Edit tour

Windows Analysis Report
rpcnetp.exe

Overview

General Information

Sample name:rpcnetp.exe
Analysis ID:1514703
MD5:07a37fda01a1342e428c4cefa7050348
SHA1:57e62bd4fc61327bc744c10ca71b0e340a46a4c9
SHA256:1c6a20980a186225979f5e91bc48eaf77c67f50eea85eba9db4c3ec55c61d55f
Infos:

Detection

Score:48
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

AI detected suspicious sample
Machine Learning detection for sample
Contains functionality to dynamically determine API calls
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Contains functionality to launch a process as a different user
Drops PE files
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
PE file contains sections with non-standard names
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
  • System is w10x64
  • rpcnetp.exe (PID: 6884 cmdline: "C:\Users\user\Desktop\rpcnetp.exe" MD5: 07A37FDA01A1342E428C4CEFA7050348)
  • cleanup
No configs have been found
No yara matches
No Sigma rule has matched
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: Submited SampleIntegrated Neural Analysis Model: Matched 85.0% probability
Source: rpcnetp.exeJoe Sandbox ML: detected
Source: rpcnetp.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: C:\Users\user\Desktop\rpcnetp.exeCode function: 0_2_00402EB2 GetCurrentProcessId,OpenProcess,DuplicateTokenEx,SetTokenInformation,CreateEnvironmentBlock,CreateProcessAsUserA,CloseHandle,CreateProcessA,WriteProcessMemory,TerminateProcess,CloseHandle,CloseHandle,ResumeThread,CreateThread,0_2_00402EB2
Source: rpcnetp.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: classification engineClassification label: mal48.winEXE@1/2@0/0
Source: C:\Users\user\Desktop\rpcnetp.exeCode function: 0_2_00402B69 StartServiceCtrlDispatcherA,0_2_00402B69
Source: C:\Users\user\Desktop\rpcnetp.exeCode function: 0_2_00402B69 StartServiceCtrlDispatcherA,0_2_00402B69
Source: C:\Users\user\Desktop\rpcnetp.exeCode function: 0_2_00A22B69 StartServiceCtrlDispatcherA,0_2_00A22B69
Source: C:\Users\user\Desktop\rpcnetp.exeFile created: C:\Users\user\Desktop\rpcnetp.dll\:Zone.Identifier:$DATAJump to behavior
Source: rpcnetp.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\rpcnetp.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Users\user\Desktop\rpcnetp.exeFile read: C:\Users\user\Desktop\rpcnetp.exeJump to behavior
Source: C:\Users\user\Desktop\rpcnetp.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\rpcnetp.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\rpcnetp.exeSection loaded: wsock32.dllJump to behavior
Source: C:\Users\user\Desktop\rpcnetp.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\Desktop\rpcnetp.exeSection loaded: acspecfc.dllJump to behavior
Source: C:\Users\user\Desktop\rpcnetp.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\rpcnetp.exeSection loaded: mscms.dllJump to behavior
Source: C:\Users\user\Desktop\rpcnetp.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\Desktop\rpcnetp.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\Desktop\rpcnetp.exeSection loaded: ddraw.dllJump to behavior
Source: C:\Users\user\Desktop\rpcnetp.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\Desktop\rpcnetp.exeSection loaded: msi.dllJump to behavior
Source: C:\Users\user\Desktop\rpcnetp.exeSection loaded: coloradapterclient.dllJump to behavior
Source: C:\Users\user\Desktop\rpcnetp.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\rpcnetp.exeSection loaded: dxgi.dllJump to behavior
Source: C:\Users\user\Desktop\rpcnetp.exeSection loaded: dciman32.dllJump to behavior
Source: C:\Users\user\Desktop\rpcnetp.exeCode function: 0_2_004014C3 LoadLibraryA,GetProcAddress,FreeLibrary,inet_ntoa,wsprintfA,0_2_004014C3
Source: rpcnetp.exeStatic PE information: section name: .cdata
Source: rpcnetp.dll.0.drStatic PE information: section name: .cdata
Source: C:\Users\user\Desktop\rpcnetp.exeCode function: 0_2_004033E9 push ecx; ret 0_2_004033F9
Source: C:\Users\user\Desktop\rpcnetp.exeCode function: 0_2_00A233E9 push ecx; ret 0_2_00A233F9
Source: C:\Users\user\Desktop\rpcnetp.exeFile created: C:\Users\user\Desktop\rpcnetp.dllJump to dropped file
Source: C:\Users\user\Desktop\rpcnetp.exeCode function: 0_2_00402B69 StartServiceCtrlDispatcherA,0_2_00402B69
Source: C:\Users\user\Desktop\rpcnetp.exeDropped PE file which has not been started: C:\Users\user\Desktop\rpcnetp.dllJump to dropped file
Source: C:\Users\user\Desktop\rpcnetp.exeAPI coverage: 4.3 %
Source: C:\Users\user\Desktop\rpcnetp.exeAPI call chain: ExitProcess graph end nodegraph_0-2527
Source: C:\Users\user\Desktop\rpcnetp.exeCode function: 0_2_004014C3 LoadLibraryA,GetProcAddress,FreeLibrary,inet_ntoa,wsprintfA,0_2_004014C3
Source: C:\Users\user\Desktop\rpcnetp.exeCode function: LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,LocalAlloc,LocalFree,OpenProcess,OpenProcessToken,CloseHandle,FreeLibrary,LocalFree, explorer.exe0_2_00402BE1
Source: C:\Users\user\Desktop\rpcnetp.exeCode function: LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,LocalAlloc,LocalFree,OpenProcess,OpenProcessToken,CloseHandle,FreeLibrary,LocalFree, explorer.exe0_2_00A22BE1
Source: C:\Users\user\Desktop\rpcnetp.exeCode function: 0_2_00402810 GetVersion,GetStdHandle,CloseHandle,CloseHandle,SetStdHandle,CreateEventA,CreateThread,WaitForSingleObject,WaitForSingleObject,CloseHandle,WaitForSingleObject,CloseHandle,CloseHandle,ExitProcess,0_2_00402810
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire Infrastructure1
Valid Accounts
2
Service Execution
1
Valid Accounts
1
Valid Accounts
1
Masquerading
OS Credential Dumping2
System Information Discovery
Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault Accounts1
Native API
3
Windows Service
1
Access Token Manipulation
1
Valid Accounts
LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAt1
DLL Side-Loading
3
Windows Service
1
Access Token Manipulation
Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
Process Injection
1
Process Injection
NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script1
DLL Side-Loading
1
DLL Side-Loading
LSA SecretsInternet Connection DiscoverySSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
Obfuscated Files or Information
Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1514703 Sample: rpcnetp.exe Startdate: 20/09/2024 Architecture: WINDOWS Score: 48 10 Machine Learning detection for sample 2->10 12 AI detected suspicious sample 2->12 5 rpcnetp.exe 1 2->5         started        process3 file4 8 C:\Users\user\Desktop\rpcnetp.dll, PE32 5->8 dropped

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
rpcnetp.exe5%ReversingLabs
rpcnetp.exe100%Joe Sandbox ML
SourceDetectionScannerLabelLink
C:\Users\user\Desktop\rpcnetp.dll11%ReversingLabs
No Antivirus matches
No Antivirus matches
No Antivirus matches
No contacted domains info
No contacted IP infos
Joe Sandbox version:41.0.0 Charoite
Analysis ID:1514703
Start date and time:2024-09-20 22:12:01 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 1m 53s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:default.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:1
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:rpcnetp.exe
Detection:MAL
Classification:mal48.winEXE@1/2@0/0
EGA Information:
  • Successful, ratio: 100%
HCA Information:
  • Successful, ratio: 90%
  • Number of executed functions: 4
  • Number of non-executed functions: 43
Cookbook Comments:
  • Found application associated with file extension: .exe
  • Stop behavior analysis, all processes terminated
  • VT rate limit hit for: rpcnetp.exe
No simulations
No context
No context
No context
No context
No context
Process:C:\Users\user\Desktop\rpcnetp.exe
File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:modified
Size (bytes):17408
Entropy (8bit):5.808879156339454
Encrypted:false
SSDEEP:384:HSW9KAUkANjOqYrxPheuHThCA2Ff2UKiQzCc2GB:y+KAU3kqYrxPhp9CA2cUKimCc2GB
MD5:C10DE8CB09BFA8DDF3EA7474E7FBA07A
SHA1:1AB13607E151F3AD4CE6D744C8E0D99773AE12F7
SHA-256:56C9AB9A663AF6AF931B3C76F32ED0F7402D6ED39F3538F72CB2757886EF7C40
SHA-512:D158348EF6064739652FCB255AD94DF1002966126EB856A612D9360FC959BACED5165B233AF2CAFAA64C785899DB90D29BFD62878DACDD667748935C6AB294B3
Malicious:true
Antivirus:
  • Antivirus: ReversingLabs, Detection: 11%
Reputation:low
Preview:MZ.............j........@...................................H....j......PE..L....O.O...........!.....6...........+.......P....@..................................................................D..F...T=..x............................p..8.......................................................L............................text....4.......6.................. ..`.data........P.......:..............@....cdata..<....`.......<..............@....reloc..8....p.......@..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
Process:C:\Users\user\Desktop\rpcnetp.exe
File Type:ASCII text, with CRLF line terminators
Category:dropped
Size (bytes):26
Entropy (8bit):3.95006375643621
Encrypted:false
SSDEEP:3:ggPYV:rPYV
MD5:187F488E27DB4AF347237FE461A079AD
SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:false
Reputation:high, very likely benign file
Preview:[ZoneTransfer]....ZoneId=0
File type:PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):5.8086863475255415
TrID:
  • Win32 Executable (generic) a (10002005/4) 99.94%
  • Clipper DOS Executable (2020/12) 0.02%
  • Generic Win/DOS Executable (2004/3) 0.02%
  • DOS Executable Generic (2002/1) 0.02%
File name:rpcnetp.exe
File size:17'408 bytes
MD5:07a37fda01a1342e428c4cefa7050348
SHA1:57e62bd4fc61327bc744c10ca71b0e340a46a4c9
SHA256:1c6a20980a186225979f5e91bc48eaf77c67f50eea85eba9db4c3ec55c61d55f
SHA512:454284f58696f402b743689826dee08356b600fc46944e2ed193ae1b08ca89584c30b96ca3f301b89e878abd8d8cac14ac0b1e163bc01854075fc9af671c35f9
SSDEEP:384:SW9KAUkANjOqYrxPheuHThCA2Ff2UKiQzCc2GB:S+KAU3kqYrxPhp9CA2cUKimCc2GB
TLSH:FB724C93FA9449F3D64206346C913E665FBEA6740C15ED67CE005E883EBE58395FC213
File Content Preview:MZ.............j........@...................................H....j......PE..L....O.O.................6...........+.......P....@..................................................................D..F...T=..x............................p..8..................
Icon Hash:90cececece8e8eb0
Entrypoint:0x402b15
Entrypoint Section:.text
Digitally signed:false
Imagebase:0x400000
Subsystem:windows gui
Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:0x4FC64FC6 [Wed May 30 16:50:14 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:4
OS Version Minor:0
File Version Major:4
File Version Minor:0
Subsystem Version Major:4
Subsystem Version Minor:0
Import Hash:ff5b6a43b1b731f25aeef3f8dca9cae0
Instruction
push ebp
mov ebp, esp
push esi
mov esi, 00405004h
xor eax, eax
cmp dword ptr [esi], eax
jne 00007FC38862AE5Fh
push eax
call dword ptr [004010B4h]
mov ecx, dword ptr [ebp+08h]
jecxz 00007FC38862AE62h
cmp eax, ecx
je 00007FC38862AE5Eh
mov dword ptr [esi], ecx
push eax
push dword ptr [00401244h]
push ecx
call dword ptr [004010D0h]
cmp eax, 0040356Ch
pop eax
jne 00007FC38862AE46h
call 00007FC38862AE75h
mov eax, 00000001h
mov dword ptr [0040504Ch], eax
pop esi
leave
retn 000Ch
mov dword ptr [esi], eax
pop esi
leave
jmp 00007FC38862AADCh
push 00405140h
call dword ptr [00401020h]
mov eax, dword ptr [0040510Ch]
ret
push ebp
mov ebp, esp
lea eax, dword ptr [ebp+08h]
push eax
push 00000001h
push 00000000h
push 00000003h
call dword ptr [004010E4h]
pop ebp
retn 0004h
mov dword ptr [00406238h], 00402810h
ret
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
dec eax
je 00007FC38862AE50h
sub eax, 04h
je 00007FC38862AE4Bh
push dword ptr [00405114h]
push dword ptr [00405118h]
push dword ptr [00405104h]
call 00007FC38862AD59h
jmp 00007FC38862AE4Ch
push 00000000h
push 00001388h
push 00000003h
call 00007FC38862AD49h
push dword ptr [00405044h]
call dword ptr [004010A8h]
NameVirtual AddressVirtual Size Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT0x44a00x46.text
IMAGE_DIRECTORY_ENTRY_IMPORT0x3d540x78.text
IMAGE_DIRECTORY_ENTRY_RESOURCE0x00x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
IMAGE_DIRECTORY_ENTRY_BASERELOC0x70000x338.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
IMAGE_DIRECTORY_ENTRY_TLS0x00x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_IAT0x10000x14c.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0
NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
.text0x10000x34e60x36001c3941e5863b3bd163c1bce13607daabFalse0.6011284722222222data6.246196243264917IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data0x50000x1b80x2002ad0e26745cf41740bf80e24c720c4dcFalse0.1171875data0.4456029195603677IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.cdata0x60000x23c0x40045b527c09be9e5e1c192f6686654c5ecFalse0.1669921875data1.3625095134733607IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc0x70000x3380x4000784c2b1e1f9f540ef7808beba6681e4False0.7490234375data5.808753726161884IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
DLLImport
ADVAPI32.dllCreateProcessAsUserA, RegisterServiceCtrlHandlerA, OpenProcessToken, RegQueryValueExA, RegDeleteValueA, DuplicateTokenEx, RegCloseKey, RegOpenKeyA, StartServiceCtrlDispatcherA, SetServiceStatus, RegEnumValueA, SetTokenInformation
KERNEL32.dllCreateRemoteThread, LocalAlloc, SetThreadPriority, CloseHandle, LoadLibraryA, RtlUnwind, VirtualAllocEx, FreeLibrary, SetStdHandle, GetStdHandle, GetBinaryTypeA, ResumeThread, CreateProcessA, LocalFree, VirtualFreeEx, EnterCriticalSection, CreateFileA, TerminateProcess, lstrlenA, GetCurrentThreadId, CopyFileA, WriteProcessMemory, WaitForSingleObject, TerminateThread, Sleep, OpenProcess, GetSystemDirectoryA, DeleteCriticalSection, InitializeCriticalSection, SetEvent, ExitProcess, GetVersion, GetModuleHandleA, GetCurrentProcessId, LeaveCriticalSection, CreateEventA, ResetEvent, ExitThread, CreateThread, GetProcAddress, lstrcatA, ReadProcessMemory, WaitForMultipleObjects, lstrcpyA, RaiseException, lstrcmpiA, WriteFile, SetFilePointer, GetModuleFileNameA, GetExitCodeThread
USER32.dllCreateWindowExA, SetTimer, GetMessageA, TranslateMessage, RegisterClassA, KillTimer, DispatchMessageA, PostMessageA, PostThreadMessageA, PeekMessageA, PostQuitMessage, wsprintfA, DefWindowProcA
USERENV.dllCreateEnvironmentBlock
WSOCK32.dllioctlsocket, inet_addr
NameOrdinalAddress
rpcnetp10x40356c
No network behavior found
0246s020406080100

Click to jump to process

0246sMB

Click to jump to process

Target ID:0
Start time:16:12:51
Start date:20/09/2024
Path:C:\Users\user\Desktop\rpcnetp.exe
Wow64 process (32bit):true
Commandline:"C:\Users\user\Desktop\rpcnetp.exe"
Imagebase:0x400000
File size:17'408 bytes
MD5 hash:07A37FDA01A1342E428C4CEFA7050348
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:low
Has exited:true

Execution Graph

Execution Coverage

Dynamic/Packed Code Coverage

Signature Coverage

Execution Coverage:2.3%
Dynamic/Decrypted Code Coverage:100%
Signature Coverage:15.3%
Total number of Nodes:679
Total number of Limit Nodes:3
Show Legend
Hide Nodes/Edges
execution_graph 2264 403bc0 2267 403bd1 2264->2267 2265 403c43 2267->2265 2269 40399f 2267->2269 2278 403a6b 2267->2278 2284 401eae 2269->2284 2271 403a30 2272 401eae 11 API calls 2271->2272 2273 403a38 2272->2273 2289 401b1b 2273->2289 2275 4039b9 2275->2271 2277 401eae 11 API calls 2275->2277 2276 403a3e 2276->2267 2277->2275 2282 403a7b 2278->2282 2280 403ba1 2280->2267 2282->2280 2283 40399f 11 API calls 2282->2283 2334 401f7b 2282->2334 2343 4019b7 2282->2343 2283->2282 2295 402196 2284->2295 2287 401ee3 2287->2275 2288 401b1b 11 API calls 2288->2287 2293 401b39 2289->2293 2290 401b75 2290->2276 2291 402196 RaiseException 2291->2293 2293->2290 2293->2291 2294 401b58 Sleep WaitForSingleObject 2293->2294 2300 401ddf 2293->2300 2294->2293 2296 4021a2 2295->2296 2297 401ebb 2295->2297 2299 402b7a RaiseException 2296->2299 2297->2287 2297->2288 2299->2297 2301 401e00 2300->2301 2302 401def 2300->2302 2317 401824 2301->2317 2310 401e6a 2302->2310 2305 401e5a 2320 4017c6 LeaveCriticalSection 2305->2320 2307 401dfb 2307->2293 2308 401e07 2308->2305 2309 401e46 SetEvent 2308->2309 2309->2308 2311 401824 2 API calls 2310->2311 2312 401e7b 2311->2312 2323 4021ae GetStdHandle 2312->2323 2315 4017c6 2 API calls 2316 401ea6 2315->2316 2316->2307 2329 4022ff 2317->2329 2321 4022ff RaiseException 2320->2321 2322 4017e0 2321->2322 2322->2307 2328 40231d 2323->2328 2325 4021cc CreateRemoteThread 2326 401e9e 2325->2326 2327 4021e7 WaitForSingleObject GetExitCodeThread CloseHandle 2325->2327 2326->2315 2327->2326 2328->2325 2330 401831 EnterCriticalSection 2329->2330 2331 40230e 2329->2331 2330->2308 2333 402b7a RaiseException 2331->2333 2333->2330 2335 402196 RaiseException 2334->2335 2336 401f8c 2335->2336 2337 401fd4 2336->2337 2338 402196 RaiseException 2336->2338 2337->2282 2339 401fb1 2338->2339 2340 401fb7 WaitForSingleObject 2339->2340 2341 401fc8 2339->2341 2340->2341 2348 401a0b 2341->2348 2344 401824 2 API calls 2343->2344 2345 4019c4 ResetEvent 2344->2345 2346 4017c6 2 API calls 2345->2346 2347 4019e0 2346->2347 2347->2282 2349 401824 2 API calls 2348->2349 2353 401a19 2349->2353 2350 401a5f 2351 4017c6 2 API calls 2350->2351 2352 401a66 2351->2352 2352->2337 2353->2350 2354 401a4c ResetEvent 2353->2354 2354->2353 2839 401c83 2840 401c8a ExitThread 2839->2840 2841 401b83 2857 40178b 2841->2857 2843 401b92 GetStdHandle ReadProcessMemory 2844 401bc3 ReadProcessMemory 2843->2844 2845 401c8a ExitThread 2843->2845 2844->2845 2846 401bdc 2844->2846 2847 401c16 2846->2847 2848 401beb 2846->2848 2849 401c1c ReadProcessMemory 2847->2849 2856 401c11 2847->2856 2851 401c03 SetEvent 2848->2851 2852 401c0b ResetEvent 2848->2852 2848->2856 2849->2845 2850 401c34 2849->2850 2853 401c5d 2850->2853 2855 401a0b 4 API calls 2850->2855 2851->2856 2852->2856 2854 401ddf 9 API calls 2853->2854 2854->2856 2855->2853 2856->2845 2857->2843 2858 40328a 2860 4032c8 2858->2860 2859 403387 2860->2859 2861 403357 RtlUnwind 2860->2861 2861->2860 2862 a2366c 2863 a23717 2862->2863 2870 a23691 2862->2870 2865 a236d9 GetProcAddress 2865->2870 2866 a236cf GetModuleHandleA 2866->2870 2867 a22dc8 LocalAlloc 2867->2870 2870->2863 2870->2865 2870->2866 2870->2867 2871 a23759 GetVersion 2870->2871 2873 a21410 2870->2873 2876 a215e5 RaiseException 2870->2876 2872 a23770 2871->2872 2872->2870 2877 a21ae0 2873->2877 2876->2870 2878 a21423 LocalFree 2877->2878 2878->2870 2910 40390f 2911 403920 2910->2911 2912 403935 2910->2912 2913 40392e 2911->2913 2916 4038aa 2911->2916 2912->2913 2920 40385b 2912->2920 2917 4038b7 2916->2917 2926 4013c0 2917->2926 2919 4038d1 2919->2913 2921 403867 2920->2921 2925 40387e 2920->2925 2930 40381c 2921->2930 2923 403873 2924 402dc8 LocalAlloc 2923->2924 2924->2925 2925->2913 2927 4013ca 2926->2927 2928 40140a 2927->2928 2929 4013fc LocalFree 2927->2929 2928->2919 2929->2927 2931 403830 2930->2931 2932 403839 GetVersion 2931->2932 2932->2923 2136 402810 GetVersion 2137 402839 GetStdHandle 2136->2137 2138 40282e 2136->2138 2163 40252d 2137->2163 2138->2137 2141 4028c1 2142 4028d5 2141->2142 2145 4028e3 CreateEventA 2141->2145 2146 4028ce 2141->2146 2142->2145 2148 4028d3 2142->2148 2153 4028de 2142->2153 2143 402866 2171 402be1 2143->2171 2144 4028a8 SetStdHandle 2144->2141 2154 4028f2 CreateThread 2145->2154 2170 402b69 StartServiceCtrlDispatcherA 2146->2170 2149 402945 CloseHandle 2148->2149 2150 40294a ExitProcess 2148->2150 2149->2150 2152 402875 2187 402eb2 2152->2187 2153->2145 2153->2154 2155 40290c 2154->2155 2162 40289b 2154->2162 2157 40291b WaitForSingleObject CloseHandle 2155->2157 2158 40292e WaitForSingleObject CloseHandle 2155->2158 2157->2158 2158->2162 2159 402889 2160 402894 CloseHandle 2159->2160 2161 402897 2159->2161 2160->2161 2161->2141 2161->2162 2162->2148 2164 402547 2163->2164 2165 402566 2163->2165 2221 403187 GetModuleFileNameA 2164->2221 2166 402598 2165->2166 2167 40258d GetCurrentProcessId 2165->2167 2166->2141 2166->2143 2166->2144 2167->2166 2170->2148 2229 40178b 2171->2229 2173 402bed LoadLibraryA 2174 402c12 GetProcAddress 2173->2174 2184 402cdd 2173->2184 2177 402c2b GetProcAddress 2174->2177 2174->2184 2175 402cf0 2178 402cf6 LocalFree 2175->2178 2179 402cff 2175->2179 2176 402ce7 FreeLibrary 2176->2175 2181 402c3e 2177->2181 2177->2184 2178->2179 2179->2152 2180 402c43 LocalAlloc 2180->2181 2180->2184 2181->2180 2182 402c66 LocalFree 2181->2182 2183 402c7f 2181->2183 2181->2184 2182->2181 2183->2184 2185 402c9d OpenProcess 2183->2185 2184->2175 2184->2176 2185->2184 2186 402cb2 OpenProcessToken CloseHandle 2185->2186 2186->2184 2230 40178b 2187->2230 2189 402ec1 GetCurrentProcessId OpenProcess 2192 402efb 2189->2192 2220 4030c9 2189->2220 2191 4030d5 2191->2159 2193 402f3b 2192->2193 2231 402d08 2192->2231 2195 403187 10 API calls 2193->2195 2196 402f4c 2193->2196 2195->2196 2197 402f51 DuplicateTokenEx 2196->2197 2198 402fcd CreateProcessA 2196->2198 2199 402f73 SetTokenInformation 2197->2199 2200 402f87 CreateEnvironmentBlock CreateProcessAsUserA 2197->2200 2201 402ff0 2198->2201 2199->2200 2200->2201 2202 402fc2 CloseHandle 2200->2202 2203 40306e 2201->2203 2204 403017 2201->2204 2208 403187 10 API calls 2201->2208 2202->2201 2206 403073 TerminateProcess CloseHandle 2203->2206 2207 403086 2203->2207 2205 40302f WriteProcessMemory 2204->2205 2204->2220 2210 403052 2205->2210 2211 403096 ResumeThread 2205->2211 2206->2207 2212 40308b CloseHandle 2207->2212 2207->2220 2209 403007 2208->2209 2240 403117 VirtualAllocEx 2209->2240 2246 403426 CreateRemoteThread 2210->2246 2215 40309f 2211->2215 2212->2220 2216 4030c1 2215->2216 2217 4030a7 CreateThread 2215->2217 2254 4033b3 SetStdHandle WaitForSingleObject CloseHandle 2216->2254 2217->2220 2256 4030e2 2220->2256 2222 4031b0 lstrcpyA lstrlenA lstrcmpiA 2221->2222 2223 402555 LoadLibraryA 2221->2223 2222->2223 2225 4031f7 lstrcpyA CopyFileA 2222->2225 2223->2165 2225->2223 2226 403212 CreateFileA 2225->2226 2226->2223 2227 40322c SetFilePointer WriteFile CloseHandle 2226->2227 2227->2223 2229->2173 2230->2189 2232 402d19 GetSystemDirectoryA lstrcatA 2231->2232 2235 402d3b 2231->2235 2239 402dbb 2232->2239 2233 402d3f lstrcpyA 2234 402d53 RegOpenKeyA 2233->2234 2233->2235 2234->2235 2236 402d67 RegQueryValueExA RegCloseKey 2234->2236 2235->2233 2235->2234 2235->2239 2237 402d9b GetBinaryTypeA 2236->2237 2238 402d8f lstrcatA 2236->2238 2237->2235 2238->2237 2239->2193 2241 40317d 2240->2241 2242 40313d lstrlenA WriteProcessMemory 2240->2242 2241->2204 2243 403159 2242->2243 2244 40316f VirtualFreeEx 2242->2244 2245 403426 5 API calls 2243->2245 2244->2241 2245->2244 2247 403495 TerminateProcess 2246->2247 2248 403458 2246->2248 2249 403069 2247->2249 2250 40345d 2248->2250 2252 403476 WaitForMultipleObjects 2248->2252 2249->2203 2249->2215 2251 40348a CloseHandle 2250->2251 2251->2249 2252->2251 2253 403480 GetExitCodeThread 2252->2253 2253->2251 2255 4033de 2254->2255 2255->2220 2257 4030e7 2256->2257 2258 4030fa 2257->2258 2259 4030f4 CloseHandle 2257->2259 2260 403108 2258->2260 2261 4030ff CloseHandle 2258->2261 2259->2258 2262 403116 2260->2262 2263 40310d CloseHandle 2260->2263 2261->2260 2262->2191 2263->2262 2355 402151 2356 402171 2355->2356 2358 40217b 2355->2358 2357 401e6a 8 API calls 2356->2357 2357->2358 2933 402691 2934 402768 KillTimer 2933->2934 2935 4026ab 2933->2935 2937 402776 PeekMessageA 2934->2937 2936 4026b7 2935->2936 2938 4026c3 2935->2938 2940 4026be 2936->2940 2960 40220a 2936->2960 2937->2937 2939 402789 PostQuitMessage 2937->2939 2941 402796 DefWindowProcA 2938->2941 2942 4026cd KillTimer 2938->2942 2939->2941 2943 402734 2939->2943 2940->2941 2941->2943 2945 4026db PeekMessageA 2942->2945 2945->2945 2946 4026ee 2945->2946 2954 4027ad 2946->2954 2948 402741 SetEvent 2949 40274f 2948->2949 2949->2934 2951 402757 SetTimer 2949->2951 2951->2943 2952 4026f3 2952->2941 2953 402701 SetTimer 2952->2953 2953->2941 2955 4027e1 2954->2955 2957 4027bc 2954->2957 2956 40220a 58 API calls 2955->2956 2958 4027d5 2956->2958 2957->2958 2959 402eb2 47 API calls 2957->2959 2958->2952 2959->2958 2961 402219 PostThreadMessageA WaitForSingleObject CloseHandle 2960->2961 2964 402258 2960->2964 2961->2964 2963 40226e 2963->2943 2963->2948 2963->2949 2964->2963 2969 403521 2964->2969 2965 4022da CreateThread 2965->2963 2974 402ab6 2965->2974 2967 403521 2 API calls 2968 4022cc 2967->2968 2968->2965 2970 403537 2969->2970 2971 40228f 2970->2971 2972 403548 inet_addr 2970->2972 2973 40354e inet_ntoa 2970->2973 2971->2963 2971->2965 2971->2967 2972->2973 2973->2971 2975 402ac2 2974->2975 2978 40297d 2975->2978 2977 402ad0 2981 40299e 2978->2981 2979 402a05 LocalAlloc 2980 402a18 GetCurrentThreadId 2979->2980 2979->2981 2980->2981 2981->2979 2984 402a40 CreateThread 2981->2984 2988 4029e9 PeekMessageA 2981->2988 2989 402a00 2981->2989 2990 4014c3 LoadLibraryA 2981->2990 2999 4024c8 2981->2999 2984->2981 2987 402a64 SetThreadPriority 2984->2987 3039 4033fa 2984->3039 2987->2981 2988->2981 2988->2989 3010 4017e5 2989->3010 2991 4014f0 2990->2991 2992 4014f8 2990->2992 2991->2981 2993 401501 GetProcAddress 2992->2993 2995 401525 2992->2995 2993->2992 2994 401541 FreeLibrary 2993->2994 2994->2991 2995->2991 2996 401554 inet_ntoa 2995->2996 2997 40153c 2995->2997 2996->2997 2997->2991 2998 4015b1 wsprintfA 2997->2998 2998->2991 3000 4024d3 2999->3000 3001 402528 2999->3001 3002 4024e4 3000->3002 3014 401a6e 3000->3014 3001->2981 3019 40233c 3002->3019 3006 402521 LocalFree 3006->3001 3007 4024f4 WaitForSingleObject 3008 402515 CloseHandle 3007->3008 3009 402507 TerminateThread 3007->3009 3008->3006 3009->3008 3011 4017f2 FreeLibrary 3010->3011 3012 40181f PostMessageA 3010->3012 3011->3012 3012->2977 3015 401ad3 3014->3015 3018 401a83 3014->3018 3015->3002 3016 401a8d GetMessageA 3016->3018 3017 401ab7 TranslateMessage DispatchMessageA 3017->3015 3017->3016 3018->3015 3018->3016 3018->3017 3020 4017e5 FreeLibrary 3019->3020 3021 402356 3020->3021 3026 402370 3021->3026 3024 402370 8 API calls 3025 40236b 3024->3025 3025->3006 3025->3007 3027 402385 EnterCriticalSection 3026->3027 3028 402362 3026->3028 3029 4023b2 3027->3029 3030 4023af SetEvent 3027->3030 3028->3024 3031 4023bc SetEvent 3029->3031 3032 4023bf 3029->3032 3030->3029 3031->3032 3033 4023ea 3032->3033 3034 4023cf WaitForSingleObject CloseHandle 3032->3034 3035 4023f4 CloseHandle 3033->3035 3036 4023f7 3033->3036 3034->3033 3035->3036 3037 402401 CloseHandle 3036->3037 3038 402404 DeleteCriticalSection 3036->3038 3037->3038 3038->3028 3042 401843 3039->3042 3041 403405 ExitThread 3062 40178b 3042->3062 3044 401852 GetStdHandle 3045 401879 3044->3045 3046 40381c GetVersion 3045->3046 3047 4018af 3046->3047 3048 4018dc GetStdHandle 3047->3048 3049 401917 3047->3049 3048->3049 3050 4018e5 3048->3050 3063 402414 3049->3063 3053 4018fd CreateRemoteThread 3050->3053 3053->3049 3054 4038aa LocalFree 3056 4019af 3054->3056 3055 402414 13 API calls 3057 401951 3055->3057 3056->3041 3058 401964 3057->3058 3061 40198c 3057->3061 3071 401ee8 3057->3071 3060 401969 ResumeThread WaitForMultipleObjects CloseHandle 3058->3060 3058->3061 3060->3061 3061->3054 3062->3044 3064 40193e 3063->3064 3065 402429 InitializeCriticalSection CreateEventA CreateEventA 3063->3065 3064->3055 3064->3061 3066 4024b1 3065->3066 3067 40247c 3065->3067 3068 402370 8 API calls 3066->3068 3067->3066 3069 4024a0 SetThreadPriority 3067->3069 3070 402485 CreateThread 3067->3070 3068->3064 3069->3064 3070->3066 3070->3069 3072 401f05 3071->3072 3073 401f19 3071->3073 3074 401f1b SetEvent 3072->3074 3075 401f08 3072->3075 3073->3074 3076 401f27 3074->3076 3075->3076 3077 401f0b ResetEvent 3075->3077 3078 401f72 3076->3078 3079 401824 2 API calls 3076->3079 3077->3076 3078->3058 3080 401f39 WaitForSingleObject 3079->3080 3081 4021ae 5 API calls 3080->3081 3082 401f6a 3081->3082 3083 4017c6 2 API calls 3082->3083 3083->3078 2359 403c52 2361 403c5f 2359->2361 2360 403a6b 14 API calls 2360->2361 2361->2360 2362 403c8a 2361->2362 2363 40399f 11 API calls 2361->2363 2363->2361 3084 402b15 3085 402b24 GetModuleHandleA 3084->3085 3088 402b4c 3084->3088 3086 402b30 3085->3086 3085->3088 3087 402b34 GetProcAddress 3086->3087 3086->3088 3087->3088 3112 401c98 3121 40178b 3112->3121 3114 401ca4 LocalAlloc GetStdHandle 3115 401d37 ExitThread 3114->3115 3116 401cc8 WriteProcessMemory 3114->3116 3117 401d25 LocalFree 3116->3117 3118 401ce9 ReadProcessMemory 3116->3118 3117->3115 3118->3117 3119 401cfe 3118->3119 3120 401843 32 API calls 3119->3120 3120->3117 3121->3114 2366 402cda 2367 402cdd 2366->2367 2368 402cf0 2367->2368 2369 402ce7 FreeLibrary 2367->2369 2370 402cf6 LocalFree 2368->2370 2371 402cff 2368->2371 2369->2368 2370->2371 3122 402b9c 3123 402bc3 3122->3123 3124 402ba5 3122->3124 3131 402ae5 SetServiceStatus 3123->3131 3124->3123 3126 402baa 3124->3126 3130 402ae5 SetServiceStatus 3126->3130 3128 402bd1 SetEvent 3129 402bc1 3128->3129 3130->3129 3131->3128 3132 40199f 3133 4019a2 3132->3133 3134 4038aa LocalFree 3133->3134 3135 4019af 3134->3135 2374 a21b83 2390 a2178b 2374->2390 2376 a21b92 GetStdHandle ReadProcessMemory 2377 a21bc3 ReadProcessMemory 2376->2377 2378 a21c8a ExitThread 2376->2378 2377->2378 2379 a21bdc 2377->2379 2380 a21c16 2379->2380 2382 a21beb 2379->2382 2381 a21c1c ReadProcessMemory 2380->2381 2389 a21c11 2380->2389 2381->2378 2383 a21c34 2381->2383 2384 a21c03 SetEvent 2382->2384 2385 a21c0b ResetEvent 2382->2385 2382->2389 2386 a21c5d 2383->2386 2391 a21a0b 2383->2391 2384->2389 2385->2389 2398 a21ddf 2386->2398 2389->2378 2390->2376 2408 a21824 2391->2408 2394 a21a19 2395 a21a5f 2394->2395 2397 a21a4c ResetEvent 2394->2397 2411 a217c6 LeaveCriticalSection 2395->2411 2397->2394 2399 a21e00 2398->2399 2400 a21def 2398->2400 2402 a21824 2 API calls 2399->2402 2419 a21e6a 2400->2419 2406 a21e07 2402->2406 2403 a21dfb 2403->2389 2404 a21e5a 2405 a217c6 2 API calls 2404->2405 2405->2403 2406->2404 2407 a21e46 SetEvent 2406->2407 2407->2406 2414 a222ff 2408->2414 2412 a222ff RaiseException 2411->2412 2413 a217e0 2412->2413 2413->2386 2415 a21831 EnterCriticalSection 2414->2415 2416 a2230e 2414->2416 2415->2394 2418 a22b7a RaiseException 2416->2418 2418->2415 2420 a21824 2 API calls 2419->2420 2421 a21e7b 2420->2421 2426 a221ae GetStdHandle 2421->2426 2424 a217c6 2 API calls 2425 a21ea6 2424->2425 2425->2403 2431 a2231d 2426->2431 2428 a221cc CreateRemoteThread 2429 a21e9e 2428->2429 2430 a221e7 WaitForSingleObject GetExitCodeThread CloseHandle 2428->2430 2429->2424 2430->2429 2431->2428 3136 a23bc0 3139 a23bd1 3136->3139 3137 a23c43 3139->3137 3141 a2399f 3139->3141 3150 a23a6b 3139->3150 3156 a21eae 3141->3156 3143 a23a30 3144 a21eae 11 API calls 3143->3144 3145 a23a38 3144->3145 3161 a21b1b 3145->3161 3147 a239b9 3147->3143 3149 a21eae 11 API calls 3147->3149 3148 a23a3e 3148->3139 3149->3147 3153 a23a7b 3150->3153 3152 a23ba1 3152->3139 3153->3152 3155 a2399f 11 API calls 3153->3155 3172 a21f7b 3153->3172 3181 a219b7 3153->3181 3155->3153 3167 a22196 3156->3167 3159 a21ee3 3159->3147 3160 a21b1b 11 API calls 3160->3159 3165 a21b39 3161->3165 3162 a21b75 3162->3148 3163 a22196 RaiseException 3163->3165 3164 a21ddf 9 API calls 3164->3165 3165->3162 3165->3163 3165->3164 3166 a21b58 Sleep WaitForSingleObject 3165->3166 3166->3165 3168 a221a2 3167->3168 3169 a21ebb 3167->3169 3171 a22b7a RaiseException 3168->3171 3169->3159 3169->3160 3171->3169 3173 a22196 RaiseException 3172->3173 3174 a21f8c 3173->3174 3175 a21fd4 3174->3175 3176 a22196 RaiseException 3174->3176 3175->3153 3177 a21fb1 3176->3177 3178 a21fb7 WaitForSingleObject 3177->3178 3179 a21fc8 3177->3179 3178->3179 3180 a21a0b 4 API calls 3179->3180 3180->3175 3182 a21824 2 API calls 3181->3182 3183 a219c4 ResetEvent 3182->3183 3184 a217c6 2 API calls 3183->3184 3185 a219e0 3184->3185 3185->3153 2436 40366c 2437 403691 2436->2437 2438 403717 2436->2438 2437->2438 2440 4036d9 GetProcAddress 2437->2440 2441 4036cf GetModuleHandleA 2437->2441 2445 403759 GetVersion 2437->2445 2447 402dc8 LocalAlloc 2437->2447 2449 401410 2437->2449 2452 4015e5 RaiseException 2437->2452 2440->2437 2441->2437 2446 403770 2445->2446 2446->2437 2448 402de1 2447->2448 2448->2437 2453 401ae0 2449->2453 2452->2437 2454 401423 LocalFree 2453->2454 2454->2437 2455 40356c CreateEventA RegisterServiceCtrlHandlerA 2456 403665 2455->2456 2457 4035be 2455->2457 2470 402ae5 SetServiceStatus 2457->2470 2459 4035d4 2471 402ae5 SetServiceStatus 2459->2471 2461 4035e7 2472 402df6 RegOpenKeyA 2461->2472 2464 403612 2466 403651 CloseHandle 2464->2466 2465 40361a WaitForSingleObject 2467 403633 PostMessageA 2465->2467 2468 40363e WaitForSingleObject CloseHandle 2465->2468 2478 402ae5 SetServiceStatus 2466->2478 2467->2468 2468->2466 2470->2459 2471->2461 2473 402e72 CreateThread 2472->2473 2474 402e1b RegQueryValueExA 2472->2474 2473->2464 2473->2465 2479 4025b3 2473->2479 2475 402e4d RegEnumValueA 2474->2475 2476 402e40 RegDeleteValueA 2475->2476 2477 402e66 RegCloseKey 2475->2477 2476->2475 2477->2473 2478->2456 2485 40178b 2479->2485 2481 4025c2 GetModuleFileNameA RegisterClassA CreateWindowExA SetTimer 2482 402631 GetMessageA 2481->2482 2483 402642 TranslateMessage DispatchMessageA 2482->2483 2484 402658 2482->2484 2483->2482 2485->2481 2486 a2390f 2487 a23920 2486->2487 2488 a23935 2486->2488 2491 a2392e 2487->2491 2492 a238aa 2487->2492 2488->2491 2496 a2385b 2488->2496 2493 a238b7 2492->2493 2502 a213c0 2493->2502 2495 a238d1 2495->2491 2497 a23867 2496->2497 2499 a2387e 2496->2499 2506 a2381c 2497->2506 2499->2491 2500 a23873 2509 a22dc8 LocalAlloc 2500->2509 2503 a213ca 2502->2503 2504 a2140a 2503->2504 2505 a213fc LocalFree 2503->2505 2504->2495 2505->2503 2507 a23830 2506->2507 2508 a23839 GetVersion 2507->2508 2508->2500 2510 a22de1 2509->2510 2510->2499 2511 a22810 GetVersion 2512 a22839 GetStdHandle 2511->2512 2513 a2282e 2511->2513 2535 a2252d 2512->2535 2513->2512 2516 a228d5 2520 a228e3 CreateEventA 2516->2520 2525 a228f2 CreateThread 2516->2525 2534 a2289b 2516->2534 2517 a22897 2517->2516 2517->2520 2521 a228ce 2517->2521 2517->2534 2518 a22866 2542 a22be1 2518->2542 2519 a228a8 SetStdHandle 2519->2517 2520->2525 2592 a22b69 StartServiceCtrlDispatcherA 2521->2592 2524 a22875 2558 a22eb2 2524->2558 2529 a2290c 2525->2529 2525->2534 2526 a22945 CloseHandle 2527 a2294a ExitProcess 2526->2527 2531 a2291b WaitForSingleObject CloseHandle 2529->2531 2532 a2292e WaitForSingleObject CloseHandle 2529->2532 2530 a22889 2530->2517 2533 a22894 CloseHandle 2530->2533 2531->2532 2532->2534 2533->2517 2534->2526 2534->2527 2536 a22547 2535->2536 2537 a22566 2535->2537 2593 a23187 GetModuleFileNameA 2536->2593 2539 a22598 2537->2539 2540 a2258d GetCurrentProcessId 2537->2540 2539->2517 2539->2518 2539->2519 2540->2539 2601 a2178b 2542->2601 2544 a22bed LoadLibraryA 2545 a22c12 GetProcAddress 2544->2545 2554 a22cdd 2544->2554 2546 a22c2b GetProcAddress 2545->2546 2545->2554 2552 a22c3e 2546->2552 2546->2554 2547 a22cf0 2549 a22cf6 LocalFree 2547->2549 2550 a22cff 2547->2550 2548 a22ce7 FreeLibrary 2548->2547 2549->2550 2550->2524 2551 a22c43 LocalAlloc 2551->2552 2551->2554 2552->2551 2553 a22c66 LocalFree 2552->2553 2552->2554 2555 a22c7f 2552->2555 2553->2552 2554->2547 2554->2548 2555->2554 2556 a22c9d OpenProcess 2555->2556 2556->2554 2557 a22cb2 OpenProcessToken CloseHandle 2556->2557 2557->2554 2602 a2178b 2558->2602 2560 a22ec1 GetCurrentProcessId OpenProcess 2562 a22efb 2560->2562 2591 a230c9 2560->2591 2564 a22f3b 2562->2564 2603 a22d08 2562->2603 2563 a230d5 2563->2530 2566 a23187 10 API calls 2564->2566 2567 a22f4c 2564->2567 2566->2567 2568 a22f51 DuplicateTokenEx 2567->2568 2569 a22fcd CreateProcessA 2567->2569 2570 a22f73 SetTokenInformation 2568->2570 2571 a22f87 CreateEnvironmentBlock CreateProcessAsUserA 2568->2571 2572 a22ff0 2569->2572 2570->2571 2571->2572 2573 a22fc2 CloseHandle 2571->2573 2574 a23017 2572->2574 2575 a2306e 2572->2575 2579 a23187 10 API calls 2572->2579 2573->2572 2576 a2302f WriteProcessMemory 2574->2576 2574->2591 2577 a23073 TerminateProcess CloseHandle 2575->2577 2578 a23086 2575->2578 2581 a23052 2576->2581 2582 a23096 ResumeThread 2576->2582 2577->2578 2583 a2308b CloseHandle 2578->2583 2578->2591 2580 a23007 2579->2580 2612 a23117 VirtualAllocEx 2580->2612 2618 a23426 CreateRemoteThread 2581->2618 2586 a2309f 2582->2586 2583->2591 2587 a230c1 2586->2587 2588 a230a7 CreateThread 2586->2588 2626 a233b3 SetStdHandle WaitForSingleObject CloseHandle 2587->2626 2588->2591 2628 a230e2 2591->2628 2592->2534 2594 a231b0 lstrcpyA lstrlenA lstrcmpiA 2593->2594 2595 a22555 LoadLibraryA 2593->2595 2594->2595 2597 a231f7 lstrcpyA CopyFileA 2594->2597 2595->2537 2597->2595 2598 a23212 CreateFileA 2597->2598 2598->2595 2599 a2322c SetFilePointer WriteFile CloseHandle 2598->2599 2599->2595 2601->2544 2602->2560 2604 a22d19 GetSystemDirectoryA lstrcatA 2603->2604 2608 a22d3b 2603->2608 2611 a22dbb 2604->2611 2605 a22d3f lstrcpyA 2606 a22d53 RegOpenKeyA 2605->2606 2605->2608 2607 a22d67 RegQueryValueExA RegCloseKey 2606->2607 2606->2608 2609 a22d9b GetBinaryTypeA 2607->2609 2610 a22d8f lstrcatA 2607->2610 2608->2605 2608->2606 2608->2611 2609->2608 2610->2609 2611->2564 2613 a2317d 2612->2613 2614 a2313d lstrlenA WriteProcessMemory 2612->2614 2613->2574 2615 a23159 2614->2615 2616 a2316f VirtualFreeEx 2614->2616 2617 a23426 5 API calls 2615->2617 2616->2613 2617->2616 2619 a23495 TerminateProcess 2618->2619 2620 a23458 2618->2620 2622 a23069 2619->2622 2621 a2345d 2620->2621 2624 a23476 WaitForMultipleObjects 2620->2624 2623 a2348a CloseHandle 2621->2623 2622->2575 2622->2586 2623->2622 2624->2623 2625 a23480 GetExitCodeThread 2624->2625 2625->2623 2627 a233de 2626->2627 2627->2591 2629 a230e7 2628->2629 2630 a230fa 2629->2630 2631 a230f4 CloseHandle 2629->2631 2632 a23108 2630->2632 2633 a230ff CloseHandle 2630->2633 2631->2630 2634 a23116 2632->2634 2635 a2310d CloseHandle 2632->2635 2633->2632 2634->2563 2635->2634 2787 402675 PostThreadMessageA 2788 401ff5 2789 402001 2788->2789 2790 402026 WaitForSingleObject 2789->2790 2799 402034 2789->2799 2790->2799 2791 402188 2793 4020ce WaitForSingleObject 2793->2799 2794 401a0b LeaveCriticalSection EnterCriticalSection ResetEvent RaiseException 2794->2799 2795 401ddf 9 API calls 2795->2799 2796 401ee8 11 API calls 2796->2799 2797 402b7a RaiseException 2797->2799 2799->2791 2799->2793 2799->2794 2799->2795 2799->2796 2799->2797 2800 4015fc 2799->2800 2804 401694 2799->2804 2801 40160b 2800->2801 2802 401620 wsprintfA 2801->2802 2803 40165b 2802->2803 2803->2799 2806 4016a0 2804->2806 2805 401706 lstrcpyA 2807 401739 2805->2807 2806->2805 2808 40174a 2806->2808 2807->2808 2809 40173d lstrcpyA 2807->2809 2808->2799 2809->2808

Executed Functions

Control-flow Graph

APIs
  • GetVersion.KERNEL32 ref: 00402819
  • GetStdHandle.KERNEL32(000000F4), ref: 0040283B
  • CloseHandle.KERNEL32(00000000), ref: 00402895
  • SetStdHandle.KERNEL32(000000F6,?), ref: 004028B7
  • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 004028E7
  • CreateThread.KERNEL32(00000000,00000000,Function_000025B3,00000000,00000000,?), ref: 004028FF
  • WaitForSingleObject.KERNEL32(?,000000FF), ref: 0040291E
  • CloseHandle.KERNEL32 ref: 00402926
  • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00402933
  • CloseHandle.KERNEL32(?), ref: 00402938
  • CloseHandle.KERNEL32(?), ref: 00402948
  • ExitProcess.KERNEL32 ref: 0040294B
Memory Dump Source
  • Source File: 00000000.00000002.1667087219.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.1667061091.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667112860.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667134465.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_rpcnetp.jbxd
Similarity
  • API ID: Handle$Close$CreateObjectSingleWait$EventExitProcessThreadVersion
  • String ID:
  • API String ID: 2472693224-0
  • Opcode ID: 9cbd657857b55a71ff7b06cb11e1f56f07b342860491c15c69beaa2a1e8e738d
  • Instruction ID: 351d9ccb138fcf285cb1693bd3b0aece53692c2f86dc06a253764435628f0754
  • Opcode Fuzzy Hash: 9cbd657857b55a71ff7b06cb11e1f56f07b342860491c15c69beaa2a1e8e738d
  • Instruction Fuzzy Hash: 733192B5900255AFCB207FA59FCCD5F3AA8EB04324B10433AE955B22F1D7B84C449EAC

Control-flow Graph

  • Executed
  • Not Executed
control_flow_graph 57 402b69-402b79 StartServiceCtrlDispatcherA
APIs
  • StartServiceCtrlDispatcherA.ADVAPI32(00405140,004028D3), ref: 00402B6E
Memory Dump Source
  • Source File: 00000000.00000002.1667087219.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.1667061091.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667112860.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667134465.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_rpcnetp.jbxd
Similarity
  • API ID: CtrlDispatcherServiceStart
  • String ID:
  • API String ID: 3789849863-0
  • Opcode ID: 698578779489da70f091bc8e24d5313923afe18190b1a296e3a9409160284594
  • Instruction ID: 4a0d57ed3107fe9dc9aed8d854821eb5c31e201905f90b85e4554e80e2cbf05a
  • Opcode Fuzzy Hash: 698578779489da70f091bc8e24d5313923afe18190b1a296e3a9409160284594
  • Instruction Fuzzy Hash: 52A00134E40A548BCE009B55AA4EB0A77A0E6597463506161E541AA6A4C6B458408E59

Control-flow Graph

APIs
  • GetModuleFileNameA.KERNEL32(?,00000104), ref: 004031A2
  • lstrcpyA.KERNEL32(?,?,?,?,00000001), ref: 004031D8
  • lstrlenA.KERNEL32(?,?,?,00000001), ref: 004031DB
  • lstrcmpiA.KERNEL32(-00000003,00401344), ref: 004031E9
  • lstrcpyA.KERNEL32(-00000003,00401344,?,?,00000001), ref: 004031FB
  • CopyFileA.KERNEL32(?,?,00000000), ref: 00403208
  • CreateFileA.KERNELBASE(?,C0000000,00000003,00000000,00000003,00000000,00000000,?,?,00000001), ref: 0040321F
  • SetFilePointer.KERNELBASE(00000000,?,00000000,00000000,?,?,00000001), ref: 00403264
  • WriteFile.KERNELBASE(00000000,00000000,00000002,?,00000000,?,?,00000001), ref: 00403276
  • CloseHandle.KERNEL32(00000000,?,?,00000001), ref: 0040327D
Strings
Memory Dump Source
  • Source File: 00000000.00000002.1667087219.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.1667061091.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667112860.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667134465.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_rpcnetp.jbxd
Similarity
  • API ID: File$lstrcpy$CloseCopyCreateHandleModuleNamePointerWritelstrcmpilstrlen
  • String ID: dll$exe
  • API String ID: 3010676052-2048111982
  • Opcode ID: 638d776a9f35d1838af362259311b179a9b62e1f604d0a34881f7312d87135a0
  • Instruction ID: 147aec4e025f2d9b475cf100369f53d27357f6d99d60d9ad1cf4a7e8ebb2348a
  • Opcode Fuzzy Hash: 638d776a9f35d1838af362259311b179a9b62e1f604d0a34881f7312d87135a0
  • Instruction Fuzzy Hash: 4B31AE75500118BBDB109FA1DD88EEB3FBCEF45751F00807AFA45E61A0D7748A85CBA8

Control-flow Graph

  • Executed
  • Not Executed
control_flow_graph 49 40252d-402545 50 402547-402564 call 403187 LoadLibraryA 49->50 51 402568-40258b 49->51 50->51 56 402566 50->56 52 402598-4025b0 51->52 53 40258d-402596 GetCurrentProcessId 51->53 53->52 56->51
APIs
  • GetCurrentProcessId.KERNEL32 ref: 0040258D
    • Part of subcall function 00403187: GetModuleFileNameA.KERNEL32(?,00000104), ref: 004031A2
    • Part of subcall function 00403187: lstrcpyA.KERNEL32(?,?,?,?,00000001), ref: 004031D8
    • Part of subcall function 00403187: lstrlenA.KERNEL32(?,?,?,00000001), ref: 004031DB
    • Part of subcall function 00403187: lstrcmpiA.KERNEL32(-00000003,00401344), ref: 004031E9
    • Part of subcall function 00403187: lstrcpyA.KERNEL32(-00000003,00401344,?,?,00000001), ref: 004031FB
    • Part of subcall function 00403187: CopyFileA.KERNEL32(?,?,00000000), ref: 00403208
    • Part of subcall function 00403187: CreateFileA.KERNELBASE(?,C0000000,00000003,00000000,00000003,00000000,00000000,?,?,00000001), ref: 0040321F
    • Part of subcall function 00403187: SetFilePointer.KERNELBASE(00000000,?,00000000,00000000,?,?,00000001), ref: 00403264
    • Part of subcall function 00403187: WriteFile.KERNELBASE(00000000,00000000,00000002,?,00000000,?,?,00000001), ref: 00403276
    • Part of subcall function 00403187: CloseHandle.KERNEL32(00000000,?,?,00000001), ref: 0040327D
  • LoadLibraryA.KERNELBASE(?,?,00000000), ref: 0040255C
Memory Dump Source
  • Source File: 00000000.00000002.1667087219.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.1667061091.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667112860.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667134465.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_rpcnetp.jbxd
Similarity
  • API ID: File$lstrcpy$CloseCopyCreateCurrentHandleLibraryLoadModuleNamePointerProcessWritelstrcmpilstrlen
  • String ID:
  • API String ID: 2826298108-0
  • Opcode ID: e8fa9a5ab0e90bf7ac3574db5dfbbb1cd76a9456a18b4ccde3a7d56617f299f7
  • Instruction ID: 230871ee88a0079c86af088c874ddb91e9892db0b9abda11b080f0ab8cfff07c
  • Opcode Fuzzy Hash: e8fa9a5ab0e90bf7ac3574db5dfbbb1cd76a9456a18b4ccde3a7d56617f299f7
  • Instruction Fuzzy Hash: B6015EB56006149FD720DF68DE88B4A77E8EB08318F01417AD64AF7290D2B4A944CF9C

Non-executed Functions

Control-flow Graph

APIs
  • GetCurrentProcessId.KERNEL32(00403CA0,00000180,004027D5,00000000,00000001,00000000,?,?,004026F3), ref: 00402EDA
  • OpenProcess.KERNEL32(001FFFFF,00000001,00000000,?,?,004026F3), ref: 00402EEA
  • DuplicateTokenEx.ADVAPI32(?,02000000,00000000,00000000,00000001,00000000,?,00000001), ref: 00402F69
  • SetTokenInformation.ADVAPI32(00000000,0000000C,?,00000004), ref: 00402F7E
  • CreateEnvironmentBlock.USERENV(?,?,00000000), ref: 00402F8E
  • CreateProcessAsUserA.ADVAPI32(?,00000000,?,00000000,00000000,00000001,00000404,?,00000000,?,?,?,?,00000000), ref: 00402FB4
  • CloseHandle.KERNEL32(00000000), ref: 00402FC5
  • CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000004,00000000,00000000,?,?,?,00000001), ref: 00402FE7
  • WriteProcessMemory.KERNEL32(?,-00404FC0,00405070,00000080,00000000), ref: 00403047
  • TerminateProcess.KERNEL32(?,00000000,?,?,00000000,00000000,00000044,00000000), ref: 00403077
    • Part of subcall function 00402D08: GetSystemDirectoryA.KERNEL32(?,?), ref: 00402D1F
    • Part of subcall function 00402D08: lstrcatA.KERNEL32(?,\svchost.exe), ref: 00402D2D
  • CloseHandle.KERNEL32(?), ref: 00403080
  • CloseHandle.KERNEL32(?,?,?,00000000,00000000,00000044,00000000), ref: 0040308E
  • ResumeThread.KERNEL32(?), ref: 00403099
  • CreateThread.KERNEL32(00000000,00000000,Function_000033B3,?,00000000,?), ref: 004030B6
Strings
Memory Dump Source
  • Source File: 00000000.00000002.1667087219.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.1667061091.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667112860.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667134465.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_rpcnetp.jbxd
Similarity
  • API ID: Process$Create$CloseHandle$ThreadToken$BlockCurrentDirectoryDuplicateEnvironmentInformationMemoryOpenResumeSystemTerminateUserWritelstrcat
  • String ID: pP@
  • API String ID: 1678882957-1742187910
  • Opcode ID: 11957780e1a9e3ac5577ba74467633ca4e45c8da2927855ccdaf6d35260d4446
  • Instruction ID: 48c543887ccef012dc7ac3e570b48e6894f946ab0db30b625c0ebc434e70389d
  • Opcode Fuzzy Hash: 11957780e1a9e3ac5577ba74467633ca4e45c8da2927855ccdaf6d35260d4446
  • Instruction Fuzzy Hash: 2E61D471802229ABDB21DF91DD48EEEBF7DEF08745F10402AF605B21A4C7785A41DFA8

Control-flow Graph

  • Executed
  • Not Executed
control_flow_graph 132 a22be1-a22c0c call a2178b LoadLibraryA 135 a22c12-a22c25 GetProcAddress 132->135 136 a22ce1-a22ce5 132->136 135->136 137 a22c2b-a22c38 GetProcAddress 135->137 138 a22cf0-a22cf4 136->138 139 a22ce7-a22cea FreeLibrary 136->139 137->136 142 a22c3e 137->142 140 a22cf6-a22cf9 LocalFree 138->140 141 a22cff-a22d07 call a233e9 138->141 139->138 140->141 144 a22c43-a22c51 LocalAlloc 142->144 144->136 146 a22c57-a22c64 144->146 148 a22c66-a22c75 LocalFree 146->148 149 a22c77-a22c79 146->149 150 a22c7b-a22c7d 148->150 149->136 149->150 150->144 151 a22c7f-a22c84 150->151 152 a22c87-a22c8c 151->152 153 a22ccb-a22ccd 152->153 154 a22c8e-a22c9b 152->154 155 a22ccf-a22cd4 153->155 156 a22cdd 153->156 154->153 158 a22c9d-a22cb0 OpenProcess 154->158 155->152 155->156 156->136 158->156 159 a22cb2-a22cc9 OpenProcessToken CloseHandle 158->159 159->156
APIs
  • LoadLibraryA.KERNEL32(ntdll.dll), ref: 00A22BFF
  • GetProcAddress.KERNEL32(00000000,NtQuerySystemInformation), ref: 00A22C1E
  • GetProcAddress.KERNEL32(00000000,_wcsicmp), ref: 00A22C31
  • LocalAlloc.KERNEL32(00000040,00010000), ref: 00A22C46
  • LocalFree.KERNEL32(00000000), ref: 00A22C69
  • OpenProcess.KERNEL32(00000410,00000000,?), ref: 00A22CA6
  • OpenProcessToken.ADVAPI32(00000000,000200FF,?), ref: 00A22CBC
  • CloseHandle.KERNEL32(00000000), ref: 00A22CC3
  • FreeLibrary.KERNEL32(00000000), ref: 00A22CEA
  • LocalFree.KERNEL32(00000000), ref: 00A22CF9
Strings
Memory Dump Source
  • Source File: 00000000.00000002.1667304746.0000000000A21000.00000020.00000001.01000000.00000004.sdmp, Offset: 00A20000, based on PE: true
  • Associated: 00000000.00000002.1667291762.0000000000A20000.00000002.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667318567.0000000000A26000.00000004.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667332190.0000000000A27000.00000002.00000001.01000000.00000004.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_a20000_rpcnetp.jbxd
Similarity
  • API ID: FreeLocal$AddressLibraryOpenProcProcess$AllocCloseHandleLoadToken
  • String ID: NtQuerySystemInformation$_wcsicmp$explorer.exe$ntdll.dll
  • API String ID: 3808024924-2858649656
  • Opcode ID: d770a58d820a3866ee5a5983693771c325488e656fe313149b870c9ddbcb78b7
  • Instruction ID: 23c7da7e67a1d0f6b97fcf13e29f39f7ff2da55bf7571e7ca34b8dab7f913d2c
  • Opcode Fuzzy Hash: d770a58d820a3866ee5a5983693771c325488e656fe313149b870c9ddbcb78b7
  • Instruction Fuzzy Hash: 07316E71D00325ABDB219BADED48BEEB6B4BF58711F140435E911B2290DBB49D81CF54

Control-flow Graph

  • Executed
  • Not Executed
control_flow_graph 104 402be1-402c0c call 40178b LoadLibraryA 107 402ce1-402ce5 104->107 108 402c12-402c25 GetProcAddress 104->108 109 402cf0-402cf4 107->109 110 402ce7-402cea FreeLibrary 107->110 108->107 111 402c2b-402c38 GetProcAddress 108->111 112 402cf6-402cf9 LocalFree 109->112 113 402cff-402d07 call 4033e9 109->113 110->109 111->107 114 402c3e 111->114 112->113 116 402c43-402c51 LocalAlloc 114->116 116->107 118 402c57-402c64 116->118 120 402c66-402c75 LocalFree 118->120 121 402c77-402c79 118->121 122 402c7b-402c7d 120->122 121->107 121->122 122->116 123 402c7f-402c84 122->123 124 402c87-402c8c 123->124 125 402ccb-402ccd 124->125 126 402c8e-402c9b 124->126 127 402cdd 125->127 128 402ccf-402cd4 125->128 126->125 130 402c9d-402cb0 OpenProcess 126->130 127->107 128->124 128->127 130->127 131 402cb2-402cc9 OpenProcessToken CloseHandle 130->131 131->127
APIs
  • LoadLibraryA.KERNEL32(ntdll.dll), ref: 00402BFF
  • GetProcAddress.KERNEL32(00000000,NtQuerySystemInformation), ref: 00402C1E
  • GetProcAddress.KERNEL32(00000000,_wcsicmp), ref: 00402C31
  • LocalAlloc.KERNEL32(00000040,00010000), ref: 00402C46
  • LocalFree.KERNEL32(00000000), ref: 00402C69
  • OpenProcess.KERNEL32(00000410,00000000,?), ref: 00402CA6
  • OpenProcessToken.ADVAPI32(00000000,000200FF,?), ref: 00402CBC
  • CloseHandle.KERNEL32(00000000), ref: 00402CC3
  • FreeLibrary.KERNEL32(00000000), ref: 00402CEA
  • LocalFree.KERNEL32(00000000), ref: 00402CF9
Strings
Memory Dump Source
  • Source File: 00000000.00000002.1667087219.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.1667061091.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667112860.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667134465.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_rpcnetp.jbxd
Similarity
  • API ID: FreeLocal$AddressLibraryOpenProcProcess$AllocCloseHandleLoadToken
  • String ID: NtQuerySystemInformation$_wcsicmp$explorer.exe$ntdll.dll
  • API String ID: 3808024924-2858649656
  • Opcode ID: a6d811a8d3e870569674520a785892a75462e28a25577fb807dbe55d8ad1d7f4
  • Instruction ID: c13fdc06058cf9be2c783cc7f7b6a30699a0855dda5ef4865f3eb6f2515208be
  • Opcode Fuzzy Hash: a6d811a8d3e870569674520a785892a75462e28a25577fb807dbe55d8ad1d7f4
  • Instruction Fuzzy Hash: 67317E71D043159BEF215BA58E4DBAEBAB4BF08715F240036E945B22E0DBF88C809B58

Control-flow Graph

  • Executed
  • Not Executed
control_flow_graph 250 4014c3-4014ee LoadLibraryA 251 4014f0-4014f3 250->251 252 4014f8-4014ff 250->252 253 4015df-4015e2 251->253 254 401501-401517 GetProcAddress 252->254 255 401541-40154f FreeLibrary 254->255 256 401519-401523 254->256 257 4015de 255->257 256->254 258 401525-401535 256->258 257->253 260 401592-401595 258->260 261 401537-40153a 258->261 260->257 262 401554-401559 inet_ntoa 261->262 263 40153c-40153f 261->263 264 40155e-401576 262->264 263->264 264->260 266 401578-401590 264->266 266->260 268 401597-4015dd wsprintfA 266->268 268->257
APIs
  • LoadLibraryA.KERNEL32(wininet.dll), ref: 004014DE
  • GetProcAddress.KERNEL32(?,004011CC), ref: 0040150A
Strings
Memory Dump Source
  • Source File: 00000000.00000002.1667087219.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.1667061091.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667112860.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667134465.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_rpcnetp.jbxd
Similarity
  • API ID: AddressLibraryLoadProc
  • String ID: N$%s: 0$Mozilla/4.0 (compatible; MSIE 7.0;)$POST$TagId$wininet.dll
  • API String ID: 2574300362-1135021940
  • Opcode ID: e7f0f3c8f508b876c5fa306f532be16dde24df0314e8c27e32cbb3b6cae0240b
  • Instruction ID: 55760f99152eced98eafff36c210f15042cf257ac8e4928325542e4aab6520ce
  • Opcode Fuzzy Hash: e7f0f3c8f508b876c5fa306f532be16dde24df0314e8c27e32cbb3b6cae0240b
  • Instruction Fuzzy Hash: CB3191B1500608BFDB209F60CDC9DAB7BA8EB48754F10493AF653F65E0D274AD448B25
APIs
  • VirtualAllocEx.KERNEL32(?,00000000,00001000,00001000,00000004,00000044,00000000,00000001,?,?,00A23017,?,?,00000000,?,00000000), ref: 00A23131
  • lstrlenA.KERNEL32(?,00000000,?,?,00A23017,?,?,00000000,?,00000000), ref: 00A23142
  • WriteProcessMemory.KERNEL32(?,00000000,?,00000001,?,?,00A23017,?,?,00000000,?,00000000), ref: 00A2314F
  • VirtualFreeEx.KERNEL32(?,00000000,00001000,00008000,?,?,00A23017,?,?,00000000,?,00000000), ref: 00A23177
    • Part of subcall function 00A23426: CreateRemoteThread.KERNEL32(?,00000000,00000000,?,00A226F3,00000000,00000000), ref: 00A2344B
    • Part of subcall function 00A23426: CloseHandle.KERNEL32(?,?,?,?,00A23069,?,?,00000000,00000000,00000044,00000000), ref: 00A2348D
Memory Dump Source
  • Source File: 00000000.00000002.1667304746.0000000000A21000.00000020.00000001.01000000.00000004.sdmp, Offset: 00A20000, based on PE: true
  • Associated: 00000000.00000002.1667291762.0000000000A20000.00000002.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667318567.0000000000A26000.00000004.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667332190.0000000000A27000.00000002.00000001.01000000.00000004.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_a20000_rpcnetp.jbxd
Similarity
  • API ID: Virtual$AllocCloseCreateFreeHandleMemoryProcessRemoteThreadWritelstrlen
  • String ID:
  • API String ID: 4087653319-0
  • Opcode ID: 3e395a9bfd3e31ad7ce0221e63c1a9901d820775d959ed8363468a85f7adddec
  • Instruction ID: c593aeb813721e8fc4df349a5f517fd8a5410458d6d94d25d7d22cb86a30fbce
  • Opcode Fuzzy Hash: 3e395a9bfd3e31ad7ce0221e63c1a9901d820775d959ed8363468a85f7adddec
  • Instruction Fuzzy Hash: 12018176200258FBDB319B9ADC89FAB7F6CEB86791F104025BA05A5090C6799942CB74
APIs
  • VirtualAllocEx.KERNEL32(?,00000000,00001000,00001000,00000004,00000044,00000000,00000001,?,?,00403017,?,?,00000000,?,00000000), ref: 00403131
  • lstrlenA.KERNEL32(?,00000000,?,?,00403017,?,?,00000000,?,00000000), ref: 00403142
  • WriteProcessMemory.KERNEL32(?,00000000,?,00000001,?,?,00403017,?,?,00000000,?,00000000), ref: 0040314F
  • VirtualFreeEx.KERNEL32(?,00000000,00001000,00008000,?,?,00403017,?,?,00000000,?,00000000), ref: 00403177
    • Part of subcall function 00403426: CreateRemoteThread.KERNEL32(?,00000000,00000000,?,004026F3,00000000,00000000), ref: 0040344B
    • Part of subcall function 00403426: CloseHandle.KERNEL32(?,?,?,?,00403069,?,?,00000000,00000000,00000044,00000000), ref: 0040348D
Memory Dump Source
  • Source File: 00000000.00000002.1667087219.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.1667061091.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667112860.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667134465.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_rpcnetp.jbxd
Similarity
  • API ID: Virtual$AllocCloseCreateFreeHandleMemoryProcessRemoteThreadWritelstrlen
  • String ID:
  • API String ID: 4087653319-0
  • Opcode ID: 658860827393ae2cb197a9d513df03727d1bd74e57c94a52a80bc8137fd13d78
  • Instruction ID: cf2704d47440e46bdd879faa6c390eef7cd51666af6440076bd194a0a255cf94
  • Opcode Fuzzy Hash: 658860827393ae2cb197a9d513df03727d1bd74e57c94a52a80bc8137fd13d78
  • Instruction Fuzzy Hash: 26018C76200244FBEB218F66DD89F9B7F3CEB89791F104025BA45B51A1C6799A40CB78
APIs
  • StartServiceCtrlDispatcherA.ADVAPI32(00A25140,00A228D3), ref: 00A22B6E
Memory Dump Source
  • Source File: 00000000.00000002.1667304746.0000000000A21000.00000020.00000001.01000000.00000004.sdmp, Offset: 00A20000, based on PE: true
  • Associated: 00000000.00000002.1667291762.0000000000A20000.00000002.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667318567.0000000000A26000.00000004.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667332190.0000000000A27000.00000002.00000001.01000000.00000004.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_a20000_rpcnetp.jbxd
Similarity
  • API ID: CtrlDispatcherServiceStart
  • String ID:
  • API String ID: 3789849863-0
  • Opcode ID: 53479c621bb3d99e923a24092574ae2116cf59b2862b3d9932138bdc47a617f5
  • Instruction ID: 2e4930617e67a69232cf533fb38abe138a76b9a4414203c66623b90392b734b8
  • Opcode Fuzzy Hash: 53479c621bb3d99e923a24092574ae2116cf59b2862b3d9932138bdc47a617f5
  • Instruction Fuzzy Hash: A6A00134E84A549B8E20EBADA94AE2877A0B6697463405660E80186668C67454678E11

Control-flow Graph

APIs
  • GetCurrentProcessId.KERNEL32(00A23CA0,00000180,00A227D5,00000000,00000001,00000000,?,?,00A226F3), ref: 00A22EDA
  • OpenProcess.KERNEL32(001FFFFF,00000001,00000000,?,?,00A226F3), ref: 00A22EEA
  • DuplicateTokenEx.ADVAPI32(?,02000000,00000000,00000000,00000001,00000000,?,00000001), ref: 00A22F69
  • SetTokenInformation.ADVAPI32(00000000,0000000C,?,00000004), ref: 00A22F7E
  • CreateEnvironmentBlock.USERENV(?,?,00000000), ref: 00A22F8E
  • CreateProcessAsUserA.ADVAPI32(?,00000000,?,00000000,00000000,00000001,00000404,?,00000000,?,?,?,?,00000000), ref: 00A22FB4
  • CloseHandle.KERNEL32(00000000), ref: 00A22FC5
  • CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000004,00000000,00000000,?,?,?,00000001), ref: 00A22FE7
  • WriteProcessMemory.KERNEL32(?,-00A24FC0,00A25070,00000080,00000000), ref: 00A23047
  • TerminateProcess.KERNEL32(?,00000000,?,?,00000000,00000000,00000044,00000000), ref: 00A23077
    • Part of subcall function 00A22D08: GetSystemDirectoryA.KERNEL32(?,?), ref: 00A22D1F
    • Part of subcall function 00A22D08: lstrcatA.KERNEL32(?,\svchost.exe), ref: 00A22D2D
  • CloseHandle.KERNEL32(?), ref: 00A23080
  • CloseHandle.KERNEL32(?,?,?,00000000,00000000,00000044,00000000), ref: 00A2308E
  • ResumeThread.KERNEL32(?), ref: 00A23099
  • CreateThread.KERNEL32(00000000,00000000,Function_000033B3,?,00000000,?), ref: 00A230B6
Memory Dump Source
  • Source File: 00000000.00000002.1667304746.0000000000A21000.00000020.00000001.01000000.00000004.sdmp, Offset: 00A20000, based on PE: true
  • Associated: 00000000.00000002.1667291762.0000000000A20000.00000002.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667318567.0000000000A26000.00000004.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667332190.0000000000A27000.00000002.00000001.01000000.00000004.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_a20000_rpcnetp.jbxd
Similarity
  • API ID: Process$Create$CloseHandle$ThreadToken$BlockCurrentDirectoryDuplicateEnvironmentInformationMemoryOpenResumeSystemTerminateUserWritelstrcat
  • String ID:
  • API String ID: 1678882957-0
  • Opcode ID: 442200e549a9bbf864ee2d8e058b07f7c950b9ab20dc04e1e9bb81a9d43d2e00
  • Instruction ID: c98541e1fd67b0dceb0238c3b5f00768794f6d74f4cd31166cc70216b033cea4
  • Opcode Fuzzy Hash: 442200e549a9bbf864ee2d8e058b07f7c950b9ab20dc04e1e9bb81a9d43d2e00
  • Instruction Fuzzy Hash: B961C372D05228AFDF21DBA9ED48EEEBB79FF09750F104026F605A2160C7745A56CFA0

Control-flow Graph

  • Executed
  • Not Executed
control_flow_graph 206 a23187-a231aa GetModuleFileNameA 207 a231b0-a231bb 206->207 208 a23286-a23287 206->208 209 a231c4-a231f1 lstrcpyA lstrlenA lstrcmpiA 207->209 210 a231bd 207->210 211 a23283-a23285 209->211 212 a231f7-a23210 lstrcpyA CopyFileA 209->212 210->209 211->208 212->211 213 a23212-a2322a CreateFileA 212->213 213->211 214 a2322c-a23243 213->214 215 a23250-a23259 214->215 216 a23245-a2324e 214->216 217 a2325c-a2327d SetFilePointer WriteFile CloseHandle 215->217 216->217 217->211
APIs
  • GetModuleFileNameA.KERNEL32(?,00000104), ref: 00A231A2
  • lstrcpyA.KERNEL32(?,?,?,?,00000001), ref: 00A231D8
  • lstrlenA.KERNEL32(?,?,?,00000001), ref: 00A231DB
  • lstrcmpiA.KERNEL32(-00000003,00A21344), ref: 00A231E9
  • lstrcpyA.KERNEL32(-00000003,00A21344,?,?,00000001), ref: 00A231FB
  • CopyFileA.KERNEL32(?,?,00000000), ref: 00A23208
  • CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000,?,?,00000001), ref: 00A2321F
  • SetFilePointer.KERNEL32(00000000,?,00000000,00000000,?,?,00000001), ref: 00A23264
  • WriteFile.KERNEL32(00000000,00000000,00000002,?,00000000,?,?,00000001), ref: 00A23276
  • CloseHandle.KERNEL32(00000000,?,?,00000001), ref: 00A2327D
Strings
Memory Dump Source
  • Source File: 00000000.00000002.1667304746.0000000000A21000.00000020.00000001.01000000.00000004.sdmp, Offset: 00A20000, based on PE: true
  • Associated: 00000000.00000002.1667291762.0000000000A20000.00000002.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667318567.0000000000A26000.00000004.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667332190.0000000000A27000.00000002.00000001.01000000.00000004.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_a20000_rpcnetp.jbxd
Similarity
  • API ID: File$lstrcpy$CloseCopyCreateHandleModuleNamePointerWritelstrcmpilstrlen
  • String ID: dll$exe
  • API String ID: 3010676052-2048111982
  • Opcode ID: 6a90038eb6d3fbf8165f8056003c037349ea564d16ff4844f6f23d14347df25e
  • Instruction ID: e621612810cb0608dc407f04129735e68c78de032a5905612d7148e68e05816e
  • Opcode Fuzzy Hash: 6a90038eb6d3fbf8165f8056003c037349ea564d16ff4844f6f23d14347df25e
  • Instruction Fuzzy Hash: CD314D76604128EBDB20DBA9ED48EFA3BBCEB55750F108039FA05D6150D6749A86CBA0

Control-flow Graph

  • Executed
  • Not Executed
control_flow_graph 234 a22d08-a22d17 235 a22d3b-a22d3c 234->235 236 a22d19-a22d36 GetSystemDirectoryA lstrcatA 234->236 238 a22d3f-a22d4d lstrcpyA 235->238 237 a22dc3-a22dc5 236->237 239 a22d53-a22d65 RegOpenKeyA 238->239 240 a22d4f 238->240 241 a22db0-a22db2 239->241 242 a22d67-a22d8d RegQueryValueExA RegCloseKey 239->242 240->239 243 a22dc0 241->243 244 a22db4-a22db9 241->244 245 a22d9b-a22da8 GetBinaryTypeA 242->245 246 a22d8f-a22d95 lstrcatA 242->246 247 a22dc2 243->247 244->238 245->241 248 a22daa-a22dae 245->248 246->245 247->237 248->241 249 a22dbb-a22dbe 248->249 249->247
APIs
  • GetSystemDirectoryA.KERNEL32(?,?), ref: 00A22D1F
  • lstrcatA.KERNEL32(?,\svchost.exe), ref: 00A22D2D
  • lstrcpyA.KERNEL32(?,Software\Microsoft\Windows\CurrentVersion\App Paths\iexplore.exe,00000000,00000044), ref: 00A22D45
  • RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 00A22D5D
  • RegQueryValueExA.ADVAPI32(?,ProgramFilesDir,00000000,?,?,?), ref: 00A22D7C
  • RegCloseKey.ADVAPI32(?), ref: 00A22D85
  • lstrcatA.KERNEL32(?,\Internet Explorer\iexplore.exe), ref: 00A22D95
  • GetBinaryTypeA.KERNEL32(?,?), ref: 00A22DA0
Strings
  • ProgramFilesDir, xrefs: 00A22D78, 00A22DB4
  • \svchost.exe, xrefs: 00A22D25
  • Software\Microsoft\Windows\CurrentVersion\App Paths\iexplore.exe, xrefs: 00A22D3F
  • \Internet Explorer\iexplore.exe, xrefs: 00A22D8F
Memory Dump Source
  • Source File: 00000000.00000002.1667304746.0000000000A21000.00000020.00000001.01000000.00000004.sdmp, Offset: 00A20000, based on PE: true
  • Associated: 00000000.00000002.1667291762.0000000000A20000.00000002.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667318567.0000000000A26000.00000004.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667332190.0000000000A27000.00000002.00000001.01000000.00000004.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_a20000_rpcnetp.jbxd
Similarity
  • API ID: lstrcat$BinaryCloseDirectoryOpenQuerySystemTypeValuelstrcpy
  • String ID: ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion\App Paths\iexplore.exe$\Internet Explorer\iexplore.exe$\svchost.exe
  • API String ID: 2611574897-1971102070
  • Opcode ID: ab8c2c46a7384b0c6ea45fd450dbdec4d523c34780108e88ed14a55e1cc703cc
  • Instruction ID: ac91284c5dee30b6711a1197bfabd4638be089de5e153ddd96248d27c16493b4
  • Opcode Fuzzy Hash: ab8c2c46a7384b0c6ea45fd450dbdec4d523c34780108e88ed14a55e1cc703cc
  • Instruction Fuzzy Hash: D2212C36604168FBDB21DFA9ED08FEA7BB9FB55741F104435B906D5110DB308A429BA0

Control-flow Graph

  • Executed
  • Not Executed
control_flow_graph 218 402d08-402d17 219 402d19-402d36 GetSystemDirectoryA lstrcatA 218->219 220 402d3b-402d3c 218->220 221 402dc3-402dc5 219->221 222 402d3f-402d4d lstrcpyA 220->222 223 402d53-402d65 RegOpenKeyA 222->223 224 402d4f 222->224 225 402db0-402db2 223->225 226 402d67-402d8d RegQueryValueExA RegCloseKey 223->226 224->223 229 402dc0 225->229 230 402db4-402db9 225->230 227 402d9b-402da8 GetBinaryTypeA 226->227 228 402d8f-402d95 lstrcatA 226->228 227->225 231 402daa-402dae 227->231 228->227 232 402dc2 229->232 230->222 231->225 233 402dbb-402dbe 231->233 232->221 233->232
APIs
  • GetSystemDirectoryA.KERNEL32(?,?), ref: 00402D1F
  • lstrcatA.KERNEL32(?,\svchost.exe), ref: 00402D2D
  • lstrcpyA.KERNEL32(?,Software\Microsoft\Windows\CurrentVersion\App Paths\iexplore.exe,00000000,00000044), ref: 00402D45
  • RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 00402D5D
  • RegQueryValueExA.ADVAPI32(?,ProgramFilesDir,00000000,?,?,?), ref: 00402D7C
  • RegCloseKey.ADVAPI32(?), ref: 00402D85
  • lstrcatA.KERNEL32(?,\Internet Explorer\iexplore.exe), ref: 00402D95
  • GetBinaryTypeA.KERNEL32(?,?), ref: 00402DA0
Strings
  • ProgramFilesDir, xrefs: 00402D78, 00402DB4
  • Software\Microsoft\Windows\CurrentVersion\App Paths\iexplore.exe, xrefs: 00402D3F
  • \Internet Explorer\iexplore.exe, xrefs: 00402D8F
  • \svchost.exe, xrefs: 00402D25
Memory Dump Source
  • Source File: 00000000.00000002.1667087219.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.1667061091.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667112860.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667134465.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_rpcnetp.jbxd
Similarity
  • API ID: lstrcat$BinaryCloseDirectoryOpenQuerySystemTypeValuelstrcpy
  • String ID: ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion\App Paths\iexplore.exe$\Internet Explorer\iexplore.exe$\svchost.exe
  • API String ID: 2611574897-1971102070
  • Opcode ID: c499db2f4050ff19d14ce38f272b39f56c66e6ceb2c0f4dc08b3a58792dace64
  • Instruction ID: ed15d8e80b296fdae4186c7ff83a2837b71a94e962ea1344566a324c537ddc5b
  • Opcode Fuzzy Hash: c499db2f4050ff19d14ce38f272b39f56c66e6ceb2c0f4dc08b3a58792dace64
  • Instruction Fuzzy Hash: B0214A36600144FADB129F61DE08BEB7BB8EF45741F108076B946F16A0D7B88A419BA8

Control-flow Graph

  • Executed
  • Not Executed
control_flow_graph 272 a214c3-a214ee LoadLibraryA 273 a214f0-a214f3 272->273 274 a214f8-a214ff 272->274 275 a215df-a215e2 273->275 276 a21501-a21517 GetProcAddress 274->276 277 a21541-a2154f FreeLibrary 276->277 278 a21519-a21523 276->278 280 a215de 277->280 278->276 279 a21525-a21535 278->279 282 a21592-a21595 279->282 283 a21537-a2153a 279->283 280->275 282->280 284 a21554-a21559 inet_ntoa 283->284 285 a2153c-a2153f 283->285 286 a2155e-a21576 284->286 285->286 286->282 288 a21578-a21590 286->288 288->282 290 a21597-a215dd wsprintfA 288->290 290->280
APIs
  • LoadLibraryA.KERNEL32(wininet.dll), ref: 00A214DE
  • GetProcAddress.KERNEL32(?,00A211CC), ref: 00A2150A
Strings
Memory Dump Source
  • Source File: 00000000.00000002.1667304746.0000000000A21000.00000020.00000001.01000000.00000004.sdmp, Offset: 00A20000, based on PE: true
  • Associated: 00000000.00000002.1667291762.0000000000A20000.00000002.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667318567.0000000000A26000.00000004.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667332190.0000000000A27000.00000002.00000001.01000000.00000004.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_a20000_rpcnetp.jbxd
Similarity
  • API ID: AddressLibraryLoadProc
  • String ID: N$%s: 0$Mozilla/4.0 (compatible; MSIE 7.0;)$POST$TagId$wininet.dll
  • API String ID: 2574300362-1135021940
  • Opcode ID: 44685207738724014bfd3596aee5e50874af210862e9f8f040858d6dfc905659
  • Instruction ID: cd01a1677e4cad549fc356939ed2238326764dd27b6c1aeac96dfa52beaf3113
  • Opcode Fuzzy Hash: 44685207738724014bfd3596aee5e50874af210862e9f8f040858d6dfc905659
  • Instruction Fuzzy Hash: EF31C0B1600218BFDB209FA8DDC8DABBBB9FB58754B104938F653D6590D230ED448B20

Control-flow Graph

  • Executed
  • Not Executed
control_flow_graph 294 a22810-a2282c GetVersion 295 a22839-a22854 GetStdHandle call a2252d 294->295 296 a2282e-a22830 294->296 300 a228c1-a228c8 295->300 301 a22856-a22864 295->301 296->295 298 a22832 296->298 298->295 302 a228d5-a228d8 300->302 303 a228ca-a228cc 300->303 304 a22866-a22892 call a22be1 call a22eb2 301->304 305 a228a8-a228bd SetStdHandle 301->305 309 a22940-a22943 302->309 310 a228da-a228dc 302->310 306 a228e3-a228ed CreateEventA 303->306 307 a228ce-a228d3 call a22b69 303->307 325 a22897-a22899 304->325 326 a22894-a22895 CloseHandle 304->326 305->300 314 a228f2-a2290a CreateThread 306->314 307->309 315 a22945-a22948 CloseHandle 309->315 316 a2294a-a2294b ExitProcess 309->316 310->306 313 a228de-a228e1 310->313 313->306 313->314 319 a2293a-a2293b call a22e74 314->319 320 a2290c-a22919 314->320 315->316 319->309 322 a2291b-a22928 WaitForSingleObject CloseHandle 320->322 323 a2292e-a22938 WaitForSingleObject CloseHandle 320->323 322->323 323->319 327 a2289b-a228a3 call a22e74 325->327 328 a228bf 325->328 326->325 327->309 328->300
APIs
  • GetVersion.KERNEL32 ref: 00A22819
  • GetStdHandle.KERNEL32(000000F4), ref: 00A2283B
  • CloseHandle.KERNEL32(00000000), ref: 00A22895
  • SetStdHandle.KERNEL32(000000F6,?), ref: 00A228B7
  • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00A228E7
  • CreateThread.KERNEL32(00000000,00000000,Function_000025B3,00000000,00000000,?), ref: 00A228FF
  • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00A2291E
  • CloseHandle.KERNEL32 ref: 00A22926
  • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00A22933
  • CloseHandle.KERNEL32(?), ref: 00A22938
  • CloseHandle.KERNEL32(?), ref: 00A22948
  • ExitProcess.KERNEL32 ref: 00A2294B
Memory Dump Source
  • Source File: 00000000.00000002.1667304746.0000000000A21000.00000020.00000001.01000000.00000004.sdmp, Offset: 00A20000, based on PE: true
  • Associated: 00000000.00000002.1667291762.0000000000A20000.00000002.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667318567.0000000000A26000.00000004.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667332190.0000000000A27000.00000002.00000001.01000000.00000004.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_a20000_rpcnetp.jbxd
Similarity
  • API ID: Handle$Close$CreateObjectSingleWait$EventExitProcessThreadVersion
  • String ID:
  • API String ID: 2472693224-0
  • Opcode ID: dabd1105a8107f720bf3a9fb151465d02bda3a41e525da677e2564541c8922c4
  • Instruction ID: a1f771d8c08e832a347e56beeded88f4cd878a10086b9253ec3f0fc21e7e7729
  • Opcode Fuzzy Hash: dabd1105a8107f720bf3a9fb151465d02bda3a41e525da677e2564541c8922c4
  • Instruction Fuzzy Hash: F1315271808265BFCB30EFFCADC4E793AB8BB143647510235E911921A0D7348D87DBA0
APIs
  • KillTimer.USER32(?,00000064), ref: 00A226D0
  • PeekMessageA.USER32(?,?,00000113,00000113,00000001), ref: 00A226E4
  • SetTimer.USER32(?,00000064,000DBBA0,00000000), ref: 00A2270A
  • SetEvent.KERNEL32(?), ref: 00A22749
  • SetTimer.USER32(?,00000064,000DBBA0,00000000), ref: 00A22760
  • KillTimer.USER32(?,00000064), ref: 00A2276B
  • PeekMessageA.USER32(?,?,00000113,00000113,00000001), ref: 00A2277F
  • PostQuitMessage.USER32(00000000), ref: 00A2278A
  • DefWindowProcA.USER32(?,00000011,?,?), ref: 00A227A0
Strings
Memory Dump Source
  • Source File: 00000000.00000002.1667304746.0000000000A21000.00000020.00000001.01000000.00000004.sdmp, Offset: 00A20000, based on PE: true
  • Associated: 00000000.00000002.1667291762.0000000000A20000.00000002.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667318567.0000000000A26000.00000004.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667332190.0000000000A27000.00000002.00000001.01000000.00000004.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_a20000_rpcnetp.jbxd
Similarity
  • API ID: Timer$Message$KillPeek$EventPostProcQuitWindow
  • String ID: d
  • API String ID: 2149785620-2564639436
  • Opcode ID: 1a9cb5f821b9e9ce31ef8abf3aa084987c1858eeeffde2772cdc2c3a07537547
  • Instruction ID: 59b91bad798b1301107eb03fdfc901cee6b36cefef4f27b3eae2249dbccb27ee
  • Opcode Fuzzy Hash: 1a9cb5f821b9e9ce31ef8abf3aa084987c1858eeeffde2772cdc2c3a07537547
  • Instruction Fuzzy Hash: F831BF31948364BFDB309FBCBE89FBA3BA8AB21755F400138F605A50A1D3758812C761

Control-flow Graph

  • Executed
  • Not Executed
control_flow_graph 331 402691-4026a5 332 402768-402771 KillTimer 331->332 333 4026ab-4026ae 331->333 336 402776-402787 PeekMessageA 332->336 334 4026b0-4026b5 333->334 335 402715-402722 333->335 337 4026c3-4026c7 334->337 338 4026b7-4026bc 334->338 340 402728-402732 call 40220a 335->340 336->336 339 402789-402794 PostQuitMessage 336->339 342 402796-4027a0 DefWindowProcA 337->342 343 4026cd-4026d6 KillTimer 337->343 338->340 341 4026be 338->341 339->342 344 402734-402736 339->344 340->344 350 402738-40273f 340->350 341->342 347 4027a6-4027aa 342->347 346 4026db-4026ec PeekMessageA 343->346 344->347 346->346 349 4026ee-4026fb call 4027ad 346->349 349->342 356 402701-402710 SetTimer 349->356 351 402741-402749 SetEvent 350->351 352 40274f-402755 350->352 351->352 352->332 354 402757-402766 SetTimer 352->354 354->344 356->342
APIs
  • KillTimer.USER32(?,00000064), ref: 004026D0
  • PeekMessageA.USER32(?,?,00000113,00000113,00000001), ref: 004026E4
  • SetTimer.USER32(?,00000064,000DBBA0,00000000), ref: 0040270A
  • SetEvent.KERNEL32(?), ref: 00402749
  • SetTimer.USER32(?,00000064,000DBBA0,00000000), ref: 00402760
  • KillTimer.USER32(?,00000064), ref: 0040276B
  • PeekMessageA.USER32(?,?,00000113,00000113,00000001), ref: 0040277F
  • PostQuitMessage.USER32(00000000), ref: 0040278A
  • DefWindowProcA.USER32(?,00000011,?,?), ref: 004027A0
Strings
Memory Dump Source
  • Source File: 00000000.00000002.1667087219.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.1667061091.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667112860.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667134465.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_rpcnetp.jbxd
Similarity
  • API ID: Timer$Message$KillPeek$EventPostProcQuitWindow
  • String ID: d
  • API String ID: 2149785620-2564639436
  • Opcode ID: 788158b6ae4b03e146bf784c5c24d602dd0dca4eae1f0263ec1c7915737c847d
  • Instruction ID: 4146e7dff65f9d5d6a929247f4e74c17ea046e55d613d5af5036dbf01f38b0c3
  • Opcode Fuzzy Hash: 788158b6ae4b03e146bf784c5c24d602dd0dca4eae1f0263ec1c7915737c847d
  • Instruction Fuzzy Hash: 1031EE31500344ABDB256F64AF8DFAB3BACEB55715F000036F605BA1E1C3F98850CA7A
APIs
  • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 00A2357C
  • RegisterServiceCtrlHandlerA.ADVAPI32(rpcnetp,00A22B9C), ref: 00A235AB
    • Part of subcall function 00A22AE5: SetServiceStatus.ADVAPI32(00A25100,?,00A235D4,00000002,00001388,00000000), ref: 00A22B0B
    • Part of subcall function 00A22DF6: RegOpenKeyA.ADVAPI32(80000002,System\CurrentControlSet\Services\rpcnetp,?), ref: 00A22E11
    • Part of subcall function 00A22DF6: RegQueryValueExA.ADVAPI32(?,00000000,00000000,00000000,00A25070,00000080,00000002,00000000,00000001), ref: 00A22E2F
    • Part of subcall function 00A22DF6: RegEnumValueA.ADVAPI32(?,00000000,?,00000080,00000000,00000000,00000000,00000000), ref: 00A22E60
    • Part of subcall function 00A22DF6: RegCloseKey.ADVAPI32(?), ref: 00A22E69
  • CreateThread.KERNEL32(00000000,00000000,00A225B3,00000000,00000000,?), ref: 00A23605
  • WaitForSingleObject.KERNEL32(000000FF), ref: 00A23628
  • PostMessageA.USER32(?,00000011,00000000,00000000), ref: 00A23638
  • WaitForSingleObject.KERNEL32(?,00007530), ref: 00A23646
  • CloseHandle.KERNEL32(?), ref: 00A2364B
  • CloseHandle.KERNEL32 ref: 00A23657
Strings
Memory Dump Source
  • Source File: 00000000.00000002.1667304746.0000000000A21000.00000020.00000001.01000000.00000004.sdmp, Offset: 00A20000, based on PE: true
  • Associated: 00000000.00000002.1667291762.0000000000A20000.00000002.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667318567.0000000000A26000.00000004.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667332190.0000000000A27000.00000002.00000001.01000000.00000004.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_a20000_rpcnetp.jbxd
Similarity
  • API ID: Close$CreateHandleObjectServiceSingleValueWait$CtrlEnumEventHandlerMessageOpenPostQueryRegisterStatusThread
  • String ID: rpcnetp
  • API String ID: 2965456292-3180878357
  • Opcode ID: bdd5a71e35f45afb6fe4b31bf3cb458cddcb8fd64d89869619098c54d1d9920f
  • Instruction ID: df4c48082d117f82e02dcdf23f310c47adba2ee93581fb37ec15581c6c4913df
  • Opcode Fuzzy Hash: bdd5a71e35f45afb6fe4b31bf3cb458cddcb8fd64d89869619098c54d1d9920f
  • Instruction Fuzzy Hash: 2C216B71945624BBD730EFADBD49EAB7E6CFB16790B004539F605961A0C7B405038BA0
APIs
  • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0040357C
  • RegisterServiceCtrlHandlerA.ADVAPI32(rpcnetp,00402B9C), ref: 004035AB
    • Part of subcall function 00402AE5: SetServiceStatus.ADVAPI32(00405100,?,004035D4,00000002,00001388,00000000), ref: 00402B0B
    • Part of subcall function 00402DF6: RegOpenKeyA.ADVAPI32(80000002,System\CurrentControlSet\Services\rpcnetp,?), ref: 00402E11
    • Part of subcall function 00402DF6: RegQueryValueExA.ADVAPI32(?,00000000,00000000,00000000,00405070,00000080,00000002,00000000,00000001), ref: 00402E2F
    • Part of subcall function 00402DF6: RegEnumValueA.ADVAPI32(?,00000000,?,00000080,00000000,00000000,00000000,00000000), ref: 00402E60
    • Part of subcall function 00402DF6: RegCloseKey.ADVAPI32(?), ref: 00402E69
  • CreateThread.KERNEL32(00000000,00000000,004025B3,00000000,00000000,?), ref: 00403605
  • WaitForSingleObject.KERNEL32(000000FF), ref: 00403628
  • PostMessageA.USER32(?,00000011,00000000,00000000), ref: 00403638
  • WaitForSingleObject.KERNEL32(?,00007530), ref: 00403646
  • CloseHandle.KERNEL32(?), ref: 0040364B
  • CloseHandle.KERNEL32 ref: 00403657
Strings
Memory Dump Source
  • Source File: 00000000.00000002.1667087219.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.1667061091.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667112860.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667134465.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_rpcnetp.jbxd
Similarity
  • API ID: Close$CreateHandleObjectServiceSingleValueWait$CtrlEnumEventHandlerMessageOpenPostQueryRegisterStatusThread
  • String ID: rpcnetp
  • API String ID: 2965456292-3180878357
  • Opcode ID: 1d7e46fa320dc13aeeb0a2b45e3245fdac663ab64a8c095f0d303eb3bd547514
  • Instruction ID: b9b7afd12bf92787cc7a87e207f8211ca41d69d33ac13f49ee2273e324f2b2f7
  • Opcode Fuzzy Hash: 1d7e46fa320dc13aeeb0a2b45e3245fdac663ab64a8c095f0d303eb3bd547514
  • Instruction Fuzzy Hash: C3216BB0901624BBD7206F52AE4DE8B7E6CEB46795B10053AF205B61E1C7B809408FAC
APIs
  • GetStdHandle.KERNEL32(000000F4,?,?,?,?,?,?,00A23CD8,00000DA4), ref: 00A21B98
  • ReadProcessMemory.KERNEL32(00000000,?,?,00000010,?,?,?,?,?,?,?,00A23CD8,00000DA4), ref: 00A21BB9
  • ReadProcessMemory.KERNEL32(00000000,?,?,00000004,?,?,?,?,?,?,?,00A23CD8,00000DA4), ref: 00A21BD2
  • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00A23CD8,00000DA4), ref: 00A21C03
  • ResetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00A23CD8,00000DA4), ref: 00A21C0B
  • ReadProcessMemory.KERNEL32(00000000,?,?,00000000,?), ref: 00A21C2E
  • ExitThread.KERNEL32 ref: 00A21C91
Strings
Memory Dump Source
  • Source File: 00000000.00000002.1667304746.0000000000A21000.00000020.00000001.01000000.00000004.sdmp, Offset: 00A20000, based on PE: true
  • Associated: 00000000.00000002.1667291762.0000000000A20000.00000002.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667318567.0000000000A26000.00000004.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667332190.0000000000A27000.00000002.00000001.01000000.00000004.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_a20000_rpcnetp.jbxd
Similarity
  • API ID: MemoryProcessRead$Event$ExitHandleResetThread
  • String ID: x
  • API String ID: 2307309678-2363233923
  • Opcode ID: b32bec5e8f943845ae473c26a3e8274adba1b2ec1b3ec43d8236209db6b959ff
  • Instruction ID: 901c364d7f3bc27794bc941bc7ea1289b91214811d87fdc78af3a9e3a71d58dc
  • Opcode Fuzzy Hash: b32bec5e8f943845ae473c26a3e8274adba1b2ec1b3ec43d8236209db6b959ff
  • Instruction Fuzzy Hash: 8C31347594022AEEDF21DBE8ED84EEDBBB8EB18311F100125E510B2090D774AE86CF61
APIs
  • GetStdHandle.KERNEL32(000000F4,?,?,?,?,?,?,00403CD8,00000DA4), ref: 00401B98
  • ReadProcessMemory.KERNEL32(00000000,?,?,00000010,?,?,?,?,?,?,?,00403CD8,00000DA4), ref: 00401BB9
  • ReadProcessMemory.KERNEL32(00000000,?,?,00000004,?,?,?,?,?,?,?,00403CD8,00000DA4), ref: 00401BD2
  • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00403CD8,00000DA4), ref: 00401C03
  • ResetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00403CD8,00000DA4), ref: 00401C0B
  • ReadProcessMemory.KERNEL32(00000000,?,?,00000000,?), ref: 00401C2E
  • ExitThread.KERNEL32 ref: 00401C91
Strings
Memory Dump Source
  • Source File: 00000000.00000002.1667087219.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.1667061091.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667112860.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667134465.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_rpcnetp.jbxd
Similarity
  • API ID: MemoryProcessRead$Event$ExitHandleResetThread
  • String ID: x
  • API String ID: 2307309678-2363233923
  • Opcode ID: 2e493a0dd9b84af05df26eef17b2f8db8b2aac406ae78f1f4ca0f7775605e2a2
  • Instruction ID: 81935058fcf6de04fc342461eb25ad0ce884fdcc3147937999faeee3248a2f58
  • Opcode Fuzzy Hash: 2e493a0dd9b84af05df26eef17b2f8db8b2aac406ae78f1f4ca0f7775605e2a2
  • Instruction Fuzzy Hash: 89315E71944219EFEF10DBE4CD84EEE7BB8AB04310F140126E911B21E0C778AE85CF69
APIs
  • PeekMessageA.USER32(?,00000000,00000012,00000012,00000000), ref: 004029F6
  • LocalAlloc.KERNEL32(00000040,00004464,?,00000000,00000080), ref: 00402A0C
  • GetCurrentThreadId.KERNEL32 ref: 00402A20
  • CreateThread.KERNEL32(00000000,00000000,004033FA,00000000,00000000,?), ref: 00402A54
  • SetThreadPriority.KERNEL32(?,000000F1), ref: 00402A76
  • PostMessageA.USER32(00000400,00000001,00000002), ref: 00402AA9
Strings
Memory Dump Source
  • Source File: 00000000.00000002.1667087219.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.1667061091.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667112860.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667134465.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_rpcnetp.jbxd
Similarity
  • API ID: Thread$Message$AllocCreateCurrentLocalPeekPostPriority
  • String ID: vP@
  • API String ID: 2250156434-1666896180
  • Opcode ID: d9c1b0744aeb912969516d75e6a748d86802b318bf502a08a396029d8caa6d5c
  • Instruction ID: b3c5155c2a85fce59f2b01b100524277d3037c56840d0f53ec6babc7a5001f72
  • Opcode Fuzzy Hash: d9c1b0744aeb912969516d75e6a748d86802b318bf502a08a396029d8caa6d5c
  • Instruction Fuzzy Hash: 4A318171A00608ABDB219BA5CE49F8BBBBCEB45304F10816AF645F61D1DB749A40CF68
APIs
  • EnterCriticalSection.KERNEL32(?,?,?,?,?,00A22362,?), ref: 00A22399
  • SetEvent.KERNEL32(?,?,?,?,?,00A22362,?), ref: 00A223B0
  • SetEvent.KERNEL32(?,?,?,?,?,00A22362,?), ref: 00A223BD
  • WaitForSingleObject.KERNEL32(?,000007D0,?,?,?,?,00A22362,?), ref: 00A223D5
  • CloseHandle.KERNEL32(?,?,?,?,?,00A22362,?), ref: 00A223E1
  • CloseHandle.KERNEL32(?,?,?,?,?,00A22362,?), ref: 00A223F5
  • CloseHandle.KERNEL32(?,?,?,?,?,00A22362,?), ref: 00A22402
  • DeleteCriticalSection.KERNEL32(?,?,?,?,?,00A22362,?), ref: 00A22407
Memory Dump Source
  • Source File: 00000000.00000002.1667304746.0000000000A21000.00000020.00000001.01000000.00000004.sdmp, Offset: 00A20000, based on PE: true
  • Associated: 00000000.00000002.1667291762.0000000000A20000.00000002.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667318567.0000000000A26000.00000004.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667332190.0000000000A27000.00000002.00000001.01000000.00000004.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_a20000_rpcnetp.jbxd
Similarity
  • API ID: CloseHandle$CriticalEventSection$DeleteEnterObjectSingleWait
  • String ID:
  • API String ID: 2299618653-0
  • Opcode ID: bce193cb0b1724b465cf982ffe188329f6ebd7d0c849321ca6d611a970993423
  • Instruction ID: 65341b2fa5c09ce463bef14a0691716e2fdae6d9ac97a6d24c6678d1200f0bdb
  • Opcode Fuzzy Hash: bce193cb0b1724b465cf982ffe188329f6ebd7d0c849321ca6d611a970993423
  • Instruction Fuzzy Hash: E2112A35604714ABCB20EB79EC94BD7BBA8AF18791B058929F959D7210DB24E8428B60
APIs
  • EnterCriticalSection.KERNEL32(?,?,?,?,?,00402362,?), ref: 00402399
  • SetEvent.KERNEL32(?,?,?,?,?,00402362,?), ref: 004023B0
  • SetEvent.KERNEL32(?,?,?,?,?,00402362,?), ref: 004023BD
  • WaitForSingleObject.KERNEL32(?,000007D0,?,?,?,?,00402362,?), ref: 004023D5
  • CloseHandle.KERNEL32(?,?,?,?,?,00402362,?), ref: 004023E1
  • CloseHandle.KERNEL32(?,?,?,?,?,00402362,?), ref: 004023F5
  • CloseHandle.KERNEL32(?,?,?,?,?,00402362,?), ref: 00402402
  • DeleteCriticalSection.KERNEL32(?,?,?,?,?,00402362,?), ref: 00402407
Memory Dump Source
  • Source File: 00000000.00000002.1667087219.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.1667061091.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667112860.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667134465.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_rpcnetp.jbxd
Similarity
  • API ID: CloseHandle$CriticalEventSection$DeleteEnterObjectSingleWait
  • String ID:
  • API String ID: 2299618653-0
  • Opcode ID: faf1c56d3449b0115e270c2d15903ec17e0fe08861eeb166ea37fb5cbfa16b0b
  • Instruction ID: 05f698acd1fdf22502a31cde1afe2f3b6d13bb5edab1a564564757d72b465a12
  • Opcode Fuzzy Hash: faf1c56d3449b0115e270c2d15903ec17e0fe08861eeb166ea37fb5cbfa16b0b
  • Instruction Fuzzy Hash: F1118235600704ABCB219F35DD88AD7B7ECBF04781F05882AFD99E3291D778E840CA64
APIs
  • GetModuleFileNameA.KERNEL32(?,?,00000103,00A25018,00000000,?,00000000,00080000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00A225F7
  • RegisterClassA.USER32 ref: 00A225FD
  • CreateWindowExA.USER32 ref: 00A22603
  • SetTimer.USER32(00000064,?,00000000), ref: 00A2262B
  • GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00A22638
  • TranslateMessage.USER32(?), ref: 00A22646
  • DispatchMessageA.USER32(?), ref: 00A22650
Memory Dump Source
  • Source File: 00000000.00000002.1667304746.0000000000A21000.00000020.00000001.01000000.00000004.sdmp, Offset: 00A20000, based on PE: true
  • Associated: 00000000.00000002.1667291762.0000000000A20000.00000002.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667318567.0000000000A26000.00000004.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667332190.0000000000A27000.00000002.00000001.01000000.00000004.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_a20000_rpcnetp.jbxd
Similarity
  • API ID: Message$ClassCreateDispatchFileModuleNameRegisterTimerTranslateWindow
  • String ID:
  • API String ID: 2359640614-0
  • Opcode ID: 0c68c61c5123def06dec8965de364e9865c0ab04dec440aed202772f0bd43ea1
  • Instruction ID: 0d84cd7fde5aac41ac41cb9d345984ce5e219d50b9c45e08846d8f08d4a7725e
  • Opcode Fuzzy Hash: 0c68c61c5123def06dec8965de364e9865c0ab04dec440aed202772f0bd43ea1
  • Instruction Fuzzy Hash: 22113DB1D44614BFD720DBF8ED49EBA7BBCFB91701B100639BA01D25A0D7744A568B60
APIs
  • GetModuleFileNameA.KERNEL32(?,?,00000103,00405018,00000000,?,00000000,00080000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 004025F7
  • RegisterClassA.USER32 ref: 004025FD
  • CreateWindowExA.USER32 ref: 00402603
  • SetTimer.USER32(00000064,?,00000000), ref: 0040262B
  • GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00402638
  • TranslateMessage.USER32(?), ref: 00402646
  • DispatchMessageA.USER32(?), ref: 00402650
Memory Dump Source
  • Source File: 00000000.00000002.1667087219.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.1667061091.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667112860.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667134465.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_rpcnetp.jbxd
Similarity
  • API ID: Message$ClassCreateDispatchFileModuleNameRegisterTimerTranslateWindow
  • String ID:
  • API String ID: 2359640614-0
  • Opcode ID: 1428383eb1f0e8057fef3d496035bbc9effb1ee24df824c0a0c4f2cbed0a3432
  • Instruction ID: 712634aa623e0817e6849e726326b394937e7e84ca649c12cc98f7f66d0a4027
  • Opcode Fuzzy Hash: 1428383eb1f0e8057fef3d496035bbc9effb1ee24df824c0a0c4f2cbed0a3432
  • Instruction Fuzzy Hash: C31151B1900604AFD710AFB5DE4DE6F7BBCFB95705B10453AB601F61E0D7744A408B68
APIs
  • RegOpenKeyA.ADVAPI32(80000002,System\CurrentControlSet\Services\rpcnetp,?), ref: 00A22E11
  • RegQueryValueExA.ADVAPI32(?,00000000,00000000,00000000,00A25070,00000080,00000002,00000000,00000001), ref: 00A22E2F
  • RegDeleteValueA.ADVAPI32(?,?), ref: 00A22E47
  • RegEnumValueA.ADVAPI32(?,00000000,?,00000080,00000000,00000000,00000000,00000000), ref: 00A22E60
  • RegCloseKey.ADVAPI32(?), ref: 00A22E69
Strings
  • System\CurrentControlSet\Services\rpcnetp, xrefs: 00A22E00
Memory Dump Source
  • Source File: 00000000.00000002.1667304746.0000000000A21000.00000020.00000001.01000000.00000004.sdmp, Offset: 00A20000, based on PE: true
  • Associated: 00000000.00000002.1667291762.0000000000A20000.00000002.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667318567.0000000000A26000.00000004.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667332190.0000000000A27000.00000002.00000001.01000000.00000004.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_a20000_rpcnetp.jbxd
Similarity
  • API ID: Value$CloseDeleteEnumOpenQuery
  • String ID: System\CurrentControlSet\Services\rpcnetp
  • API String ID: 1768883651-3077676073
  • Opcode ID: d0f33ba11704c14755c2ea968f4c5438942ce56d83a4f061ca2343fe9ec9d664
  • Instruction ID: 321fd2424ae02b13754ab82d18d51ba0cec0c089f313abaea666f85e371ad790
  • Opcode Fuzzy Hash: d0f33ba11704c14755c2ea968f4c5438942ce56d83a4f061ca2343fe9ec9d664
  • Instruction Fuzzy Hash: 31010076501128FADB20DBD9EC48EEF7F7CEF15361F100071F905A1010D6709A46DBA0
APIs
  • RegOpenKeyA.ADVAPI32(80000002,System\CurrentControlSet\Services\rpcnetp,?), ref: 00402E11
  • RegQueryValueExA.ADVAPI32(?,00000000,00000000,00000000,00405070,00000080,00000002,00000000,00000001), ref: 00402E2F
  • RegDeleteValueA.ADVAPI32(?,?), ref: 00402E47
  • RegEnumValueA.ADVAPI32(?,00000000,?,00000080,00000000,00000000,00000000,00000000), ref: 00402E60
  • RegCloseKey.ADVAPI32(?), ref: 00402E69
Strings
  • System\CurrentControlSet\Services\rpcnetp, xrefs: 00402E00
Memory Dump Source
  • Source File: 00000000.00000002.1667087219.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.1667061091.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667112860.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667134465.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_rpcnetp.jbxd
Similarity
  • API ID: Value$CloseDeleteEnumOpenQuery
  • String ID: System\CurrentControlSet\Services\rpcnetp
  • API String ID: 1768883651-3077676073
  • Opcode ID: 24901ab7914830ef6385fc247776699aa31b9192637591c317c3188df503adef
  • Instruction ID: 046056ca9bbb8563ea703a4c9f344ee4ef02cc1dcef8da84f746e39af4cc73b7
  • Opcode Fuzzy Hash: 24901ab7914830ef6385fc247776699aa31b9192637591c317c3188df503adef
  • Instruction Fuzzy Hash: 1E010876901118FADB209BD2DE48EDFBF7CEF493A1F100072FA45B11A0D6749A85DBA4
APIs
  • GetStdHandle.KERNEL32(000000F4,00A23D28,000000E0,00A23405,?), ref: 00A21865
    • Part of subcall function 00A2381C: GetVersion.KERNEL32(?,00A25150,00000034,?,?,00A218AF,?,?,?,?,?,00000040,?,00000000,00000040), ref: 00A23839
  • GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,?,?,?,?,00000040,?,00000000,00000040), ref: 00A218DE
  • CreateRemoteThread.KERNEL32(?,00000000,00000000,00000000,?,00000004,?), ref: 00A2190A
  • ResumeThread.KERNEL32(?), ref: 00A2196C
  • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 00A2197B
  • CloseHandle.KERNEL32(?), ref: 00A21984
Memory Dump Source
  • Source File: 00000000.00000002.1667304746.0000000000A21000.00000020.00000001.01000000.00000004.sdmp, Offset: 00A20000, based on PE: true
  • Associated: 00000000.00000002.1667291762.0000000000A20000.00000002.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667318567.0000000000A26000.00000004.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667332190.0000000000A27000.00000002.00000001.01000000.00000004.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_a20000_rpcnetp.jbxd
Similarity
  • API ID: Handle$Thread$CloseCreateMultipleObjectsRemoteResumeVersionWait
  • String ID:
  • API String ID: 3869061129-0
  • Opcode ID: e946296b8781b8dee88334f6cc3cc1698e48f4259c358171e0858b7ff2bde866
  • Instruction ID: 56925d41630fa18db338bf1053127bd10433ed2c9f68ba92b923235b7c4deb05
  • Opcode Fuzzy Hash: e946296b8781b8dee88334f6cc3cc1698e48f4259c358171e0858b7ff2bde866
  • Instruction Fuzzy Hash: E6417E71C00268AADF20DFA9ED45FEEBAB8BF55310F104639F511A6091D7789A85CF20
APIs
  • GetStdHandle.KERNEL32(000000F4,00403D28,000000E0,00403405,?), ref: 00401865
    • Part of subcall function 0040381C: GetVersion.KERNEL32(?,00405150,00000034,?,?,004018AF,?,?,?,?,?,00000040,?,00000000,00000040), ref: 00403839
  • GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,?,?,?,?,00000040,?,00000000,00000040), ref: 004018DE
  • CreateRemoteThread.KERNEL32(?,00000000,00000000,00000000,?,00000004,?), ref: 0040190A
  • ResumeThread.KERNEL32(?), ref: 0040196C
  • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 0040197B
  • CloseHandle.KERNEL32(?), ref: 00401984
Memory Dump Source
  • Source File: 00000000.00000002.1667087219.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.1667061091.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667112860.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667134465.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_rpcnetp.jbxd
Similarity
  • API ID: Handle$Thread$CloseCreateMultipleObjectsRemoteResumeVersionWait
  • String ID:
  • API String ID: 3869061129-0
  • Opcode ID: 9bc09197fc356cc899a3623219c0ea5bdb23df86491b186bf5197572956ab66f
  • Instruction ID: 39d7b7a65ba03cc0244b6edcb67a82141fc2be70d3d5ef91f1cf8c64e53fd6b6
  • Opcode Fuzzy Hash: 9bc09197fc356cc899a3623219c0ea5bdb23df86491b186bf5197572956ab66f
  • Instruction Fuzzy Hash: 184149B1800258AADB20DFA1CC49EEEBABCBF44314F10426FF551B61E1D7789A44CF29
APIs
  • PeekMessageA.USER32(?,00000000,00000012,00000012,00000000), ref: 00A229F6
  • LocalAlloc.KERNEL32(00000040,00004464,?,00000000,00000080), ref: 00A22A0C
  • GetCurrentThreadId.KERNEL32 ref: 00A22A20
  • CreateThread.KERNEL32(00000000,00000000,00A233FA,00000000,00000000,?), ref: 00A22A54
  • SetThreadPriority.KERNEL32(?,000000F1), ref: 00A22A76
  • PostMessageA.USER32(00000400,00000001,00000002), ref: 00A22AA9
Memory Dump Source
  • Source File: 00000000.00000002.1667304746.0000000000A21000.00000020.00000001.01000000.00000004.sdmp, Offset: 00A20000, based on PE: true
  • Associated: 00000000.00000002.1667291762.0000000000A20000.00000002.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667318567.0000000000A26000.00000004.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667332190.0000000000A27000.00000002.00000001.01000000.00000004.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_a20000_rpcnetp.jbxd
Similarity
  • API ID: Thread$Message$AllocCreateCurrentLocalPeekPostPriority
  • String ID:
  • API String ID: 2250156434-0
  • Opcode ID: 2ba16cebb1320ce77fb6dbb1fff3d6246151dd74bf113428b088945672895b1a
  • Instruction ID: ff124030b25969389c3f48852f65debc1c45eaedabefc3fb01580ac6df3ec886
  • Opcode Fuzzy Hash: 2ba16cebb1320ce77fb6dbb1fff3d6246151dd74bf113428b088945672895b1a
  • Instruction Fuzzy Hash: 0B319A71900628BFDB31DBACED49F9ABBBCFB45340F108269F645E6191D7709A81CB21
APIs
  • LocalAlloc.KERNEL32(00000040,00004464,00A23D18,00000010), ref: 00A21CAB
  • GetStdHandle.KERNEL32(000000F4), ref: 00A21CB6
  • WriteProcessMemory.KERNEL32(00000000,?,00000000,00000004,?), ref: 00A21CDF
  • ReadProcessMemory.KERNEL32(00000000,?,00000000,00000078,?), ref: 00A21CF4
    • Part of subcall function 00A21843: GetStdHandle.KERNEL32(000000F4,00A23D28,000000E0,00A23405,?), ref: 00A21865
    • Part of subcall function 00A21843: GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,?,?,?,?,00000040,?,00000000,00000040), ref: 00A218DE
    • Part of subcall function 00A21843: CreateRemoteThread.KERNEL32(?,00000000,00000000,00000000,?,00000004,?), ref: 00A2190A
    • Part of subcall function 00A21843: ResumeThread.KERNEL32(?), ref: 00A2196C
    • Part of subcall function 00A21843: WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 00A2197B
    • Part of subcall function 00A21843: CloseHandle.KERNEL32(?), ref: 00A21984
  • LocalFree.KERNEL32(00000000), ref: 00A21D28
  • ExitThread.KERNEL32 ref: 00A21D3D
Memory Dump Source
  • Source File: 00000000.00000002.1667304746.0000000000A21000.00000020.00000001.01000000.00000004.sdmp, Offset: 00A20000, based on PE: true
  • Associated: 00000000.00000002.1667291762.0000000000A20000.00000002.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667318567.0000000000A26000.00000004.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667332190.0000000000A27000.00000002.00000001.01000000.00000004.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_a20000_rpcnetp.jbxd
Similarity
  • API ID: Handle$Thread$LocalMemoryProcess$AllocCloseCreateExitFreeMultipleObjectsReadRemoteResumeWaitWrite
  • String ID:
  • API String ID: 3187294079-0
  • Opcode ID: 96978057c7194b2c5806e8e6598622e68c118a7be34cc436ae9e1261d696f56a
  • Instruction ID: 2414356b6006e68b89b9f7e85e5e1dd6a06afa455fbfb4fc0f3281a1c36b33d6
  • Opcode Fuzzy Hash: 96978057c7194b2c5806e8e6598622e68c118a7be34cc436ae9e1261d696f56a
  • Instruction Fuzzy Hash: F8113A7190421AEFDB20DB98DC49FFE7BB4EB14720F148175E524A61A1C7389946DF14
APIs
  • LocalAlloc.KERNEL32(00000040,00004464,00403D18,00000010), ref: 00401CAB
  • GetStdHandle.KERNEL32(000000F4), ref: 00401CB6
  • WriteProcessMemory.KERNEL32(00000000,?,00000000,00000004,?), ref: 00401CDF
  • ReadProcessMemory.KERNEL32(00000000,?,00000000,00000078,?), ref: 00401CF4
    • Part of subcall function 00401843: GetStdHandle.KERNEL32(000000F4,00403D28,000000E0,00403405,?), ref: 00401865
    • Part of subcall function 00401843: GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,?,?,?,?,00000040,?,00000000,00000040), ref: 004018DE
    • Part of subcall function 00401843: CreateRemoteThread.KERNEL32(?,00000000,00000000,00000000,?,00000004,?), ref: 0040190A
    • Part of subcall function 00401843: ResumeThread.KERNEL32(?), ref: 0040196C
    • Part of subcall function 00401843: WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 0040197B
    • Part of subcall function 00401843: CloseHandle.KERNEL32(?), ref: 00401984
  • LocalFree.KERNEL32(00000000), ref: 00401D28
  • ExitThread.KERNEL32 ref: 00401D3D
Memory Dump Source
  • Source File: 00000000.00000002.1667087219.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.1667061091.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667112860.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667134465.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_rpcnetp.jbxd
Similarity
  • API ID: Handle$Thread$LocalMemoryProcess$AllocCloseCreateExitFreeMultipleObjectsReadRemoteResumeWaitWrite
  • String ID:
  • API String ID: 3187294079-0
  • Opcode ID: 89312ce2d0e72a7f395c57c8affcfc28eed6495173ff693821a33f4466f850aa
  • Instruction ID: 4dcc0f069dc886efddb8e915f196cfedbe51cafda5c366a27be74427557cf9cc
  • Opcode Fuzzy Hash: 89312ce2d0e72a7f395c57c8affcfc28eed6495173ff693821a33f4466f850aa
  • Instruction Fuzzy Hash: 5711497190020AAFDB109FA5DC49FEE7BB8AF04720F148266F565B61F0C7389985DF18
APIs
  • InitializeCriticalSection.KERNEL32(?), ref: 00A2244C
  • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 00A2245F
  • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 00A2246C
  • CreateThread.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 00A22490
  • SetThreadPriority.KERNEL32(?,?), ref: 00A224A9
Memory Dump Source
  • Source File: 00000000.00000002.1667304746.0000000000A21000.00000020.00000001.01000000.00000004.sdmp, Offset: 00A20000, based on PE: true
  • Associated: 00000000.00000002.1667291762.0000000000A20000.00000002.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667318567.0000000000A26000.00000004.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667332190.0000000000A27000.00000002.00000001.01000000.00000004.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_a20000_rpcnetp.jbxd
Similarity
  • API ID: Create$EventThread$CriticalInitializePrioritySection
  • String ID:
  • API String ID: 2454249074-0
  • Opcode ID: c28a8c5c0b2df44efb9617dcd32518ba4557777f98150c95eaac764a999ad26e
  • Instruction ID: a076c4a4502f5c81856d92bb583f0a80b4904576c16da157e82609a272172a28
  • Opcode Fuzzy Hash: c28a8c5c0b2df44efb9617dcd32518ba4557777f98150c95eaac764a999ad26e
  • Instruction Fuzzy Hash: 00116035500654BBC731AF699C44EE7BBF9FF89740B04482EF9A986111E335A842CB20
APIs
  • InitializeCriticalSection.KERNEL32(?), ref: 0040244C
  • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0040245F
  • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0040246C
  • CreateThread.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 00402490
  • SetThreadPriority.KERNEL32(?,?), ref: 004024A9
Memory Dump Source
  • Source File: 00000000.00000002.1667087219.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.1667061091.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667112860.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667134465.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_rpcnetp.jbxd
Similarity
  • API ID: Create$EventThread$CriticalInitializePrioritySection
  • String ID:
  • API String ID: 2454249074-0
  • Opcode ID: 9601d3d944b8396fc69740d90de82c3dd0bb766865a97f42f2e366a5ddec668c
  • Instruction ID: 572a93cb63d77f8a72c1ef43f81203abdc73baac1463497f861453daa1844bb9
  • Opcode Fuzzy Hash: 9601d3d944b8396fc69740d90de82c3dd0bb766865a97f42f2e366a5ddec668c
  • Instruction Fuzzy Hash: 47116035100684ABC7329F658D58DE7BBF8FF89740B04482EF9A996291E379A841CB24
APIs
  • CreateRemoteThread.KERNEL32(?,00000000,00000000,?,00A226F3,00000000,00000000), ref: 00A2344B
  • WaitForMultipleObjects.KERNEL32(00000001,?,00000000,000000FF,?,?,?,00A23069,?,?,00000000,00000000,00000044,00000000), ref: 00A23476
  • GetExitCodeThread.KERNEL32(?,?,?,?,?,00A23069,?,?,00000000,00000000,00000044,00000000), ref: 00A23484
  • CloseHandle.KERNEL32(?,?,?,?,00A23069,?,?,00000000,00000000,00000044,00000000), ref: 00A2348D
  • TerminateProcess.KERNEL32(?,00000000,?,?,?,00A23069,?,?,00000000,00000000,00000044,00000000), ref: 00A23499
Memory Dump Source
  • Source File: 00000000.00000002.1667304746.0000000000A21000.00000020.00000001.01000000.00000004.sdmp, Offset: 00A20000, based on PE: true
  • Associated: 00000000.00000002.1667291762.0000000000A20000.00000002.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667318567.0000000000A26000.00000004.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667332190.0000000000A27000.00000002.00000001.01000000.00000004.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_a20000_rpcnetp.jbxd
Similarity
  • API ID: Thread$CloseCodeCreateExitHandleMultipleObjectsProcessRemoteTerminateWait
  • String ID:
  • API String ID: 1317926807-0
  • Opcode ID: 4f39b0b6dd7a3e187c56502eca9801130c35738c950aa5f9fcb294ff6e578d86
  • Instruction ID: 9daaa8f857b25afb3d738e071581c38d48ea78eb033ca080bc35285965fdc663
  • Opcode Fuzzy Hash: 4f39b0b6dd7a3e187c56502eca9801130c35738c950aa5f9fcb294ff6e578d86
  • Instruction Fuzzy Hash: B0118E32505138FBCF229F9AEC48DEF7F78EF167A2F1081A2F51592150C3754A82CAA0
APIs
  • CreateRemoteThread.KERNEL32(?,00000000,00000000,?,004026F3,00000000,00000000), ref: 0040344B
  • WaitForMultipleObjects.KERNEL32(00000001,?,00000000,000000FF,?,?,?,00403069,?,?,00000000,00000000,00000044,00000000), ref: 00403476
  • GetExitCodeThread.KERNEL32(?,?,?,?,?,00403069,?,?,00000000,00000000,00000044,00000000), ref: 00403484
  • CloseHandle.KERNEL32(?,?,?,?,00403069,?,?,00000000,00000000,00000044,00000000), ref: 0040348D
  • TerminateProcess.KERNEL32(?,00000000,?,?,?,00403069,?,?,00000000,00000000,00000044,00000000), ref: 00403499
Memory Dump Source
  • Source File: 00000000.00000002.1667087219.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.1667061091.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667112860.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667134465.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_rpcnetp.jbxd
Similarity
  • API ID: Thread$CloseCodeCreateExitHandleMultipleObjectsProcessRemoteTerminateWait
  • String ID:
  • API String ID: 1317926807-0
  • Opcode ID: 8cd0b04c13307a6cd237efc4485d8960eb13dabe45fd48181b2a3adfdfee44d1
  • Instruction ID: 5b99711272aad8972bb747cdccbe3d7b25785faebf461d70bd82baa156f316eb
  • Opcode Fuzzy Hash: 8cd0b04c13307a6cd237efc4485d8960eb13dabe45fd48181b2a3adfdfee44d1
  • Instruction Fuzzy Hash: F7117970401128BBCB224F52CC48DCFBE7CEF057A2F108022F509AA2A0C3754A81DAA5
APIs
  • GetStdHandle.KERNEL32(000000F4,?,?,?,?,00A21E9E,?,?,?,?,00A21DFB,?,?,?), ref: 00A221BA
  • CreateRemoteThread.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?), ref: 00A221DB
  • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,00A21E9E,?,?,?,?,00A21DFB,?,?,?), ref: 00A221EA
  • GetExitCodeThread.KERNEL32(00000000,00000000,?,?,?,00A21E9E,?,?,?,?,00A21DFB,?,?,?), ref: 00A221F5
  • CloseHandle.KERNEL32(00000000,?,?,?,00A21E9E,?,?,?,?,00A21DFB,?,?,?), ref: 00A221FC
Memory Dump Source
  • Source File: 00000000.00000002.1667304746.0000000000A21000.00000020.00000001.01000000.00000004.sdmp, Offset: 00A20000, based on PE: true
  • Associated: 00000000.00000002.1667291762.0000000000A20000.00000002.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667318567.0000000000A26000.00000004.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667332190.0000000000A27000.00000002.00000001.01000000.00000004.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_a20000_rpcnetp.jbxd
Similarity
  • API ID: HandleThread$CloseCodeCreateExitObjectRemoteSingleWait
  • String ID:
  • API String ID: 3128336559-0
  • Opcode ID: 85a7f520f2997374e3a1f8c5b1d71ff7840bd2e840e9f95110dc5d727b14cd9d
  • Instruction ID: a443dd35085897df71a165e8443b8351d8085cdf5902384015619ac77d3cfb6f
  • Opcode Fuzzy Hash: 85a7f520f2997374e3a1f8c5b1d71ff7840bd2e840e9f95110dc5d727b14cd9d
  • Instruction Fuzzy Hash: 30F0B476104108BBD720D7D8DC4AFFE367CEB95B20F200234F511A21D0EB789A439724
APIs
  • GetStdHandle.KERNEL32(000000F4,?,?,?,?,00401E9E,?,?,?,?,00401DFB,?,?,?), ref: 004021BA
  • CreateRemoteThread.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?), ref: 004021DB
  • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,00401E9E,?,?,?,?,00401DFB,?,?,?), ref: 004021EA
  • GetExitCodeThread.KERNEL32(00000000,00000000,?,?,?,00401E9E,?,?,?,?,00401DFB,?,?,?), ref: 004021F5
  • CloseHandle.KERNEL32(00000000,?,?,?,00401E9E,?,?,?,?,00401DFB,?,?,?), ref: 004021FC
Memory Dump Source
  • Source File: 00000000.00000002.1667087219.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.1667061091.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667112860.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667134465.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_rpcnetp.jbxd
Similarity
  • API ID: HandleThread$CloseCodeCreateExitObjectRemoteSingleWait
  • String ID:
  • API String ID: 3128336559-0
  • Opcode ID: 7dd46b2e84a05e2a0139bf82f292dcfc2f30c86a21051ab4026cd52fe93b73b0
  • Instruction ID: 8122dd7984b6be64f1b0c5f5c9ab7c3ef1e894c08d3148ac22cfcd468644eb06
  • Opcode Fuzzy Hash: 7dd46b2e84a05e2a0139bf82f292dcfc2f30c86a21051ab4026cd52fe93b73b0
  • Instruction Fuzzy Hash: 12F0B476000104BBD7009794CE4EFFE367CEB85B20F204229FA11B21E0DBB8A9419728
APIs
Strings
Memory Dump Source
  • Source File: 00000000.00000002.1667304746.0000000000A21000.00000020.00000001.01000000.00000004.sdmp, Offset: 00A20000, based on PE: true
  • Associated: 00000000.00000002.1667291762.0000000000A20000.00000002.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667318567.0000000000A26000.00000004.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667332190.0000000000A27000.00000002.00000001.01000000.00000004.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_a20000_rpcnetp.jbxd
Similarity
  • API ID: lstrcpy
  • String ID: ($TagId
  • API String ID: 3722407311-2515966560
  • Opcode ID: fcc1cec1baad939a96305a0095b867f7211c2df25575ef971ee40bb21592d2d3
  • Instruction ID: f9915d46e7f3a6052cee48e0dc84b1d289f1558c74323da4a684b48cef7c3d55
  • Opcode Fuzzy Hash: fcc1cec1baad939a96305a0095b867f7211c2df25575ef971ee40bb21592d2d3
  • Instruction Fuzzy Hash: 21310572A00269AFDB21CFA9DC84DEEB7F8BF58300F144539E526E6150DB74AA04DF20
APIs
Strings
Memory Dump Source
  • Source File: 00000000.00000002.1667087219.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.1667061091.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667112860.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667134465.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_rpcnetp.jbxd
Similarity
  • API ID: lstrcpy
  • String ID: ($TagId
  • API String ID: 3722407311-2515966560
  • Opcode ID: d3b58252124b0ac098eb98d3b1ee8a9bd791280dee38920877c0728637a4094a
  • Instruction ID: 9bd5df99f3b3113a56912b3e4830ed530f33bf6383fff5d3ce4fbcee489ba96c
  • Opcode Fuzzy Hash: d3b58252124b0ac098eb98d3b1ee8a9bd791280dee38920877c0728637a4094a
  • Instruction Fuzzy Hash: B931D671900249ABDB21DFA5CC859EFB7B8BF04300F14453AE565F62A0DB79AA049B24
APIs
  • PostThreadMessageA.USER32(00000012,00000000,00000000), ref: 00A22223
  • WaitForSingleObject.KERNEL32(00007530), ref: 00A22234
  • CloseHandle.KERNEL32 ref: 00A22240
  • CreateThread.KERNEL32(00000000,00000000,00A22AB6,00000000,00000000,00A25010), ref: 00A222EE
Memory Dump Source
  • Source File: 00000000.00000002.1667304746.0000000000A21000.00000020.00000001.01000000.00000004.sdmp, Offset: 00A20000, based on PE: true
  • Associated: 00000000.00000002.1667291762.0000000000A20000.00000002.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667318567.0000000000A26000.00000004.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667332190.0000000000A27000.00000002.00000001.01000000.00000004.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_a20000_rpcnetp.jbxd
Similarity
  • API ID: Thread$CloseCreateHandleMessageObjectPostSingleWait
  • String ID:
  • API String ID: 3204264564-0
  • Opcode ID: 38a8233ad418a76648b83779c39cffd98726d82a61096d1c84dd86b54e0f9818
  • Instruction ID: a16a27a885e3addc47e601d4f3053ab8ca152b3c651a8ad49a80ce320df45c05
  • Opcode Fuzzy Hash: 38a8233ad418a76648b83779c39cffd98726d82a61096d1c84dd86b54e0f9818
  • Instruction Fuzzy Hash: E1218C71C4CAA4FEEB32DBFCBC80BB57BA8BB153447044074E54256131C2360947EBA0
APIs
  • PostThreadMessageA.USER32(00000012,00000000,00000000), ref: 00402223
  • WaitForSingleObject.KERNEL32(00007530), ref: 00402234
  • CloseHandle.KERNEL32 ref: 00402240
  • CreateThread.KERNEL32(00000000,00000000,00402AB6,00000000,00000000,00405010), ref: 004022EE
Memory Dump Source
  • Source File: 00000000.00000002.1667087219.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.1667061091.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667112860.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667134465.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_rpcnetp.jbxd
Similarity
  • API ID: Thread$CloseCreateHandleMessageObjectPostSingleWait
  • String ID:
  • API String ID: 3204264564-0
  • Opcode ID: ec24359d780d0092ed2721f109fcf85f989c54bc74de86bfcae5e0e311e00460
  • Instruction ID: 5048084c2e6edd88962fef6f151fccf2681ddf64870c56c701b03647ee5dcd97
  • Opcode Fuzzy Hash: ec24359d780d0092ed2721f109fcf85f989c54bc74de86bfcae5e0e311e00460
  • Instruction Fuzzy Hash: EC217171444A84BEEB129BA0AF88A5F7F58F705348B0440BAE545761F2D3B90D84EFAD
APIs
  • WaitForSingleObject.KERNEL32(?,00001388), ref: 00A224FA
  • TerminateThread.KERNEL32(?,00000000), ref: 00A2250F
  • CloseHandle.KERNEL32(?), ref: 00A2251B
  • LocalFree.KERNEL32(?), ref: 00A22522
    • Part of subcall function 00A21A6E: GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00A21A94
    • Part of subcall function 00A21A6E: TranslateMessage.USER32(?), ref: 00A21ABB
    • Part of subcall function 00A21A6E: DispatchMessageA.USER32(?), ref: 00A21AC5
Memory Dump Source
  • Source File: 00000000.00000002.1667304746.0000000000A21000.00000020.00000001.01000000.00000004.sdmp, Offset: 00A20000, based on PE: true
  • Associated: 00000000.00000002.1667291762.0000000000A20000.00000002.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667318567.0000000000A26000.00000004.00000001.01000000.00000004.sdmpDownload File
  • Associated: 00000000.00000002.1667332190.0000000000A27000.00000002.00000001.01000000.00000004.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_a20000_rpcnetp.jbxd
Similarity
  • API ID: Message$CloseDispatchFreeHandleLocalObjectSingleTerminateThreadTranslateWait
  • String ID:
  • API String ID: 2048180657-0
  • Opcode ID: 63671376b720e0a1af71f2da2005980d59e281b3bca9f0c5e3fa99e063fff430
  • Instruction ID: d5b834a88d62b0e390462ef4905034535d06ed3b0e06b50a075c60441f327326
  • Opcode Fuzzy Hash: 63671376b720e0a1af71f2da2005980d59e281b3bca9f0c5e3fa99e063fff430
  • Instruction Fuzzy Hash: EDF02E30201B20BBC732ABACED09FEE775CEF10711F444134F51595190C7789A42CB95
APIs
  • WaitForSingleObject.KERNEL32(?,00001388), ref: 004024FA
  • TerminateThread.KERNEL32(?,00000000), ref: 0040250F
  • CloseHandle.KERNEL32(?), ref: 0040251B
  • LocalFree.KERNEL32(?), ref: 00402522
    • Part of subcall function 00401A6E: GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00401A94
    • Part of subcall function 00401A6E: TranslateMessage.USER32(?), ref: 00401ABB
    • Part of subcall function 00401A6E: DispatchMessageA.USER32(?), ref: 00401AC5
Memory Dump Source
  • Source File: 00000000.00000002.1667087219.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.1667061091.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667112860.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.1667134465.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_rpcnetp.jbxd
Similarity
  • API ID: Message$CloseDispatchFreeHandleLocalObjectSingleTerminateThreadTranslateWait
  • String ID:
  • API String ID: 2048180657-0
  • Opcode ID: dbd711cf2186b05b19fe5e252099d816eeb2c3fa283710d888582fd106f8db48
  • Instruction ID: e0533b2128b86761e9aab4ab1d0d73a85fdb416855143be9988b913b9b9876ad
  • Opcode Fuzzy Hash: dbd711cf2186b05b19fe5e252099d816eeb2c3fa283710d888582fd106f8db48
  • Instruction Fuzzy Hash: 76F08231201A10BBDB226B71DE0DBDF775CAF01715F04453AFA95B52E1CBB89A408BAD