52

__close.LIBCMT ref: 00026110

Strings

JRE-Version, xrefs: 00026097
Main-Class, xrefs: 0002607E
Splashscreen-Image, xrefs: 000260DA
Manifest-Version, xrefs: 00026066
true, xrefs: 000260C1
JRE-Restrict-Search, xrefs: 000260B0

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: __close$__wopen_malloc_strpbrk
String ID: JRE-Restrict-Search$JRE-Version$Main-Class$Manifest-Version$Splashscreen-Image$true
API String ID: 2265373541-795735454
Opcode ID: 52836292173533ae9c5c7f0bc4ae19696515b7dc6d17553708ed9341a8239615
Instruction ID: f25166ba2a7066f14d9807630d8b1f0f64d0180eb54d0afb5e4d9204f42a0c56
Opcode Fuzzy Hash: 52836292173533ae9c5c7f0bc4ae19696515b7dc6d17553708ed9341a8239615
Instruction Fuzzy Hash: EA310A32508636AEDB229B64FC919DF77ECDF05320F200166F901EA182EF729A409794

Function 00023D83 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 114registryCOMMON

Download Yara Rule

APIs

RegEnumKeyA.ADVAPI32(80000001,00000000,?,00000104), ref: 00023DCA
RegEnumKeyA.ADVAPI32(?,?,?,00000104), ref: 00023E1A
RegOpenKeyExA.ADVAPI32(?,00000000,00000000,00020019,?), ref: 00023E38
RegCloseKey.ADVAPI32(?), ref: 00023E51
RegQueryValueExA.ADVAPI32(?,JavaHome,00000000,00000000,?,?), ref: 00023E74
RegCloseKey.ADVAPI32(?), ref: 00023E86

Part of subcall function 000262D9: _strpbrk.LIBCMT ref: 00026311
Part of subcall function 000262D9: _strpbrk.LIBCMT ref: 0002632D

Strings

JavaHome, xrefs: 00023E69

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: CloseEnum_strpbrk$OpenQueryValue
String ID: JavaHome
API String ID: 3676537333-2033683150
Opcode ID: eb8ac95f03dac6d008e26170b973819e54135224df6a4bb1ece39956800dec7f
Instruction ID: e5284a9b05716ba8c89be908ecec1cc17f4ecf15c23c7bc4183f50ffb6654dce
Opcode Fuzzy Hash: eb8ac95f03dac6d008e26170b973819e54135224df6a4bb1ece39956800dec7f
Instruction Fuzzy Hash: 43317E729002289EEF259BB5EC84EDE77BCEF45710F21012AF509E7052EB749A49CF20

Function 6B8CAAF7 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 99pipeCOMMON

Download Yara Rule

APIs

?GetInstance@D3DPipelineManager@@SAPAV1@XZ.AWT(?,?,6C975A58,00010002), ref: 6B8CAC6C
?GetD3DContext@D3DPipelineManager@@QAEJIPAPAVD3DContext@@@Z.AWT(?,?,6C975A58,00010002), ref: 6B8CAC73
?EndScene@D3DContext@@QAEJXZ.AWT(6C975A58,00010002), ref: 6B8CACC2
?Sync@D3DContext@@QAEJXZ.AWT ref: 6B8CACD6
JNU_CallMethodByName.JAVA(?,00000000,?,run,()V), ref: 6B8CAD08
J2dTraceImpl.AWT(00000001,00000001,D3DRQ_flushBuffer: invalid opcode=%d,?,6C975A58,00010002), ref: 6B8CAD21

Strings

run, xrefs: 6B8CACFF
()V, xrefs: 6B8CACFA

Memory Dump Source

Source File: 00000005.00000002.2267521549.000000006B8B1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8B0000, based on PE: true

Associated: 00000005.00000002.2267495654.000000006B8B0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267626294.000000006B969000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267685099.000000006B9A4000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267741690.000000006B9A6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267784368.000000006B9A7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267838865.000000006B9A8000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267863426.000000006B9A9000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AA000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AD000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267959620.000000006B9D0000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6b8b0000_javaw.jbxd

Similarity

API ID: Context@@Manager@@Pipeline$CallContext@Context@@@ImplInstance@MethodNameScene@Sync@Trace
String ID: ()V$run
API String ID: 1221654457-1990820779
Opcode ID: 42e713664e4c811e825233c348347d0fe90ffdee7e8f6ec206df630361299b44
Instruction ID: 29e4ab1c9c2eda88321984ae3a6c58d1f9876239522d1f33209d5d3b814c0968
Opcode Fuzzy Hash: 42e713664e4c811e825233c348347d0fe90ffdee7e8f6ec206df630361299b44
Instruction Fuzzy Hash: 3331DEB51082449FD620DB29D880B2BB7F9AFC5314F158C9CE8C947216DB39E854C7A3

Function 6B8CABD8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 98pipeCOMMON

Download Yara Rule

APIs

?GetInstance@D3DPipelineManager@@SAPAV1@XZ.AWT(?,?,6C975A58,00010002), ref: 6B8CAC6C
?GetD3DContext@D3DPipelineManager@@QAEJIPAPAVD3DContext@@@Z.AWT(?,?,6C975A58,00010002), ref: 6B8CAC73
?EndScene@D3DContext@@QAEJXZ.AWT(6C975A58,00010002), ref: 6B8CACC2
?Sync@D3DContext@@QAEJXZ.AWT ref: 6B8CACD6
JNU_CallMethodByName.JAVA(?,00000000,?,run,()V), ref: 6B8CAD08
J2dTraceImpl.AWT(00000001,00000001,D3DRQ_flushBuffer: invalid opcode=%d,?,6C975A58,00010002), ref: 6B8CAD21

Strings

run, xrefs: 6B8CACFF
()V, xrefs: 6B8CACFA

Memory Dump Source

Source File: 00000005.00000002.2267521549.000000006B8B1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8B0000, based on PE: true

Associated: 00000005.00000002.2267495654.000000006B8B0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267626294.000000006B969000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267685099.000000006B9A4000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267741690.000000006B9A6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267784368.000000006B9A7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267838865.000000006B9A8000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267863426.000000006B9A9000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AA000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AD000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267959620.000000006B9D0000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6b8b0000_javaw.jbxd

Similarity

API ID: Context@@Manager@@Pipeline$CallContext@Context@@@ImplInstance@MethodNameScene@Sync@Trace
String ID: ()V$run
API String ID: 1221654457-1990820779
Opcode ID: 5cf8b5a3bb56ace46f467526aaa251c89d8c832e2a97f02dbb79ef8ec9f5a511
Instruction ID: ee5a2616363bb61f091bd640b137a683b79953be43fd6ba4ba889b51c5afd5b7
Opcode Fuzzy Hash: 5cf8b5a3bb56ace46f467526aaa251c89d8c832e2a97f02dbb79ef8ec9f5a511
Instruction Fuzzy Hash: 8A317EB56042419FD620CB39C8C0A6B77F9AFC5254F158C6CE88987256D739EC41CB72

Function 6B8CAB5E Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 91pipeCOMMON

Download Yara Rule

APIs

?GetInstance@D3DPipelineManager@@SAPAV1@XZ.AWT(?,?,6C975A58,00010002), ref: 6B8CAC6C
?GetD3DContext@D3DPipelineManager@@QAEJIPAPAVD3DContext@@@Z.AWT(?,?,6C975A58,00010002), ref: 6B8CAC73
?EndScene@D3DContext@@QAEJXZ.AWT(6C975A58,00010002), ref: 6B8CACC2
?Sync@D3DContext@@QAEJXZ.AWT ref: 6B8CACD6
JNU_CallMethodByName.JAVA(?,00000000,?,run,()V), ref: 6B8CAD08
J2dTraceImpl.AWT(00000001,00000001,D3DRQ_flushBuffer: invalid opcode=%d,?,6C975A58,00010002), ref: 6B8CAD21

Strings

run, xrefs: 6B8CACFF
()V, xrefs: 6B8CACFA

Memory Dump Source

Source File: 00000005.00000002.2267521549.000000006B8B1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8B0000, based on PE: true

Associated: 00000005.00000002.2267495654.000000006B8B0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267626294.000000006B969000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267685099.000000006B9A4000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267741690.000000006B9A6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267784368.000000006B9A7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267838865.000000006B9A8000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267863426.000000006B9A9000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AA000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AD000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267959620.000000006B9D0000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6b8b0000_javaw.jbxd

Similarity

API ID: Context@@Manager@@Pipeline$CallContext@Context@@@ImplInstance@MethodNameScene@Sync@Trace
String ID: ()V$run
API String ID: 1221654457-1990820779
Opcode ID: bde879ce18f12a27ba249f8bef3e8eb8af7375467b4991ee68f23c61ddea69c4
Instruction ID: 6d3e0378a638c3a1df8e32cf3e84ee118cc54ddd0bc4f96232e238cc507bc954
Opcode Fuzzy Hash: bde879ce18f12a27ba249f8bef3e8eb8af7375467b4991ee68f23c61ddea69c4
Instruction Fuzzy Hash: 3D317EF96042459FDA10CB29C8C0B6B77F9AFC5354F154C5CE98997216D739EC01CBA2

Function 00021005 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 83COMMON

Download Yara Rule

APIs

__wgetenv.LIBCMT ref: 00021013
GetCommandLineA.KERNEL32 ref: 00021053

Part of subcall function 00028A72: __stbuf.LIBCMT ref: 00028AC0
Part of subcall function 00028A72: __ftbuf.LIBCMT ref: 00028AE9

Strings

1.8.0_101-b13, xrefs: 000210C4
_JAVA_LAUNCHER_DEBUG, xrefs: 00021009
wwwd_args[%d] = %s, xrefs: 0002103D
1.8, xrefs: 000210BF
Windows original main args:, xrefs: 0002101F

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: CommandLine__ftbuf__stbuf__wgetenv
String ID: 1.8$1.8.0_101-b13$Windows original main args:$_JAVA_LAUNCHER_DEBUG$wwwd_args[%d] = %s
API String ID: 1994048314-67548272
Opcode ID: e2a1619caa6d85decabb365852b4d6e61fd9599db2f63c3433564c841d3fb1e1
Instruction ID: 69bb77db1a058628fd45b2159fe9e6e17aa03a9633cb0972dcf26b0db33a7d8a
Opcode Fuzzy Hash: e2a1619caa6d85decabb365852b4d6e61fd9599db2f63c3433564c841d3fb1e1
Instruction Fuzzy Hash: 222138B56002346FE3186FE0BCC6CAB779CE746719B51002DF640CB113EA76AD908BA0

Function 6B8CABA5 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 83pipeCOMMON

Download Yara Rule

APIs

?GetInstance@D3DPipelineManager@@SAPAV1@XZ.AWT(?,?,6C975A58,00010002), ref: 6B8CAC6C
?GetD3DContext@D3DPipelineManager@@QAEJIPAPAVD3DContext@@@Z.AWT(?,?,6C975A58,00010002), ref: 6B8CAC73
?EndScene@D3DContext@@QAEJXZ.AWT(6C975A58,00010002), ref: 6B8CACC2
?Sync@D3DContext@@QAEJXZ.AWT ref: 6B8CACD6
JNU_CallMethodByName.JAVA(?,00000000,?,run,()V), ref: 6B8CAD08
J2dTraceImpl.AWT(00000001,00000001,D3DRQ_flushBuffer: invalid opcode=%d,?,6C975A58,00010002), ref: 6B8CAD21

Strings

run, xrefs: 6B8CACFF
()V, xrefs: 6B8CACFA

Memory Dump Source

Source File: 00000005.00000002.2267521549.000000006B8B1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8B0000, based on PE: true

Associated: 00000005.00000002.2267495654.000000006B8B0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267626294.000000006B969000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267685099.000000006B9A4000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267741690.000000006B9A6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267784368.000000006B9A7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267838865.000000006B9A8000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267863426.000000006B9A9000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AA000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AD000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267959620.000000006B9D0000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6b8b0000_javaw.jbxd

Similarity

API ID: Context@@Manager@@Pipeline$CallContext@Context@@@ImplInstance@MethodNameScene@Sync@Trace
String ID: ()V$run
API String ID: 1221654457-1990820779
Opcode ID: 1837b111c3f74fa79db14f0a639acfd663e7a0340b24917a5755477dd4eb2f4e
Instruction ID: d387cfd085aa895991fdf70b090cdbee55f63db726250bae1ef99351fac98de4
Opcode Fuzzy Hash: 1837b111c3f74fa79db14f0a639acfd663e7a0340b24917a5755477dd4eb2f4e
Instruction Fuzzy Hash: 2C21BFFA6042459FDA20CB38C8C0B6B33B9AFC1218F158C6CE94987256DB39DC01C7A2

Function 6B8CAB9A Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 74pipeCOMMON

Download Yara Rule

APIs

?GetInstance@D3DPipelineManager@@SAPAV1@XZ.AWT(?,?,6C975A58,00010002), ref: 6B8CAC6C
?GetD3DContext@D3DPipelineManager@@QAEJIPAPAVD3DContext@@@Z.AWT(?,?,6C975A58,00010002), ref: 6B8CAC73
?EndScene@D3DContext@@QAEJXZ.AWT(6C975A58,00010002), ref: 6B8CACC2
?Sync@D3DContext@@QAEJXZ.AWT ref: 6B8CACD6
JNU_CallMethodByName.JAVA(?,00000000,?,run,()V), ref: 6B8CAD08
J2dTraceImpl.AWT(00000001,00000001,D3DRQ_flushBuffer: invalid opcode=%d,?,6C975A58,00010002), ref: 6B8CAD21

Strings

run, xrefs: 6B8CACFF
()V, xrefs: 6B8CACFA

Memory Dump Source

Source File: 00000005.00000002.2267521549.000000006B8B1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8B0000, based on PE: true

Associated: 00000005.00000002.2267495654.000000006B8B0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267626294.000000006B969000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267685099.000000006B9A4000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267741690.000000006B9A6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267784368.000000006B9A7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267838865.000000006B9A8000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267863426.000000006B9A9000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AA000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AD000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267959620.000000006B9D0000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6b8b0000_javaw.jbxd

Similarity

API ID: Context@@Manager@@Pipeline$CallContext@Context@@@ImplInstance@MethodNameScene@Sync@Trace
String ID: ()V$run
API String ID: 1221654457-1990820779
Opcode ID: f34f20191073ea43365ebf7e53f4755b7dd671bccad10d3b0b5aa96310981ea3
Instruction ID: 7d4f406fc51b438b0af8f2906e2380e8864e65c1f305f8a04cde3daaa5b47445
Opcode Fuzzy Hash: f34f20191073ea43365ebf7e53f4755b7dd671bccad10d3b0b5aa96310981ea3
Instruction Fuzzy Hash: AC21BBF96042049FDA10DB38C8C0B6B33BAAFC1254F144C68E8098B266DB39DC01C7A3

Function 6B8CABCD Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 73pipeCOMMON

Download Yara Rule

APIs

?GetInstance@D3DPipelineManager@@SAPAV1@XZ.AWT(?,?,6C975A58,00010002), ref: 6B8CAC6C
?GetD3DContext@D3DPipelineManager@@QAEJIPAPAVD3DContext@@@Z.AWT(?,?,6C975A58,00010002), ref: 6B8CAC73
?EndScene@D3DContext@@QAEJXZ.AWT(6C975A58,00010002), ref: 6B8CACC2
?Sync@D3DContext@@QAEJXZ.AWT ref: 6B8CACD6
JNU_CallMethodByName.JAVA(?,00000000,?,run,()V), ref: 6B8CAD08
J2dTraceImpl.AWT(00000001,00000001,D3DRQ_flushBuffer: invalid opcode=%d,?,6C975A58,00010002), ref: 6B8CAD21

Strings

run, xrefs: 6B8CACFF
()V, xrefs: 6B8CACFA

Memory Dump Source

Source File: 00000005.00000002.2267521549.000000006B8B1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8B0000, based on PE: true

Associated: 00000005.00000002.2267495654.000000006B8B0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267626294.000000006B969000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267685099.000000006B9A4000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267741690.000000006B9A6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267784368.000000006B9A7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267838865.000000006B9A8000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267863426.000000006B9A9000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AA000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AD000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267959620.000000006B9D0000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6b8b0000_javaw.jbxd

Similarity

API ID: Context@@Manager@@Pipeline$CallContext@Context@@@ImplInstance@MethodNameScene@Sync@Trace
String ID: ()V$run
API String ID: 1221654457-1990820779
Opcode ID: 27e09ffe4c53f6917a63abc7ffae48c185429a6fa364d96f97e0e4b8d7017147
Instruction ID: ba2e6c2e26b9b7fc26b46e7d81c60acc0be38ecf28538b895060f97136d490e4
Opcode Fuzzy Hash: 27e09ffe4c53f6917a63abc7ffae48c185429a6fa364d96f97e0e4b8d7017147
Instruction Fuzzy Hash: 2B218EF96142059FDA10DB39C8C1B6B33B9AF81254F154C68D9099B266DB39DC41C7A3

Function 00023BA3 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 51windowCOMMON

Download Yara Rule

APIs

_vwprintf.LIBCMT ref: 00023BB8

Part of subcall function 00023904: _malloc.LIBCMT ref: 00023908
Part of subcall function 00023904: _perror.LIBCMT ref: 00023917

_vswprintf_s.LIBCMT ref: 00023BD3

Part of subcall function 0002A9C0: __vsnprintf_l.LIBCMT ref: 0002A9D3

MessageBoxA.USER32(00000000,00000000,Java Virtual Machine Launcher,00000010), ref: 00023BE9
_vfwprintf.LIBCMT ref: 00023C07
_fprintf.LIBCMT ref: 00023C1D

Strings

JVM_FindClassFromBootLoader, xrefs: 00023BB2
Java Virtual Machine Launcher, xrefs: 00023BDD

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: Message__vsnprintf_l_fprintf_malloc_perror_vfwprintf_vswprintf_s_vwprintf
String ID: JVM_FindClassFromBootLoader$Java Virtual Machine Launcher
API String ID: 502157442-2728474055
Opcode ID: 22d76845b8655b51a9d8e9b4a7c00fc6417e5d46d521e6919afaa94de1669038
Instruction ID: 1348ecdc691ac6d267b0ef8418035c27aea48f9ef2ee97998c86668a61c31c91
Opcode Fuzzy Hash: 22d76845b8655b51a9d8e9b4a7c00fc6417e5d46d521e6919afaa94de1669038
Instruction Fuzzy Hash: 9401D6B35042547AEB017BA1BC07FEB3B5C9F42760F044016F90999053EE76E65087B6

Function 6B8C6B40 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44pipeCOMMON

Download Yara Rule

APIs

J2dTraceImpl.AWT(00000003,00000001,D3DGD_getDeviceCapsNative), ref: 6B8C6B4B

Part of subcall function 6B90EA57: _J2dTraceInit@0.AWT(?,6B8B4EE4,00000001,00000001,BufferedMaskBlit_enqueueTile: cannot lock mask array), ref: 6B90EA63
Part of subcall function 6B90EA57: fprintf.MSVCR100 ref: 6B90EABA
Part of subcall function 6B90EA57: vfprintf.MSVCR100 ref: 6B90EACB
Part of subcall function 6B90EA57: fprintf.MSVCR100 ref: 6B90EAE5
Part of subcall function 6B90EA57: fflush.MSVCR100 ref: 6B90EAEF

?GetInstance@D3DPipelineManager@@SAPAV1@XZ.AWT ref: 6B8C6B53
?GetAdapterOrdinalForScreen@D3DPipelineManager@@QAEIJ@Z.AWT(?), ref: 6B8C6B6B
?GetD3DContext@D3DPipelineManager@@QAEJIPAPAVD3DContext@@@Z.AWT(00000000,?,?), ref: 6B8C6B7A
J2dTraceImpl.AWT(00000001,00000001,D3DGD_getDeviceCapsNative: device %d disabled,00000000,00000000,?,?), ref: 6B8C6B8D

Strings

D3DGD_getDeviceCapsNative: device %d disabled, xrefs: 6B8C6B84
D3DGD_getDeviceCapsNative, xrefs: 6B8C6B42

Memory Dump Source

Source File: 00000005.00000002.2267521549.000000006B8B1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8B0000, based on PE: true

Associated: 00000005.00000002.2267495654.000000006B8B0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267626294.000000006B969000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267685099.000000006B9A4000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267741690.000000006B9A6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267784368.000000006B9A7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267838865.000000006B9A8000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267863426.000000006B9A9000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AA000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AD000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267959620.000000006B9D0000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6b8b0000_javaw.jbxd

Similarity

API ID: Manager@@PipelineTrace$Implfprintf$AdapterContext@Context@@@Init@0Instance@OrdinalScreen@fflushvfprintf
String ID: D3DGD_getDeviceCapsNative$D3DGD_getDeviceCapsNative: device %d disabled
API String ID: 1313270379-1057826975
Opcode ID: 509b6b0b65f44ef6bbcbb3f567dc20d8f55c4fe6adb2927f915a7a36f5b82180
Instruction ID: 2140cd3d01bac7046c7e66d478dc05f95d2fe500512e35c8470bd8505861ff05
Opcode Fuzzy Hash: 509b6b0b65f44ef6bbcbb3f567dc20d8f55c4fe6adb2927f915a7a36f5b82180
Instruction Fuzzy Hash: 0FF02473B50511BAD22493699C02FEFA398DFE4B65F00483EFA05D7180EB59C81082F3

Function 6B924B56 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 161timeCOMMON

Download Yara Rule

APIs

_JNU_GetEnv@8.JAVA(00010002), ref: 6B924B6D
_JNU_ClassString@4.JAVA(00000000), ref: 6B924BB3
_JVM_CurrentTimeMillis@8.JVM(00000000,00000000,00010002), ref: 6B924CBC

Strings

sun/awt/windows/WInputMethod, xrefs: 6B924C67
sendInputMethodEvent, xrefs: 6B924C9F
(IJLjava/lang/String;[I[Ljava/lang/String;[I[BIII)V, xrefs: 6B924C9A

Memory Dump Source

Source File: 00000005.00000002.2267521549.000000006B8B1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8B0000, based on PE: true

Associated: 00000005.00000002.2267495654.000000006B8B0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267626294.000000006B969000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267685099.000000006B9A4000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267741690.000000006B9A6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267784368.000000006B9A7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267838865.000000006B9A8000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267863426.000000006B9A9000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AA000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AD000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267959620.000000006B9D0000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6b8b0000_javaw.jbxd

Similarity

API ID: ClassCurrentEnv@8Millis@8String@4Time
String ID: (IJLjava/lang/String;[I[Ljava/lang/String;[I[BIII)V$sendInputMethodEvent$sun/awt/windows/WInputMethod
API String ID: 2797162521-3029828681
Opcode ID: 6967906933d6ea4fa8fc37fa307f950ddcf5764248c8ad134e871a3ba14e56a6
Instruction ID: e290b00fa90f2af350e806826d815d28d7674b68d00c3d7fb25095faec88ae5e
Opcode Fuzzy Hash: 6967906933d6ea4fa8fc37fa307f950ddcf5764248c8ad134e871a3ba14e56a6
Instruction Fuzzy Hash: 36516774901608EFDB12DFA4CC88DAE7BB9FF89304B2045A9FE5596214D33AD951CF60

Function 6B91EB4C Relevance: 10.7, APIs: 7, Instructions: 155COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6B91EB53
_control87.MSVCR100 ref: 6B91EB98
_control87.MSVCR100 ref: 6B91EBB4
_control87.MSVCR100 ref: 6B91EBC2
_control87.MSVCR100 ref: 6B91EC8B
_control87.MSVCR100 ref: 6B91EC99
??3@YAXPAX@Z.MSVCR100(?), ref: 6B91ECA0

Memory Dump Source

Source File: 00000005.00000002.2267521549.000000006B8B1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8B0000, based on PE: true

Associated: 00000005.00000002.2267495654.000000006B8B0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267626294.000000006B969000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267685099.000000006B9A4000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267741690.000000006B9A6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267784368.000000006B9A7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267838865.000000006B9A8000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267863426.000000006B9A9000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AA000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AD000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267959620.000000006B9D0000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6b8b0000_javaw.jbxd

Similarity

API ID: _control87$??3@H_prolog3_catch
String ID:
API String ID: 417898319-0
Opcode ID: 2f731bf38cba0be0676e794b6ad38e758f8b00230db406d1a6fb2cbbc9d1c54f
Instruction ID: 5361d9fae031141b46dbb18b3c07614ce1ef7b874d99d90c56647d29617bb8e4
Opcode Fuzzy Hash: 2f731bf38cba0be0676e794b6ad38e758f8b00230db406d1a6fb2cbbc9d1c54f
Instruction Fuzzy Hash: 1C514531904609EFDB11CFA8DD88CAEBBB5FF89310F24456AF814A6290DB36D951DF60

Function 6B8C6A20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91pipeCOMMON

Download Yara Rule

APIs

?GetInstance@D3DPipelineManager@@SAPAV1@XZ.AWT ref: 6B8C6A3C
?GetAdapterOrdinalForScreen@D3DPipelineManager@@QAEIJ@Z.AWT(?), ref: 6B8C6A6F

Strings

%x&%x %S (%d.%d.%d.%d), xrefs: 6B8C6AE8

Memory Dump Source

Source File: 00000005.00000002.2267521549.000000006B8B1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8B0000, based on PE: true

Associated: 00000005.00000002.2267495654.000000006B8B0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267626294.000000006B969000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267685099.000000006B9A4000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267741690.000000006B9A6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267784368.000000006B9A7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267838865.000000006B9A8000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267863426.000000006B9A9000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AA000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AD000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267959620.000000006B9D0000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6b8b0000_javaw.jbxd

Similarity

API ID: Manager@@Pipeline$AdapterInstance@OrdinalScreen@
String ID: %x&%x %S (%d.%d.%d.%d)
API String ID: 1472660137-4060426082
Opcode ID: 0fa214c2d88b04c214fb6b46fdfa32fe9dea7d2a5a13a5289a05426a2eba53a0
Instruction ID: d74111e05ea56d99465265172692324dce96a60e8d9d3c4f0ace76bce1732e5b
Opcode Fuzzy Hash: 0fa214c2d88b04c214fb6b46fdfa32fe9dea7d2a5a13a5289a05426a2eba53a0
Instruction Fuzzy Hash: 222199B16152506BE7249B38DC45FBBB3D89FD9304F41892DF549C7241EB38E80187A6

Function 6B91CBF0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

memset.MSVCR100 ref: 6B91CC0C
GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6B91D037,?,?,6B91D208,WGLGraphicsConfig_getWGLConfigInfo), ref: 6B91CC16
J2dTraceImpl.AWT(00000001,00000001,WGLGC_CreateScratchWindow: error registering window class), ref: 6B91CC47

Part of subcall function 6B90EA57: _J2dTraceInit@0.AWT(?,6B8B4EE4,00000001,00000001,BufferedMaskBlit_enqueueTile: cannot lock mask array), ref: 6B90EA63
Part of subcall function 6B90EA57: fprintf.MSVCR100 ref: 6B90EABA
Part of subcall function 6B90EA57: vfprintf.MSVCR100 ref: 6B90EACB
Part of subcall function 6B90EA57: fprintf.MSVCR100 ref: 6B90EAE5
Part of subcall function 6B90EA57: fflush.MSVCR100 ref: 6B90EAEF

GetModuleHandleW.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,6B91D037,?,?,6B91D208,WGLGraphicsConfig_getWGLConfigInfo), ref: 6B91CC61

Strings

Tmp, xrefs: 6B91CC2B, 6B91CC7E, 6B91CC83
WGLGC_CreateScratchWindow: error registering window class, xrefs: 6B91CC3E

Memory Dump Source

Source File: 00000005.00000002.2267521549.000000006B8B1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8B0000, based on PE: true

Associated: 00000005.00000002.2267495654.000000006B8B0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267626294.000000006B969000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267685099.000000006B9A4000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267741690.000000006B9A6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267784368.000000006B9A7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267838865.000000006B9A8000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267863426.000000006B9A9000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AA000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AD000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267959620.000000006B9D0000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6b8b0000_javaw.jbxd

Similarity

API ID: HandleModuleTracefprintf$ImplInit@0fflushmemsetvfprintf
String ID: Tmp$WGLGC_CreateScratchWindow: error registering window class
API String ID: 803271967-4235559906
Opcode ID: 2f87f4d3775dd72422cbe29fdc612ce7341ad442cf3ae4906893557cdb4a95b0
Instruction ID: 616c85b2f95c4d13569c7693b603e7677c929dc22a613e9dfbda9a3ae605cc41
Opcode Fuzzy Hash: 2f87f4d3775dd72422cbe29fdc612ce7341ad442cf3ae4906893557cdb4a95b0
Instruction Fuzzy Hash: F901A770A5C304BBF670A7658C47F8A3FE89F86748F248429F648751C0E6B4E15487AA

Function 0002AA55 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 0002AA5C

Part of subcall function 0002D491: GetLastError.KERNEL32(00000001,00000000,0002AB06,0002A0B2,00000000,?,0002FE09,?,00000001,?,?,0002CE37,00000018,00042708,0000000C,0002CEC7), ref: 0002D495
Part of subcall function 0002D491: ___set_flsgetvalue.LIBCMT ref: 0002D4A3
Part of subcall function 0002D491: __calloc_crt.LIBCMT ref: 0002D4B7
Part of subcall function 0002D491: DecodePointer.KERNEL32(00000000,?,0002FE09,?,00000001,?,?,0002CE37,00000018,00042708,0000000C,0002CEC7,?,?,?,0002D5B5), ref: 0002D4D1
Part of subcall function 0002D491: __initptd.LIBCMT ref: 0002D4E0
Part of subcall function 0002D491: GetCurrentThreadId.KERNEL32 ref: 0002D4E7
Part of subcall function 0002D491: SetLastError.KERNEL32(00000000,?,0002FE09,?,00000001,?,?,0002CE37,00000018,00042708,0000000C,0002CEC7,?,?,?,0002D5B5), ref: 0002D4FF

__calloc_crt.LIBCMT ref: 0002AA7E
__get_sys_err_msg.LIBCMT ref: 0002AA9C
_strcpy_s.LIBCMT ref: 0002AAA4
__invoke_watson.LIBCMT ref: 0002AAB9

Strings

Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 0002AA69, 0002AA8C

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: ErrorLast__calloc_crt$CurrentDecodePointerThread___set_flsgetvalue__get_sys_err_msg__getptd_noexit__initptd__invoke_watson_strcpy_s
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
API String ID: 69636372-798102604
Opcode ID: 205d4e245ee7c13c3a5c75219eb8a3c9a2a4e5c72e1493d2533445fae2859358
Instruction ID: f0a40471838c6bc32d06011dfe6eac1939641699bd5d58b0bf5623f5822a966a
Opcode Fuzzy Hash: 205d4e245ee7c13c3a5c75219eb8a3c9a2a4e5c72e1493d2533445fae2859358
Instruction Fuzzy Hash: 61F02B6270433227EB717929BD818BFB3DC8F51754B11043AFA0993102EB259C008197

Function 00034A65 Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00034A71

Part of subcall function 0002D50A: __getptd_noexit.LIBCMT ref: 0002D50D
Part of subcall function 0002D50A: __amsg_exit.LIBCMT ref: 0002D51A

__amsg_exit.LIBCMT ref: 00034A91
__lock.LIBCMT ref: 00034AA1
InterlockedDecrement.KERNEL32(?), ref: 00034ABE
_free.LIBCMT ref: 00034AD1
InterlockedIncrement.KERNEL32(02811710), ref: 00034AE9

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: f5827c3b3002adc7c03bc9a676eef026c45319d09fe27cc3fd68d2216a63b580
Instruction ID: 31472181a1ef7c0562727f39b0d4c54cf838ff2436e1918f113f1acc36e50054
Opcode Fuzzy Hash: f5827c3b3002adc7c03bc9a676eef026c45319d09fe27cc3fd68d2216a63b580
Instruction Fuzzy Hash: B5012639D41E21DBE722AB14B416B9E73E8FF01711F060005F414AB582CB38BC80CBCA

Function 00025977 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 235COMMON

Download Yara Rule

APIs

Part of subcall function 000257B5: __lseeki64.LIBCMT ref: 000257C7

__lseeki64.LIBCMT ref: 00025A21
__read.LIBCMT ref: 00025A45
__lseeki64.LIBCMT ref: 00025ADA

Strings

_JAVA_SPLASH_FILE, xrefs: 000259B9

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: __lseeki64$__read
String ID: _JAVA_SPLASH_FILE
API String ID: 4142932646-1214838622
Opcode ID: 467bc92dafad20f57d52ef49c678ad7c17eb2373f1ca3d004f92fafd11d4454d
Instruction ID: bf4f7f16ce8a4f2baa4b3d5ee9fb82d8772d7c37862747d4cc6926a417ee3706
Opcode Fuzzy Hash: 467bc92dafad20f57d52ef49c678ad7c17eb2373f1ca3d004f92fafd11d4454d
Instruction Fuzzy Hash: BE71F621E289B404EB79467E5CA51BEBFF69BC1303B08825EE8F5D10C3E57C8505DB64

Function 6B8DEAF0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

Part of subcall function 6B90B3AE: malloc.MSVCR100 ref: 6B90B3B6
Part of subcall function 6B90B3AE: _SurfaceData_SetOps@12.AWT(?,?,00000000,?,6B8B4C2A,?,?,0000004C), ref: 6B90B3C7
Part of subcall function 6B90B3AE: memset.MSVCR100 ref: 6B90B3D6

_JNU_ThrowOutOfMemoryError@8.JAVA(?,Initialization of SurfaceData failed.), ref: 6B8DEB18
InterlockedIncrement.KERNEL32(6B9ABE78), ref: 6B8DEB28

Strings

Initialization of SurfaceData failed., xrefs: 6B8DEB12

Memory Dump Source

Source File: 00000005.00000002.2267521549.000000006B8B1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8B0000, based on PE: true

Associated: 00000005.00000002.2267495654.000000006B8B0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267626294.000000006B969000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267685099.000000006B9A4000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267741690.000000006B9A6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267784368.000000006B9A7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267838865.000000006B9A8000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267863426.000000006B9A9000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AA000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AD000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267959620.000000006B9D0000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6b8b0000_javaw.jbxd

Similarity

API ID: Data_Error@8IncrementInterlockedMemoryOps@12SurfaceThrowmallocmemset
String ID: Initialization of SurfaceData failed.
API String ID: 3793303029-1683995780
Opcode ID: 5ef90c96dcf3ca8e4f8359260648bf935f5ba428d60fc440d5ed5ef7e4096e38
Instruction ID: 9c46e18bd519cb8610aab28490e6470ec17af0f433df856e706791d7d234ef8c
Opcode Fuzzy Hash: 5ef90c96dcf3ca8e4f8359260648bf935f5ba428d60fc440d5ed5ef7e4096e38
Instruction Fuzzy Hash: 194187B66187049FD720DF29D480A2BFBE4BB89749F804E2EE18A87600D778E444CB91

Function 00026487 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0002649A
_strlen.LIBCMT ref: 000264CD
_strpbrk.LIBCMT ref: 000264F8

Strings

&+*, xrefs: 000264F2
.-_, xrefs: 000264A8, 00026507, 00026517, 0002652E, 0002653F

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: _strlen$_strpbrk
String ID: &+*$.-_
API String ID: 763926018-274609856
Opcode ID: 59a6e71d73d9fa2e629789d134d023931f569bb67ddbb3a840cc4cba02433b11
Instruction ID: e0e72577f35b1d4bc533a4da00923fa7f37af59f63f3897c4ecbe77754cd36a7
Opcode Fuzzy Hash: 59a6e71d73d9fa2e629789d134d023931f569bb67ddbb3a840cc4cba02433b11
Instruction Fuzzy Hash: 3A212932608E736AE775A225FC91BBF67DCDF06760FA40056EC82DA087EE16DC4181A4

Function 00021DAE Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 101COMMON

Download Yara Rule

APIs

__wgetenv.LIBCMT ref: 00021DBC
__wgetenv.LIBCMT ref: 00021DC9

Part of subcall function 00028BB6: _strnlen.LIBCMT ref: 00028BEB
Part of subcall function 00028BB6: __lock.LIBCMT ref: 00028BFC
Part of subcall function 00028BB6: __getenv_helper_nolock.LIBCMT ref: 00028C09

Part of subcall function 00026124: __wopen.LIBCMT ref: 00026136

Strings

_JAVA_SPLASH_FILE, xrefs: 00021DC1, 00021DC6, 00021E9A
_JAVA_SPLASH_JAR, xrefs: 00021DB7, 00021EA0
_JAVA_VERSION_SET, xrefs: 00021E90

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: __wgetenv$__getenv_helper_nolock__lock__wopen_strnlen
String ID: _JAVA_SPLASH_FILE$_JAVA_SPLASH_JAR$_JAVA_VERSION_SET
API String ID: 1768112632-1229670908
Opcode ID: 533b446a18bca8e8c4c838ee94f4eb5b9967c796f3db7034224e5307441ada2a
Instruction ID: b16b2e67e1bb6573384ad244012cb4d3c600d3d32b6774e6da87f161dbb6f5c7
Opcode Fuzzy Hash: 533b446a18bca8e8c4c838ee94f4eb5b9967c796f3db7034224e5307441ada2a
Instruction Fuzzy Hash: 3121BB72801938BBDF1277A8BC429EEBAB8AF51711F1100A4FD0071193EB344A919AA5

Function 6B946B2C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6B946B33
_JNU_GetEnv@8.JAVA(00010002,00000018), ref: 6B946B43
_JNU_ThrowNullPointerException@8.JAVA(00000000,null pData), ref: 6B946B7A

Strings

null pData, xrefs: 6B946BB7
peer, xrefs: 6B946B74

Memory Dump Source

Source File: 00000005.00000002.2267521549.000000006B8B1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8B0000, based on PE: true

Associated: 00000005.00000002.2267495654.000000006B8B0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267626294.000000006B969000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267685099.000000006B9A4000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267741690.000000006B9A6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267784368.000000006B9A7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267838865.000000006B9A8000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267863426.000000006B9A9000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AA000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AD000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267959620.000000006B9D0000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6b8b0000_javaw.jbxd

Similarity

API ID: Env@8Exception@8H_prolog3_catchNullPointerThrow
String ID: null pData$peer
API String ID: 1176200671-751156914
Opcode ID: 1085749d94943d887cadc3a2eb3d796df7a505b45b0c14f401c8ad029d58b69e
Instruction ID: 7a1568dedf2502802d8a71afa777c85c60586f8e1a6e5c839504ee2b3438eb30
Opcode Fuzzy Hash: 1085749d94943d887cadc3a2eb3d796df7a505b45b0c14f401c8ad029d58b69e
Instruction Fuzzy Hash: 0D317C70909604AFDF01EFB8C889DDD7BB5BF0A304F2044A9F5459B251DB79CA41DB51

Function 6B948ABE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6B948AC5
_JNU_GetEnv@8.JAVA(00010002,00000010), ref: 6B948AD5
_JNU_ThrowNullPointerException@8.JAVA(00000000,null target), ref: 6B948B23
SetLastError.KERNEL32(00000000), ref: 6B948B52

Strings

null target, xrefs: 6B948B1D

Memory Dump Source

Source File: 00000005.00000002.2267521549.000000006B8B1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8B0000, based on PE: true

Associated: 00000005.00000002.2267495654.000000006B8B0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267626294.000000006B969000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267685099.000000006B9A4000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267741690.000000006B9A6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267784368.000000006B9A7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267838865.000000006B9A8000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267863426.000000006B9A9000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AA000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AD000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267959620.000000006B9D0000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6b8b0000_javaw.jbxd

Similarity

API ID: Env@8ErrorException@8H_prolog3_catchLastNullPointerThrow
String ID: null target
API String ID: 3644746280-2084975241
Opcode ID: 0c74c684d7cce0cf9df898954eb29740ff17625d2e8300285fa03b93cdbe4ab4
Instruction ID: ba02bf4b2cd35a419fe3a688cca3ed8f437964983788748287ebbf6e9c364496
Opcode Fuzzy Hash: 0c74c684d7cce0cf9df898954eb29740ff17625d2e8300285fa03b93cdbe4ab4
Instruction Fuzzy Hash: 4D31A270904605EFDB149F78C8C9A9EBBB4BF09308F104469F945E7240D7B8CA40DB91

Function 6B952B9F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

_JNU_GetEnv@8.JAVA(00010002), ref: 6B952BB0
_JNU_ThrowNullPointerException@8.JAVA(00000000,peer), ref: 6B952BCE
_JNU_ThrowNullPointerException@8.JAVA(00000000,null pData,?,00010002), ref: 6B952C0A

Strings

null pData, xrefs: 6B952C04
peer, xrefs: 6B952BC8

Memory Dump Source

Source File: 00000005.00000002.2267521549.000000006B8B1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8B0000, based on PE: true

Associated: 00000005.00000002.2267495654.000000006B8B0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267626294.000000006B969000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267685099.000000006B9A4000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267741690.000000006B9A6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267784368.000000006B9A7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267838865.000000006B9A8000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267863426.000000006B9A9000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AA000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AD000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267959620.000000006B9D0000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6b8b0000_javaw.jbxd

Similarity

API ID: Exception@8NullPointerThrow$Env@8
String ID: null pData$peer
API String ID: 2682551001-751156914
Opcode ID: eabbe0d0db035a44d501f0505337eba8e9212e2c05c74d8460d78bd21758cb4d
Instruction ID: 0d37ef6a211103fcce675c7f276598ef08a57e8a600389fa707ebfdb07ed3a47
Opcode Fuzzy Hash: eabbe0d0db035a44d501f0505337eba8e9212e2c05c74d8460d78bd21758cb4d
Instruction Fuzzy Hash: 34116732144504BFEB12EF68C849EEE7BBCEF0A395B1000A4F94197261DB38DE518BA5

Function 6B952AED Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

_JNU_GetEnv@8.JAVA(00010002), ref: 6B952AFE
_JNU_ThrowNullPointerException@8.JAVA(00000000,peer), ref: 6B952B1C
_JNU_ThrowNullPointerException@8.JAVA(00000000,null pData,?,00010002), ref: 6B952B58

Strings

null pData, xrefs: 6B952B52
peer, xrefs: 6B952B16

Memory Dump Source

Source File: 00000005.00000002.2267521549.000000006B8B1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8B0000, based on PE: true

Associated: 00000005.00000002.2267495654.000000006B8B0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267626294.000000006B969000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267685099.000000006B9A4000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267741690.000000006B9A6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267784368.000000006B9A7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267838865.000000006B9A8000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267863426.000000006B9A9000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AA000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AD000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267959620.000000006B9D0000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6b8b0000_javaw.jbxd

Similarity

API ID: Exception@8NullPointerThrow$Env@8
String ID: null pData$peer
API String ID: 2682551001-751156914
Opcode ID: 1e73e4e5a3ae5336feaf01c0b1a5bab2985937944983c6aab9cd73007049af50
Instruction ID: c725f7c225eb1b1c2a3ff285cb6fbc637409054f9f6f6b7006d5961827f94209
Opcode Fuzzy Hash: 1e73e4e5a3ae5336feaf01c0b1a5bab2985937944983c6aab9cd73007049af50
Instruction Fuzzy Hash: BD115E32544604BFEB12DF68C849EEE7BBDEF0A354B100064F94597250DB39DD518BA5

Function 00024A44 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 000247B7: __stat64i32.LIBCMT ref: 00024812

_strlen.LIBCMT ref: 00024A79
_strlen.LIBCMT ref: 00024A87
LoadLibraryA.KERNEL32(?), ref: 00024AB9
GetProcAddress.KERNEL32(00000000,?), ref: 00024ACA

Strings

_JAVA_SPLASH_FILE, xrefs: 00024A72

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: _strlen$AddressLibraryLoadProc__stat64i32
String ID: _JAVA_SPLASH_FILE
API String ID: 381143760-1214838622
Opcode ID: 2b5026f67e38457b7ea241cfad8046b9dcd588cd3bf51c6f0b2a7007cf12f83c
Instruction ID: d5f4be7de532b82a4f6cd22432caef013bfe1c1d0c6d98457fb7ff7ecf7cb238
Opcode Fuzzy Hash: 2b5026f67e38457b7ea241cfad8046b9dcd588cd3bf51c6f0b2a7007cf12f83c
Instruction Fuzzy Hash: E001ED76A042299BEB44EBA5FC85ADA73ACEB01325F000066E640E7141EB38DD94CB58

Function 6B92EB56 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

_JNU_GetEnv@8.JAVA(00010002,?,6B92EC15), ref: 6B92EB64

Part of subcall function 6B92D8BC: _JNU_GetEnv@8.JAVA(00010002,?,00000000,?,?,6B92EB84,win.properties.version,00000003,?,?,6B92EC15), ref: 6B92D8D0
Part of subcall function 6B92D8BC: wcslen.MSVCR100 ref: 6B92D8DA
Part of subcall function 6B92D8BC: _CxxThrowException.MSVCR100(?,6B989388), ref: 6B92D907
Part of subcall function 6B92D8BC: _JNU_GetEnv@8.JAVA(00010002,?,?,6B92EB84,win.properties.version,00000003,?,?,6B92EC15), ref: 6B92D913
Part of subcall function 6B92D8BC: _JNU_GetEnv@8.JAVA(00010002), ref: 6B92D934

Part of subcall function 6B92E212: GetVersion.KERNEL32(00000000), ref: 6B92E22A

Part of subcall function 6B92E628: __EH_prolog3_catch.LIBCMT ref: 6B92E62F
Part of subcall function 6B92E628: GetVersion.KERNEL32(win.text.fontSmoothingOn,00000000,win.frame.fullWindowDragsOn,00000000,00000030,6B92EBA7,win.properties.version,00000003,?,?,6B92EC15), ref: 6B92E669
Part of subcall function 6B92E628: GetVersion.KERNEL32(?,?,6B92EC15), ref: 6B92E66F
Part of subcall function 6B92E628: GetVersion.KERNEL32(?,?,6B92EC15), ref: 6B92E678
Part of subcall function 6B92E628: GetSystemMetrics.USER32(00000044), ref: 6B92E6C8
Part of subcall function 6B92E628: GetSystemMetrics.USER32(00000045), ref: 6B92E6CE
Part of subcall function 6B92E628: GetDoubleClickTime.USER32(awt.mouse.numButtons,00000000,DnD.gestureMotionThreshold,?,win.drag.height,?,win.drag.width,00000000,?,?,6B92EC15), ref: 6B92E71C
Part of subcall function 6B92E628: GetSystemMetrics.USER32(0000004B), ref: 6B92E746

Part of subcall function 6B92E06C: __EH_prolog3_catch.LIBCMT ref: 6B92E073

GetVersion.KERNEL32(win.properties.version,00000003,?,?,6B92EC15), ref: 6B92EBBB
GetVersion.KERNEL32(?,?,6B92EC15), ref: 6B92EBC1
GetVersion.KERNEL32(?,?,6B92EC15), ref: 6B92EBCA

Strings

win.properties.version, xrefs: 6B92EB78

Memory Dump Source

Source File: 00000005.00000002.2267521549.000000006B8B1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8B0000, based on PE: true

Associated: 00000005.00000002.2267495654.000000006B8B0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267626294.000000006B969000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267685099.000000006B9A4000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267741690.000000006B9A6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267784368.000000006B9A7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267838865.000000006B9A8000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267863426.000000006B9A9000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AA000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AD000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267959620.000000006B9D0000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6b8b0000_javaw.jbxd

Similarity

API ID: Version$Env@8$MetricsSystem$H_prolog3_catch$ClickDoubleExceptionThrowTimewcslen
String ID: win.properties.version
API String ID: 297521648-1571471729
Opcode ID: 7bbb2c9619664a59d4a2bc862776954fbf906eb608952b382a842de67ad4e5e9
Instruction ID: 7c8274bd85a456af01c1ca0159b17bd11afabb68c6b6bf9f6a852ea952172f23
Opcode Fuzzy Hash: 7bbb2c9619664a59d4a2bc862776954fbf906eb608952b382a842de67ad4e5e9
Instruction Fuzzy Hash: 99F06924F74C2452A81A32399CA6AAC221A5FE6A1C7410429D1035B28CCF7CC943879A

Function 6B8B4B9F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

_JNU_ThrowNullPointerException@8.JAVA(?,Attempt to lock missing colormap), ref: 6B8B4BBE
_SurfaceData_IntersectBounds@8.AWT(?,?), ref: 6B8B4BE6
_JNU_ThrowNullPointerException@8.JAVA(?,Could not initialize inverse tables), ref: 6B8B4C0D

Strings

Could not initialize inverse tables, xrefs: 6B8B4C07
Attempt to lock missing colormap, xrefs: 6B8B4BB6

Memory Dump Source

Source File: 00000005.00000002.2267521549.000000006B8B1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8B0000, based on PE: true

Associated: 00000005.00000002.2267495654.000000006B8B0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267626294.000000006B969000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267685099.000000006B9A4000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267741690.000000006B9A6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267784368.000000006B9A7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267838865.000000006B9A8000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267863426.000000006B9A9000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AA000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AD000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267959620.000000006B9D0000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6b8b0000_javaw.jbxd

Similarity

API ID: Exception@8NullPointerThrow$Bounds@8Data_IntersectSurface
String ID: Attempt to lock missing colormap$Could not initialize inverse tables
API String ID: 2795543317-2757055519
Opcode ID: 8baac10043742c7286a51c081784ad8c79b819af1826eca43775c2412966a679
Instruction ID: fcede05b976402ea558e8ec017251dd169bbfa19f5cf7a8c17384acba5c5a972
Opcode Fuzzy Hash: 8baac10043742c7286a51c081784ad8c79b819af1826eca43775c2412966a679
Instruction Fuzzy Hash: 3B01D831405609ABDB209F79D885B4A3BA8AF9137EF040955FE14972C2E77DD8148BA1

Function 6B942BEF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 46registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Keyboard Layout\Preload,00000000,00020019,?,00000001), ref: 6B942C1D
RegQueryValueExW.ADVAPI32(?,6B9841C4,00000000,00000000,?,00000010), ref: 6B942C39
wcstoul.MSVCR100 ref: 6B942C4D
RegCloseKey.ADVAPI32(?), ref: 6B942C5B

Strings

Keyboard Layout\Preload, xrefs: 6B942C0C

Memory Dump Source

Source File: 00000005.00000002.2267521549.000000006B8B1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8B0000, based on PE: true

Associated: 00000005.00000002.2267495654.000000006B8B0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267626294.000000006B969000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267685099.000000006B9A4000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267741690.000000006B9A6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267784368.000000006B9A7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267838865.000000006B9A8000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267863426.000000006B9A9000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AA000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AD000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267959620.000000006B9D0000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6b8b0000_javaw.jbxd

Similarity

API ID: CloseOpenQueryValuewcstoul
String ID: Keyboard Layout\Preload
API String ID: 4145366269-3340346415
Opcode ID: abb0b09a37fe7ea5216ef3a66db488c2c267cdfb8b006675d9d7bf28003434d6
Instruction ID: 5cdf2de83eae367d9eb213a619c0fc7618dfccbeff5e8d71d257042055e340b9
Opcode Fuzzy Hash: abb0b09a37fe7ea5216ef3a66db488c2c267cdfb8b006675d9d7bf28003434d6
Instruction Fuzzy Hash: 64011A71A0410DBBEB108BA5CC89EBFBBBCEB99705F000429E901E2140EA74D955DB60

Function 000213BF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 00025476: __wgetenv.LIBCMT ref: 000254B0

_strlen.LIBCMT ref: 000213D1
_strlen.LIBCMT ref: 000213DA
_strlen.LIBCMT ref: 000213E7

Part of subcall function 00023904: _malloc.LIBCMT ref: 00023908
Part of subcall function 00023904: _perror.LIBCMT ref: 00023917

_sprintf.LIBCMT ref: 000213FE

Strings

-Djava.class.path=%s, xrefs: 000213F8

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: _strlen$__wgetenv_malloc_perror_sprintf
String ID: -Djava.class.path=%s
API String ID: 448369934-2416158790
Opcode ID: e6c4e5b679508970e6500807a38babfff0cac5c30c44320ec73aed271cec4485
Instruction ID: 49c4e0c0832741e08db55a877460eeb69614881b8a678dcea97d12eb06eefefd
Opcode Fuzzy Hash: e6c4e5b679508970e6500807a38babfff0cac5c30c44320ec73aed271cec4485
Instruction Fuzzy Hash: F7F06DB7A4123436993136797C83FEF42AC8F92754F050035F908F7143EE588A9284F6

Function 6B942B7C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6B942B83

Part of subcall function 6B95F49D: _JNU_GetEnv@8.JAVA(6C975A58,00010002,6B95A2EA,00000004,6B8C7083,?,00000020,?,00000020,?), ref: 6B95F4AC

Part of subcall function 6B954450: GetCurrentThreadId.KERNEL32 ref: 6B95448B
Part of subcall function 6B954450: _CxxThrowException.MSVCR100(?,6B989788), ref: 6B9544A7
Part of subcall function 6B954450: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,000000FF,?,6B989788), ref: 6B9544B6
Part of subcall function 6B954450: WaitForSingleObject.KERNEL32(00000000), ref: 6B9544BD

JNU_CallStaticMethodByName.JAVA(?,00000000,java/util/Locale,forLanguageTag,(Ljava/lang/String;)Ljava/util/Locale;,00000000), ref: 6B942BBE

Strings

(Ljava/lang/String;)Ljava/util/Locale;, xrefs: 6B942BAC
java/util/Locale, xrefs: 6B942BB6
forLanguageTag, xrefs: 6B942BB1

Memory Dump Source

Source File: 00000005.00000002.2267521549.000000006B8B1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8B0000, based on PE: true

Associated: 00000005.00000002.2267495654.000000006B8B0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267626294.000000006B969000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267685099.000000006B9A4000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267741690.000000006B9A6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267784368.000000006B9A7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267838865.000000006B9A8000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267863426.000000006B9A9000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AA000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AD000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267959620.000000006B9D0000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6b8b0000_javaw.jbxd

Similarity

API ID: CallCreateCurrentEnv@8EventExceptionH_prolog3_catchMethodNameObjectSingleStaticThreadThrowWait
String ID: (Ljava/lang/String;)Ljava/util/Locale;$forLanguageTag$java/util/Locale
API String ID: 3925435092-3289162403
Opcode ID: ae1d7c68e109c574ac410169bf6d3d315b10eba991e4e13d317666132ced03df
Instruction ID: c5735dc0a1be70548cc7922925dc4f18d839ccd7aeeff51b1e2f792b4e8bd202
Opcode Fuzzy Hash: ae1d7c68e109c574ac410169bf6d3d315b10eba991e4e13d317666132ced03df
Instruction Fuzzy Hash: 96F0E234A50200ABDB51AFB88C06F5E77B8AFB625DF108459FC44AB300E77CE9008A61

Function 6B8C6BB0 Relevance: 7.6, APIs: 5, Instructions: 117pipeCOMMON

Download Yara Rule

APIs

?GetInstance@D3DPipelineManager@@SAPAV1@XZ.AWT ref: 6B8C6BCC
?GetAdapterOrdinalForScreen@D3DPipelineManager@@QAEIJ@Z.AWT(?), ref: 6B8C6BF5
?GetD3DContext@D3DPipelineManager@@QAEJIPAPAVD3DContext@@@Z.AWT(00000000,?,?), ref: 6B8C6C04

Memory Dump Source

Source File: 00000005.00000002.2267521549.000000006B8B1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8B0000, based on PE: true

Associated: 00000005.00000002.2267495654.000000006B8B0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267626294.000000006B969000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267685099.000000006B9A4000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267741690.000000006B9A6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267784368.000000006B9A7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267838865.000000006B9A8000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267863426.000000006B9A9000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AA000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AD000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267959620.000000006B9D0000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6b8b0000_javaw.jbxd

Similarity

API ID: Manager@@Pipeline$AdapterContext@Context@@@Instance@OrdinalScreen@
String ID:
API String ID: 2689482991-0
Opcode ID: 9e18eb562ef2d5c92f61f87f263125eb281cc652e28990641e8e961249b7e56d
Instruction ID: 76f2a17db7b842e1859e69b91b9ada6896928c8d7d4f9dafabb49d9a14dfa26c
Opcode Fuzzy Hash: 9e18eb562ef2d5c92f61f87f263125eb281cc652e28990641e8e961249b7e56d
Instruction Fuzzy Hash: A0315BB1A083459BD704DF78C88196FB7E9AFD8708F00492EE98587211DB78D904CBA3

Function 0002A0BD Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0002A0CB

Part of subcall function 0002A029: __FF_MSGBANNER.LIBCMT ref: 0002A042
Part of subcall function 0002A029: __NMSG_WRITE.LIBCMT ref: 0002A049
Part of subcall function 0002A029: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,0002FE09,?,00000001,?,?,0002CE37,00000018,00042708,0000000C,0002CEC7), ref: 0002A06E

_free.LIBCMT ref: 0002A0DE

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 6d680ce837b2b5a4b5c9416e625f360ec1590435308feb6560a0d4518d91ca7a
Instruction ID: b96f4e24f4479d8e5e3416780b14b5e90897db04fac6666399b81bc49ce665e9
Opcode Fuzzy Hash: 6d680ce837b2b5a4b5c9416e625f360ec1590435308feb6560a0d4518d91ca7a
Instruction Fuzzy Hash: 1A11CE32600631ABDB362F74B805B9E37E99F923B0F204926F9489A152EF34CC508792

Function 000351E6 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 000351F2

Part of subcall function 0002D50A: __getptd_noexit.LIBCMT ref: 0002D50D
Part of subcall function 0002D50A: __amsg_exit.LIBCMT ref: 0002D51A

__getptd.LIBCMT ref: 00035209
__amsg_exit.LIBCMT ref: 00035217
__lock.LIBCMT ref: 00035227
__updatetlocinfoEx_nolock.LIBCMT ref: 0003523B

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 478a140de165eef8c8a51fcabe1b80056fe95bb16a228062496815b4dfc6d89a
Instruction ID: 45aa6a5cd5c53278620752179026e43b98e6eb0d7a3779a659d5540e3fef9696
Opcode Fuzzy Hash: 478a140de165eef8c8a51fcabe1b80056fe95bb16a228062496815b4dfc6d89a
Instruction Fuzzy Hash: E0F09C71A44F209BE752BB647C13B8E73D49F05711F158509F014AB1E3CB644D409655

Function 0002AEE9 Relevance: 7.5, APIs: 5, Instructions: 24threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00028A20: _doexit.LIBCMT ref: 00028A2C

___set_flsgetvalue.LIBCMT ref: 0002AEFB

Part of subcall function 0002D34F: TlsGetValue.KERNEL32(?,0002AF00), ref: 0002D358
Part of subcall function 0002D34F: DecodePointer.KERNEL32(?,0002AF00), ref: 0002D36A
Part of subcall function 0002D34F: TlsSetValue.KERNEL32(00000000,?,0002AF00), ref: 0002D379

___fls_getvalue@4.LIBCMT ref: 0002AF06

Part of subcall function 0002D32F: TlsGetValue.KERNEL32(?,?,0002AF0B,00000000), ref: 0002D33D

___fls_setvalue@8.LIBCMT ref: 0002AF19

Part of subcall function 0002D383: DecodePointer.KERNEL32(?,?,?,0002AF1E,00000000,?,00000000), ref: 0002D394

GetLastError.KERNEL32(00000000,?,00000000), ref: 0002AF22
ExitThread.KERNEL32 ref: 0002AF29
GetCurrentThreadId.KERNEL32 ref: 0002AF2F
__freefls@4.LIBCMT ref: 0002AF4F

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: Value$DecodePointerThread$CurrentErrorExitLast___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
String ID:
API String ID: 781180411-0
Opcode ID: eae25ab57c88092aa0fa204d3ee7f0627cf8511c73f891e878e02fac6fff1275
Instruction ID: bc8ee0511709719c3c9591f2be49cdcc3a4bedb95eccb83402bd38cce4ab8dc1
Opcode Fuzzy Hash: eae25ab57c88092aa0fa204d3ee7f0627cf8511c73f891e878e02fac6fff1275
Instruction Fuzzy Hash: 85E04F69800275A79F817BF1FD0A9CF3B6C5F41340B040412BD10E3003EE2C9E1147A3

Function 6B90AB67 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 329COMMON

Download Yara Rule

APIs

_JNU_ThrowArrayIndexOutOfBoundsException@8.JAVA(?,band array), ref: 6B90AB88

Strings

alpha tile array, xrefs: 6B90AF10
band array, xrefs: 6B90AB82

Memory Dump Source

Source File: 00000005.00000002.2267521549.000000006B8B1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8B0000, based on PE: true

Associated: 00000005.00000002.2267495654.000000006B8B0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267626294.000000006B969000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267685099.000000006B9A4000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267741690.000000006B9A6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267784368.000000006B9A7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267838865.000000006B9A8000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267863426.000000006B9A9000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AA000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AD000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267959620.000000006B9D0000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6b8b0000_javaw.jbxd

Similarity

API ID: ArrayBoundsException@8IndexThrow
String ID: alpha tile array$band array
API String ID: 540364022-1923403480
Opcode ID: bafb18dc4713113952f7feb08bb97c3d1be1eb8600fc19b7a4851fb3e25f91e1
Instruction ID: 161a5548afaf06d77d6f363c98123ffe1ab73b2eb3bc7fb380bc4d3935069c75
Opcode Fuzzy Hash: bafb18dc4713113952f7feb08bb97c3d1be1eb8600fc19b7a4851fb3e25f91e1
Instruction Fuzzy Hash: B8E1D675900519EFCB01CFA8C984A9EBBF6FF49300F2580A9F944AB255D734EA51CFA4

Function 6B948BC1 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 128COMMON

Download Yara Rule

APIs

_JNU_ThrowNullPointerException@8.JAVA(?,peer), ref: 6B948C1B
_JNU_ThrowNullPointerException@8.JAVA(?,null pData), ref: 6B948C62

Strings

null pData, xrefs: 6B948C5C
peer, xrefs: 6B948C15

Memory Dump Source

Source File: 00000005.00000002.2267521549.000000006B8B1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8B0000, based on PE: true

Associated: 00000005.00000002.2267495654.000000006B8B0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267626294.000000006B969000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267685099.000000006B9A4000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267741690.000000006B9A6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267784368.000000006B9A7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267838865.000000006B9A8000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267863426.000000006B9A9000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AA000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AD000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267959620.000000006B9D0000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6b8b0000_javaw.jbxd

Similarity

API ID: Exception@8NullPointerThrow
String ID: null pData$peer
API String ID: 473278687-751156914
Opcode ID: 5d9b269ffae1a16a421eecc0303865ede4df4e2bdabe5c26bb258ce040390484
Instruction ID: e587eee5295336d853826a11804f79af76d59af5c38feb5fb10b89c55e2e7ff8
Opcode Fuzzy Hash: 5d9b269ffae1a16a421eecc0303865ede4df4e2bdabe5c26bb258ce040390484
Instruction Fuzzy Hash: 9C411471905509AFDB019FA8C888DEEBBF8FF0E315B100069F942A6250CB39D951CFA5

Function 0002129B Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 93COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 000212F3

Part of subcall function 00023904: _malloc.LIBCMT ref: 00023908
Part of subcall function 00023904: _perror.LIBCMT ref: 00023917

Strings

-Xmx, xrefs: 0002135B
-Xms, xrefs: 0002138B
-Xss, xrefs: 00021326

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: _malloc_memmove_perror
String ID: -Xms$-Xmx$-Xss
API String ID: 3795916911-1591921524
Opcode ID: bae59073035d2636c54d9ec77660bbcf66e89a139828157aeb265eb40c4f2728
Instruction ID: 55b10a6f6c9a565d79d59fe6fd0cd9fdf219e367003dac171275f675705ced3c
Opcode Fuzzy Hash: bae59073035d2636c54d9ec77660bbcf66e89a139828157aeb265eb40c4f2728
Instruction Fuzzy Hash: 8031B6B8604615AFE700DF24FE419D877F9EB8A31AF400119FC04DB263E738AA85CB14

Function 6B95CBD1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6B95CBD8
_JNU_ThrowNullPointerException@8.JAVA(?,iconRaster data), ref: 6B95CC16
memset.MSVCR100 ref: 6B95CC69

Strings

iconRaster data, xrefs: 6B95CC10

Memory Dump Source

Source File: 00000005.00000002.2267521549.000000006B8B1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8B0000, based on PE: true

Associated: 00000005.00000002.2267495654.000000006B8B0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267626294.000000006B969000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267685099.000000006B9A4000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267741690.000000006B9A6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267784368.000000006B9A7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267838865.000000006B9A8000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267863426.000000006B9A9000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AA000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AD000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267959620.000000006B9D0000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6b8b0000_javaw.jbxd

Similarity

API ID: Exception@8H_prolog3_catchNullPointerThrowmemset
String ID: iconRaster data
API String ID: 1709764402-3591564486
Opcode ID: 74672df91c6a6c19c57fcc83fa332acac56c7e9c31bd6b498251702d4f74bc83
Instruction ID: 8d22f8cb45eb9ab27b984c9d3ffb3a2c21215346f60bd20eb37f5146efa9db79
Opcode Fuzzy Hash: 74672df91c6a6c19c57fcc83fa332acac56c7e9c31bd6b498251702d4f74bc83
Instruction Fuzzy Hash: 802189B2D00219EFDB11DFB4CD85A9E7BB8AF09708F10456AF914A7290D738CA10DBA1

Function 0002192A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0002193E
_strlen.LIBCMT ref: 00021953
_strlen.LIBCMT ref: 00021968

Strings

-Dsun.java.command=, xrefs: 00021962, 00021967, 00021979

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: _strlen
String ID: -Dsun.java.command=
API String ID: 4218353326-3397619990
Opcode ID: c38b914d9271cd0b6cff80512390d561bb31ffa5936b7e8faac8d0f877b67364
Instruction ID: fb5bcb540b52913803b6827543dc5d142d63d3fb4ead72b130e3ab886b401024
Opcode Fuzzy Hash: c38b914d9271cd0b6cff80512390d561bb31ffa5936b7e8faac8d0f877b67364
Instruction Fuzzy Hash: E001A13250423AAAD7126E98BCC6EEEB7ACAB55750F150029F944A7003DB21A952C7E1

Function 6B920AA4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6B920AAB

Part of subcall function 6B95F49D: _JNU_GetEnv@8.JAVA(6C975A58,00010002,6B95A2EA,00000004,6B8C7083,?,00000020,?,00000020,?), ref: 6B95F4AC

Part of subcall function 6B954450: GetCurrentThreadId.KERNEL32 ref: 6B95448B
Part of subcall function 6B954450: _CxxThrowException.MSVCR100(?,6B989788), ref: 6B9544A7
Part of subcall function 6B954450: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,000000FF,?,6B989788), ref: 6B9544B6
Part of subcall function 6B954450: WaitForSingleObject.KERNEL32(00000000), ref: 6B9544BD

_JNU_ThrowNullPointerException@8.JAVA(?,null pData), ref: 6B920AD4

Part of subcall function 6B953EC0: _JNU_GetEnv@8.JAVA(6C975A58,00010002,?,?), ref: 6B953ED2

Strings

null pData, xrefs: 6B920B10
peer, xrefs: 6B920ACE

Memory Dump Source

Source File: 00000005.00000002.2267521549.000000006B8B1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8B0000, based on PE: true

Associated: 00000005.00000002.2267495654.000000006B8B0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267626294.000000006B969000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267685099.000000006B9A4000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267741690.000000006B9A6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267784368.000000006B9A7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267838865.000000006B9A8000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267863426.000000006B9A9000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AA000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AD000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267959620.000000006B9D0000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6b8b0000_javaw.jbxd

Similarity

API ID: Env@8Throw$CreateCurrentEventExceptionException@8H_prolog3_catchNullObjectPointerSingleThreadWait
String ID: null pData$peer
API String ID: 2776560734-751156914
Opcode ID: 2a24b84ecf25d17cdac5816b37b7ffbf06a2df6087185e770dbeee7793c011d5
Instruction ID: a9d2f0804847cc336f06c50db11257c2ab160dbdaadd87d58221844335dd036b
Opcode Fuzzy Hash: 2a24b84ecf25d17cdac5816b37b7ffbf06a2df6087185e770dbeee7793c011d5
Instruction Fuzzy Hash: 3B117C39854504EFEB21AFA4C819FAE3BB9FF55308F2140A4F95466254D739C6508F62

Function 6B944AE1 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6B944AE8

Part of subcall function 6B95F49D: _JNU_GetEnv@8.JAVA(6C975A58,00010002,6B95A2EA,00000004,6B8C7083,?,00000020,?,00000020,?), ref: 6B95F4AC

Part of subcall function 6B954450: GetCurrentThreadId.KERNEL32 ref: 6B95448B
Part of subcall function 6B954450: _CxxThrowException.MSVCR100(?,6B989788), ref: 6B9544A7
Part of subcall function 6B954450: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,000000FF,?,6B989788), ref: 6B9544B6
Part of subcall function 6B954450: WaitForSingleObject.KERNEL32(00000000), ref: 6B9544BD

_JNU_ThrowNullPointerException@8.JAVA(?,null pData), ref: 6B944B11

Part of subcall function 6B953EC0: _JNU_GetEnv@8.JAVA(6C975A58,00010002,?,?), ref: 6B953ED2

Strings

null pData, xrefs: 6B944B4D
peer, xrefs: 6B944B0B

Memory Dump Source

Source File: 00000005.00000002.2267521549.000000006B8B1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8B0000, based on PE: true

Associated: 00000005.00000002.2267495654.000000006B8B0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267626294.000000006B969000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267685099.000000006B9A4000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267741690.000000006B9A6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267784368.000000006B9A7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267838865.000000006B9A8000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267863426.000000006B9A9000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AA000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AD000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267959620.000000006B9D0000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6b8b0000_javaw.jbxd

Similarity

API ID: Env@8Throw$CreateCurrentEventExceptionException@8H_prolog3_catchNullObjectPointerSingleThreadWait
String ID: null pData$peer
API String ID: 2776560734-751156914
Opcode ID: f01738d9b47c382fa704c06ba85a73d7ffb403287d0848b060397a6b56617393
Instruction ID: 1f39fcb7a58c93b81ebcf5f11e629a9ca2f59d9168657fc48e4571092a2ff295
Opcode Fuzzy Hash: f01738d9b47c382fa704c06ba85a73d7ffb403287d0848b060397a6b56617393
Instruction Fuzzy Hash: 0411A935900500AFEB22AFB4C818FDE3BB9AF45348F2080A4F9141A350DB39DA10CF62

Function 6B942A14 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6B942A1B

Part of subcall function 6B95F49D: _JNU_GetEnv@8.JAVA(6C975A58,00010002,6B95A2EA,00000004,6B8C7083,?,00000020,?,00000020,?), ref: 6B95F4AC

Part of subcall function 6B954450: GetCurrentThreadId.KERNEL32 ref: 6B95448B
Part of subcall function 6B954450: _CxxThrowException.MSVCR100(?,6B989788), ref: 6B9544A7
Part of subcall function 6B954450: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,000000FF,?,6B989788), ref: 6B9544B6
Part of subcall function 6B954450: WaitForSingleObject.KERNEL32(00000000), ref: 6B9544BD

_JNU_ThrowNullPointerException@8.JAVA(?,null pData), ref: 6B942A44

Strings

null pData, xrefs: 6B942A80
peer, xrefs: 6B942A3E

Memory Dump Source

Source File: 00000005.00000002.2267521549.000000006B8B1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8B0000, based on PE: true

Associated: 00000005.00000002.2267495654.000000006B8B0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267626294.000000006B969000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267685099.000000006B9A4000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267741690.000000006B9A6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267784368.000000006B9A7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267838865.000000006B9A8000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267863426.000000006B9A9000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AA000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AD000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267959620.000000006B9D0000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6b8b0000_javaw.jbxd

Similarity

API ID: Throw$CreateCurrentEnv@8EventExceptionException@8H_prolog3_catchNullObjectPointerSingleThreadWait
String ID: null pData$peer
API String ID: 608574450-751156914
Opcode ID: b61f89deedc4cdd6c6a887dcfc0daf2863b92a2747f2926b4043dcdbb98d24f6
Instruction ID: a6e9666c7c206657255ff8bf8d1a5d4e6e4a128f5c36a59f005e7adb0df9618d
Opcode Fuzzy Hash: b61f89deedc4cdd6c6a887dcfc0daf2863b92a2747f2926b4043dcdbb98d24f6
Instruction Fuzzy Hash: E401C035514510ABE721DFA88808EBE3BB9BF96708F214098F9419B291DB3CC950CBB6

Function 00023EAE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,Software\JavaSoft\Java Runtime Environment,00000000,00020019,00000000), ref: 00023EE5
RegCloseKey.ADVAPI32(00000000), ref: 00023F0B

Part of subcall function 00023D83: RegEnumKeyA.ADVAPI32(80000001,00000000,?,00000104), ref: 00023DCA
Part of subcall function 00023D83: RegEnumKeyA.ADVAPI32(?,?,?,00000104), ref: 00023E1A

RegCloseKey.ADVAPI32(00000000), ref: 00023F23

Strings

Software\JavaSoft\Java Runtime Environment, xrefs: 00023EDC

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: CloseEnum$Open
String ID: Software\JavaSoft\Java Runtime Environment
API String ID: 956018044-786720643
Opcode ID: 334f2bbd04495ca9d6a7d80f8b2b8abc174ea9be871fcd63e425c258e3501098
Instruction ID: 5210d4bc5aefa7fa6d7042babb2e38bbee929dbdafd0ec37a460f6153451551e
Opcode Fuzzy Hash: 334f2bbd04495ca9d6a7d80f8b2b8abc174ea9be871fcd63e425c258e3501098
Instruction Fuzzy Hash: CE018F32E04229FBEF959B98FE45B9DBBB8EB04304F204079E504A2051D7B99F44AB40

Function 6B91CB30 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

J2dTraceImpl.AWT(00000001,00000001,WGLGC_DestroyOGLContext: context is null,6B91D51F), ref: 6B91CB3D

Part of subcall function 6B90EA57: _J2dTraceInit@0.AWT(?,6B8B4EE4,00000001,00000001,BufferedMaskBlit_enqueueTile: cannot lock mask array), ref: 6B90EA63
Part of subcall function 6B90EA57: fprintf.MSVCR100 ref: 6B90EABA
Part of subcall function 6B90EA57: vfprintf.MSVCR100 ref: 6B90EACB
Part of subcall function 6B90EA57: fprintf.MSVCR100 ref: 6B90EAE5
Part of subcall function 6B90EA57: fflush.MSVCR100 ref: 6B90EAEF

free.MSVCR100 ref: 6B91CB95
free.MSVCR100 ref: 6B91CB9B

Strings

WGLGC_DestroyOGLContext: context is null, xrefs: 6B91CB34

Memory Dump Source

Source File: 00000005.00000002.2267521549.000000006B8B1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8B0000, based on PE: true

Associated: 00000005.00000002.2267495654.000000006B8B0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267626294.000000006B969000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267685099.000000006B9A4000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267741690.000000006B9A6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267784368.000000006B9A7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267838865.000000006B9A8000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267863426.000000006B9A9000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AA000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AD000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267959620.000000006B9D0000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6b8b0000_javaw.jbxd

Similarity

API ID: Tracefprintffree$ImplInit@0fflushvfprintf
String ID: WGLGC_DestroyOGLContext: context is null
API String ID: 3805858621-1708994239
Opcode ID: 486c2b3303b589af37fb8c4de315844b6d6d08b7cfe523b939af3bc3d85d4fcc
Instruction ID: fcc33dc237ddea3b958ba6c233c5783bdc4c033603398fcaef665c2c61a60af2
Opcode Fuzzy Hash: 486c2b3303b589af37fb8c4de315844b6d6d08b7cfe523b939af3bc3d85d4fcc
Instruction Fuzzy Hash: 24F0A475A48600BBEA209B749C85F6B337CEF05B55F108478FD1AE7240DB2DE454DA62

Function 6B94EA3D Relevance: 6.2, APIs: 4, Instructions: 202COMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32(?), ref: 6B94EA92
GlobalUnlock.KERNEL32(?), ref: 6B94EAAF
GlobalLock.KERNEL32(00000000), ref: 6B94EB82
GlobalUnlock.KERNEL32(00000000), ref: 6B94EBDC

Memory Dump Source

Source File: 00000005.00000002.2267521549.000000006B8B1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8B0000, based on PE: true

Associated: 00000005.00000002.2267495654.000000006B8B0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267626294.000000006B969000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267685099.000000006B9A4000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267741690.000000006B9A6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267784368.000000006B9A7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267838865.000000006B9A8000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267863426.000000006B9A9000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AA000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AD000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267959620.000000006B9D0000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6b8b0000_javaw.jbxd

Similarity

API ID: Global$LockUnlock
String ID:
API String ID: 2502338518-0
Opcode ID: 857972b6a916465fbfcb36e4406d45911ca29dacfb36e6d53c53c21472e2b251
Instruction ID: 640449d5f5a2af53004a27ba38c7cc120ea873611435158a4a572515029d74cd
Opcode Fuzzy Hash: 857972b6a916465fbfcb36e4406d45911ca29dacfb36e6d53c53c21472e2b251
Instruction Fuzzy Hash: 15718070914A0AFFDF14EF78D8855AEBFB8FF08308F1184A9E59492250EB35D928CB55

Function 00037B52 Relevance: 6.2, APIs: 4, Instructions: 173COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00037B60

Part of subcall function 0002CA70: __getptd.LIBCMT ref: 0002CA83

Part of subcall function 0002AB01: __getptd_noexit.LIBCMT ref: 0002AB01

__stricmp_l.LIBCMT ref: 00037BCD

Part of subcall function 0003B2F9: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0003B308

___crtLCMapStringA.LIBCMT ref: 00037C23
___crtLCMapStringA.LIBCMT ref: 00037CA4

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: Locale$StringUpdateUpdate::____crt$__getptd__getptd_noexit__stricmp_l
String ID:
API String ID: 2544346105-0
Opcode ID: 8e7860e23ef72dec1a3cdfffbdb85141dbd8d903dbe0353ee267e1089c401864
Instruction ID: c5675bbfbbff4891c3f61a03dbe5c15db03f69b9b9ffe04ff293a1d615ecda07
Opcode Fuzzy Hash: 8e7860e23ef72dec1a3cdfffbdb85141dbd8d903dbe0353ee267e1089c401864
Instruction Fuzzy Hash: C65106B0918299ABDB3B8B65C485BFD7BF8AF02324F2842D9E4A55A1D2D7308E41D750

Function 000363F0 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00036424
__isleadbyte_l.LIBCMT ref: 00036457
MultiByteToWideChar.KERNEL32(00000080,00000009,00000000,?,00000000,00000000,?,?,?,?,00000000,00000000), ref: 00036488
MultiByteToWideChar.KERNEL32(00000080,00000009,00000000,00000001,00000000,00000000,?,?,?,?,00000000,00000000), ref: 000364F6

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 061ba6a30e1575c9477696d23efc4a266ba7e2a42d18c4f30ee7013d77fc0abd
Instruction ID: 934fa0048642f20a8788e7e7259f81572432c052c2bf70dfd08be3890eeedaba
Opcode Fuzzy Hash: 061ba6a30e1575c9477696d23efc4a266ba7e2a42d18c4f30ee7013d77fc0abd
Instruction Fuzzy Hash: 6731BD31E00256FFDB22DF64C881AAE3BE9AF01314F14C5A9E4618B191D732DD80DB51

Function 6B942ABF Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6B942AC6

Part of subcall function 6B95F49D: _JNU_GetEnv@8.JAVA(6C975A58,00010002,6B95A2EA,00000004,6B8C7083,?,00000020,?,00000020,?), ref: 6B95F4AC

Part of subcall function 6B954450: GetCurrentThreadId.KERNEL32 ref: 6B95448B
Part of subcall function 6B954450: _CxxThrowException.MSVCR100(?,6B989788), ref: 6B9544A7
Part of subcall function 6B954450: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,000000FF,?,6B989788), ref: 6B9544B6
Part of subcall function 6B954450: WaitForSingleObject.KERNEL32(00000000), ref: 6B9544BD

wcslen.MSVCR100 ref: 6B942B22
free.MSVCR100 ref: 6B942B3B
_CxxThrowException.MSVCR100(?,6B989388), ref: 6B942B5C

Memory Dump Source

Source File: 00000005.00000002.2267521549.000000006B8B1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8B0000, based on PE: true

Associated: 00000005.00000002.2267495654.000000006B8B0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267626294.000000006B969000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267685099.000000006B9A4000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267741690.000000006B9A6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267784368.000000006B9A7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267838865.000000006B9A8000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267863426.000000006B9A9000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AA000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AD000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267959620.000000006B9D0000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6b8b0000_javaw.jbxd

Similarity

API ID: ExceptionThrow$CreateCurrentEnv@8EventH_prolog3_catchObjectSingleThreadWaitfreewcslen
String ID:
API String ID: 3923742239-0
Opcode ID: 0b1ebc12664ec9af369dc9cf359099fbb1f0ec73a3cc7ba8db6124106896a692
Instruction ID: 760b2f45a1588ef306b2e3a1e129654e3695763d2f5440ce80cdf2a8cc81f8af
Opcode Fuzzy Hash: 0b1ebc12664ec9af369dc9cf359099fbb1f0ec73a3cc7ba8db6124106896a692
Instruction Fuzzy Hash: 4F110432919214AB9B20DFB488998EF7B69FF9A3A8B10455DE414D7241DB7CD601CBE0

Function 00031F04 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00031F2A

Part of subcall function 00031D56: __fltout2.LIBCMT ref: 00031D81

__cftog_l.LIBCMT ref: 00031F50
__cftoe_l.LIBCMT ref: 00031F82

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: 975ff2c93c294c476a37201b2a0a3dcbc419f4499486e560263b307d8a601a4a
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: BE114B3200414ABFCF235E84DC018EE3F6BBB1E394F598525FA5899131C736C9B2AB81

Function 000361CE Relevance: 6.0, APIs: 4, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(00000000,0002F8EF,00000000,00000000,7591DF80,?,00028FE7,00000000,00000000), ref: 000361D1
__malloc_crt.LIBCMT ref: 00036200
FreeEnvironmentStringsW.KERNEL32(00000000,?,00000000,00000000,?,00028FE7,00000000,00000000), ref: 0003620D

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: EnvironmentStrings$Free__malloc_crt
String ID:
API String ID: 237123855-0
Opcode ID: ea399ff0b8329e368f3166d4ff52cdd24e2535dd122659054e3fba0486ebfc9e
Instruction ID: 691104eda6beb38457018781024d56a7c4b6af4fd2d88f8b52b579d0a0c6f1ba
Opcode Fuzzy Hash: ea399ff0b8329e368f3166d4ff52cdd24e2535dd122659054e3fba0486ebfc9e
Instruction Fuzzy Hash: AEF0E2B79000207A9EB36735BC49CAB276CDBD23A471E8426F802C3102F622CE8183E1

Function 6B928A0D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 187COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6B928A2C

Part of subcall function 6B8DF846: __EH_prolog3.LIBCMT ref: 6B8DF84D

Part of subcall function 6B964232: __onexit.MSVCRT ref: 6B96423A

Strings

VKEY translations, xrefs: 6B928A63
Dead Key Flags, xrefs: 6B928A9F

Memory Dump Source

Source File: 00000005.00000002.2267521549.000000006B8B1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8B0000, based on PE: true

Associated: 00000005.00000002.2267495654.000000006B8B0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267626294.000000006B969000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267685099.000000006B9A4000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267741690.000000006B9A6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267784368.000000006B9A7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267838865.000000006B9A8000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267863426.000000006B9A9000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AA000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AD000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267959620.000000006B9D0000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6b8b0000_javaw.jbxd

Similarity

API ID: H_prolog3$__onexit
String ID: Dead Key Flags$VKEY translations
API String ID: 896046064-1120667548
Opcode ID: a6974ac67ee337ca5c019d69f9586368fe817c716a2c103846c395a81fc3c950
Instruction ID: 9686082bb8b6e1fc39de9bc555dae5e6b61d25c9be13854bdaee0f1a70508193
Opcode Fuzzy Hash: a6974ac67ee337ca5c019d69f9586368fe817c716a2c103846c395a81fc3c950
Instruction Fuzzy Hash: 9A5126B9E68209ABEB288F748C927FE77B9AF16314F11057DE841AB2C4CB7CC5008751

Function 00026231 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

Part of subcall function 0002394B: __strdup.LIBCMT ref: 0002394F
Part of subcall function 0002394B: _perror.LIBCMT ref: 0002395E

_strpbrk.LIBCMT ref: 00026265
_strpbrk.LIBCMT ref: 0002627F

Strings

.-_, xrefs: 0002625F, 00026279

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: _strpbrk$__strdup_perror
String ID: .-_
API String ID: 2917712977-376218738
Opcode ID: 9f2206208871c4f1ec5f7fe82bd1871fb07fd105ff540fd218e746da27b6828f
Instruction ID: 41b5f6f1d9782d99806263777dfef1c2a7f5aca62adfd61a317902fb006d4e11
Opcode Fuzzy Hash: 9f2206208871c4f1ec5f7fe82bd1871fb07fd105ff540fd218e746da27b6828f
Instruction Fuzzy Hash: 4011E932D05735EADB229AA97841B9EFBE8EF41B20F25006AE80477142DF729E0585D4

Function 00023A87 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,00000104,Software\JavaSoft\Java Runtime Environment,?,?,?,00024909,?,CurrentVersion,?,00000104), ref: 00023AA5
RegQueryValueExA.ADVAPI32(00000001,?,00000000,00000000,?,00000104,?,?,?,00024909,?,CurrentVersion), ref: 00023ACA

Strings

Software\JavaSoft\Java Runtime Environment, xrefs: 00023A8C

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: QueryValue
String ID: Software\JavaSoft\Java Runtime Environment
API String ID: 3660427363-786720643
Opcode ID: bef75fc9fc04afae2436036ef341195983bee6a1b3ea50425654eef6b59962a8
Instruction ID: a9823c7375351b3044fa42a2cf8dba8926ca181f1d81215ee54408d1b06b882f
Opcode Fuzzy Hash: bef75fc9fc04afae2436036ef341195983bee6a1b3ea50425654eef6b59962a8
Instruction Fuzzy Hash: 88F0173160422DFAEF15CE80DD41FEE7BADEB04744F104061FA00A6050E771EF55AB62

Function 00025476 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 0002517D: _strlen.LIBCMT ref: 00025189
Part of subcall function 0002517D: _memmove.LIBCMT ref: 000251E3

Part of subcall function 0002536B: _strlen.LIBCMT ref: 00025389

Part of subcall function 0002510A: _strlen.LIBCMT ref: 00025120
Part of subcall function 0002510A: _strlen.LIBCMT ref: 00025148
Part of subcall function 0002510A: _memmove.LIBCMT ref: 00025162

__wgetenv.LIBCMT ref: 000254B0

Strings

_JAVA_LAUNCHER_DEBUG, xrefs: 000254AB
Expanded wildcards: before: "%s" after : "%s", xrefs: 000254BE

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: _strlen$_memmove$__wgetenv
String ID: Expanded wildcards: before: "%s" after : "%s"$_JAVA_LAUNCHER_DEBUG
API String ID: 1533977335-730970534
Opcode ID: 7c7d007379eb42955ca47e8bdb877063b80fbcda68db17d2d738397cc314e8d5
Instruction ID: 98c7b3e2bbb21fa968aeade2b937639beeeff9ae30f20a93e6760e757e058925
Opcode Fuzzy Hash: 7c7d007379eb42955ca47e8bdb877063b80fbcda68db17d2d738397cc314e8d5
Instruction Fuzzy Hash: B5E06556701B2032D12171FA3C43F8B528C8BC57A7F044026FB04DA1C3EE64890042BA

Function 6B91CBB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

J2dTraceImpl.AWT(00000001,00000001,OGLGC_DestroyOGLGraphicsConfig: info is null,?,6B8FD805,?,?,000000FF), ref: 6B91CBC2

Part of subcall function 6B90EA57: _J2dTraceInit@0.AWT(?,6B8B4EE4,00000001,00000001,BufferedMaskBlit_enqueueTile: cannot lock mask array), ref: 6B90EA63
Part of subcall function 6B90EA57: fprintf.MSVCR100 ref: 6B90EABA
Part of subcall function 6B90EA57: vfprintf.MSVCR100 ref: 6B90EACB
Part of subcall function 6B90EA57: fprintf.MSVCR100 ref: 6B90EAE5
Part of subcall function 6B90EA57: fflush.MSVCR100 ref: 6B90EAEF

free.MSVCR100 ref: 6B91CBDA

Strings

OGLGC_DestroyOGLGraphicsConfig: info is null, xrefs: 6B91CBB9

Memory Dump Source

Source File: 00000005.00000002.2267521549.000000006B8B1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8B0000, based on PE: true

Associated: 00000005.00000002.2267495654.000000006B8B0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267626294.000000006B969000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267685099.000000006B9A4000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267741690.000000006B9A6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267784368.000000006B9A7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267838865.000000006B9A8000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267863426.000000006B9A9000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AA000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267889397.000000006B9AD000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000005.00000002.2267959620.000000006B9D0000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6b8b0000_javaw.jbxd

Similarity

API ID: Tracefprintf$ImplInit@0fflushfreevfprintf
String ID: OGLGC_DestroyOGLGraphicsConfig: info is null
API String ID: 320543924-797612303
Opcode ID: 751333f6de17f040a17b88f970d23ece42fa87c705fece352828a796e9ad54dc
Instruction ID: b190f9055b91e2329bd1811e6a7670f624c3abc256100d3ff12a5b7c4582f830
Opcode Fuzzy Hash: 751333f6de17f040a17b88f970d23ece42fa87c705fece352828a796e9ad54dc
Instruction Fuzzy Hash: CFD0C233E9892023D6112629B802FCB23695FD1B28F0A807AF404BB100D655E4C1A0E6

Function 0002398B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

__wgetenv.LIBCMT ref: 00023992

Part of subcall function 00023971: _vwprintf.LIBCMT ref: 00023983

Strings

_JAVA_LAUNCHER_DEBUG, xrefs: 0002398C, 00023991, 0002399C
----%s----, xrefs: 0002399D

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: __wgetenv_vwprintf
String ID: ----%s----$_JAVA_LAUNCHER_DEBUG
API String ID: 3297135996-815448180
Opcode ID: 3d3828e67e7e1fd2e2ba0c5cfdd700bf0881a6a2df331ea6d7685f89b3543310
Instruction ID: 5f7af8174b43167119174a62ea534864ae0651d35d161718777904fb32509b2d
Opcode Fuzzy Hash: 3d3828e67e7e1fd2e2ba0c5cfdd700bf0881a6a2df331ea6d7685f89b3543310
Instruction Fuzzy Hash: 95C0126600D67115B65661747C03ED71ACC5B03338B15005AE808A92C3DF8959C182E9

Function 00023D4C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 13windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,A Java Exception has occurred.,Java Virtual Machine Launcher,00000010), ref: 00023D63

Strings

Java Virtual Machine Launcher, xrefs: 00023D57
A Java Exception has occurred., xrefs: 00023D5C

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: Message
String ID: A Java Exception has occurred.$Java Virtual Machine Launcher
API String ID: 2030045667-3647220046
Opcode ID: 295a862484b0017920b558ed37250400d8f3d28b3ba28c2345706edd98ddf75e
Instruction ID: 7c11aae09fa1537075c6d33576ef938dc35247a6a6641cb9d031d48f4e708108
Opcode Fuzzy Hash: 295a862484b0017920b558ed37250400d8f3d28b3ba28c2345706edd98ddf75e
Instruction Fuzzy Hash: 74D0C9746843006FFE52E764AE0AF0A7AA86B96B06F140484B646AF1D286A99840EA00

Function 00023904 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 11COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00023908

Part of subcall function 0002A029: __FF_MSGBANNER.LIBCMT ref: 0002A042
Part of subcall function 0002A029: __NMSG_WRITE.LIBCMT ref: 0002A049
Part of subcall function 0002A029: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,0002FE09,?,00000001,?,?,0002CE37,00000018,00042708,0000000C,0002CEC7), ref: 0002A06E

_perror.LIBCMT ref: 00023917

Part of subcall function 00029F9B: ___lock_fhandle.LIBCMT ref: 00029FAE
Part of subcall function 00029F9B: _strlen.LIBCMT ref: 00029FC5
Part of subcall function 00029F9B: __write_nolock.LIBCMT ref: 00029FCD
Part of subcall function 00029F9B: __write_nolock.LIBCMT ref: 00029FD9
Part of subcall function 00029F9B: __get_sys_err_msg.LIBCMT ref: 00029FE8
Part of subcall function 00029F9B: _strlen.LIBCMT ref: 00029FF0
Part of subcall function 00029F9B: __write_nolock.LIBCMT ref: 00029FF8
Part of subcall function 00029F9B: __write_nolock.LIBCMT ref: 0002A005

Part of subcall function 00028A0A: _doexit.LIBCMT ref: 00028A16

Strings

malloc, xrefs: 00023912

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: __write_nolock$_strlen$AllocateHeap___lock_fhandle__get_sys_err_msg_doexit_malloc_perror
String ID: malloc
API String ID: 3076456297-2803490479
Opcode ID: 5c618926e1ec17f4f8529538cf03587540a4c3fde26447637eaf89ce2e63cc64
Instruction ID: f7501ac744137c9ecf0bc222427c6d11e0b362be837bc671a7d19f9bb082eadf
Opcode Fuzzy Hash: 5c618926e1ec17f4f8529538cf03587540a4c3fde26447637eaf89ce2e63cc64
Instruction Fuzzy Hash: FCC09B153447216DF9553661BE1779A62849F53F54F50442AF504880D3DDD59C915113

Function 0002394B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 11COMMON

Download Yara Rule

APIs

__strdup.LIBCMT ref: 0002394F
_perror.LIBCMT ref: 0002395E

Part of subcall function 00029F9B: ___lock_fhandle.LIBCMT ref: 00029FAE
Part of subcall function 00029F9B: _strlen.LIBCMT ref: 00029FC5
Part of subcall function 00029F9B: __write_nolock.LIBCMT ref: 00029FCD
Part of subcall function 00029F9B: __write_nolock.LIBCMT ref: 00029FD9
Part of subcall function 00029F9B: __get_sys_err_msg.LIBCMT ref: 00029FE8
Part of subcall function 00029F9B: _strlen.LIBCMT ref: 00029FF0
Part of subcall function 00029F9B: __write_nolock.LIBCMT ref: 00029FF8
Part of subcall function 00029F9B: __write_nolock.LIBCMT ref: 0002A005

Part of subcall function 00028A0A: _doexit.LIBCMT ref: 00028A16

Strings

strdup, xrefs: 00023959

Memory Dump Source

Source File: 00000005.00000002.2247264162.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 00000005.00000002.2247239146.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247295349.000000000003C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247321095.0000000000044000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2247345099.0000000000048000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_20000_javaw.jbxd

Similarity

API ID: __write_nolock$_strlen$___lock_fhandle__get_sys_err_msg__strdup_doexit_perror
String ID: strdup
API String ID: 4113497227-3162730407
Opcode ID: 003b71750758e4c36e38edcb61fdfe4f4c6b7049f9c2668e83bf5c42c4b33f71
Instruction ID: 44098a8d46ab69706df0ab624c368c85a5cea24f9da4f5a672068d868c326758
Opcode Fuzzy Hash: 003b71750758e4c36e38edcb61fdfe4f4c6b7049f9c2668e83bf5c42c4b33f71
Instruction Fuzzy Hash: 8EC02B141007516CF5823622BE03B8A22480F11F10F50481AF000880C3EEC198900402

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 123.sfx.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\123.exe

C:\Users\user\.oracle_jre_usage\f85846f105877459.timestamp

C:\Users\user\AppData\Local\Temp\hsperfdata_user\6508

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\83aa4cc77f591dfc2374580bbd95f6ba_9e146be9-c76a-4720-bcdb-53011b87bd06

C:\Users\user\AppData\Roaming\RDBNT\jre\COPYRIGHT

C:\Users\user\AppData\Roaming\RDBNT\jre\LICENSE

C:\Users\user\AppData\Roaming\RDBNT\jre\README.txt

C:\Users\user\AppData\Roaming\RDBNT\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt

C:\Users\user\AppData\Roaming\RDBNT\jre\THIRDPARTYLICENSEREADME.txt

C:\Users\user\AppData\Roaming\RDBNT\jre\Welcome.html

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\JAWTAccessBridge-32.dll

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\JAWTAccessBridge.dll

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\JavaAccessBridge-32.dll

C:\Users\user\AppData\Roaming\RDBNT\jre\bin\JavaAccessBridge.dll

Windows Analysis Report
123.sfx.exe

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre